Top picks by use case
| Use case | Recommended | Why |
|---|---|---|
| Bitwarden-compatible self-host | Vaultwarden | Lightweight, all official Bitwarden clients work |
| File-based, no server | KeePassXC + sync | Single encrypted file; sync via any tool |
| Team / business sharing | Passbolt | Designed around team sharing primitives |
| Secrets API + UI in one | Psono | Has API-token workflow alongside vault |
| Minimal, paranoid | KeePassXC with local-only | Offline, no service surface to attack |
The main contenders
An unofficial, Rust-based reimplementation of the Bitwarden server API. Tiny — ~50MB image, ~30MB RAM — runs comfortably on a Pi or N100 mini PC. All official Bitwarden clients (browser, mobile, desktop, CLI) work against it, including 2FA, organizations, and most paid-tier features. The de facto standard for self-hosted password management.
Best for: individuals and small teams who want Bitwarden polish without paying for the SaaS or running the heavy official server.
A single AES-encrypted database file you sync however you want — Syncthing, Nextcloud, S3, even Dropbox. No server to run, no API surface, no upgrades to schedule. Browser and mobile clients (KeePassDX, Strongbox) read the same file. The most resilient choice for a one-person vault.
Best for: single users, paranoid users, anyone who wants no running service.
Built around team sharing from day one. Group-based ACLs, OpenPGP-based key model, audit log. Browser extension and mobile apps. Community edition is open-source; pro tier adds SSO and directory sync. Heavier to operate than Vaultwarden (PHP + MariaDB + GPG keys) but better for organizations with sharing-heavy workflows.
Best for: small teams, agencies, companies that don't want to outsource secret management.
Password manager plus API-token / secrets store in one. Useful when you want one tool for "human" passwords and "machine" tokens. Browser extension, mobile apps, CLI. Self-host with Docker.
Best for: small dev teams who want secrets and passwords in one tool.
Padloc is a modern Bitwarden alternative with its own clients — niche but well-built. The official Bitwarden server is also self-hostable but heavy (multiple services, MSSQL by default). Most homelabbers pick Vaultwarden instead and never look back.
Best for: users with specific reasons not to use Vaultwarden.
What actually matters
- Client coverage: a self-hosted vault is only as useful as its clients. Vaultwarden wins because it inherits the whole Bitwarden client ecosystem.
- Backup story: if you lose the database and the encryption keys, the vault is gone. Automate daily encrypted backups off the host.
- TLS: never expose a password manager over plain HTTP. Use a reverse proxy with Let's Encrypt — see best reverse proxy.
- Two-factor: enable on the vault and on the reverse proxy access if exposed to the internet.
- Recovery key: store an offline copy of your master password / recovery key. Hardware password backup (printed + safe deposit box) is reasonable for the master key.
Self-hosted vs managed (Bitwarden cloud, 1Password)
Managed services do the operational work for you: backups, patching, uptime. The trade-off is trust — you're depending on the provider's security posture. For most individuals, managed is the right call. Self-hosting makes sense if you've already got a homelab and the marginal cost is low, or if compliance/privacy requires data residency you control. See Bitwarden vs 1Password for the managed comparison.
Exposing to the internet — or not
You don't have to. Vaultwarden over Tailscale (no public DNS, no exposed port) is more secure than Vaultwarden behind Cloudflare. Mobile clients sync the same way once your phone joins the tailnet. Recommended unless you genuinely need browser access from arbitrary networks.
Frequently Asked Questions
Is Vaultwarden safe?
Yes — it's a faithful reimplementation of the Bitwarden API and uses the same end-to-end encryption model. Your vault is encrypted client-side with your master password; the server only ever sees ciphertext. Many security-conscious users and companies run it in production.
How do I back up Vaultwarden?
Stop the container, copy the data directory (SQLite database + attachments), restart. Or use the built-in backup script. Encrypt the backup with a key you store separately (otherwise, an attacker who gets the backup gets the vault).
Can I migrate from Bitwarden cloud to Vaultwarden?
Yes. Export from Bitwarden cloud (encrypted JSON), point your clients to your Vaultwarden URL, log in, import. Mobile and browser clients all support changing server URLs.
What if my server goes down?
Bitwarden clients cache your vault locally. You can keep using existing passwords offline — you just can't add or sync new ones until the server is back. Web vault access stops; mobile and browser extensions keep working.
Should I expose it to the internet?
Only if you need access from networks you don't control. Tailscale / WireGuard access is more secure and simpler. If you do expose it, use a reverse proxy with TLS, enable rate limiting, and consider an extra auth layer (Authelia / Authentik).