The default is to trust a company with your passwords. You sign up for 1Password or Bitwarden, hand over your vault, and hope they never get breached, acquired, or change their pricing. For most people that's a fine trade-off. For me it wasn't.

What Vaultwarden is

Vaultwarden is an unofficial, open-source implementation of the Bitwarden server, written in Rust. It's compatible with every official Bitwarden client — browser extensions, mobile apps, desktop apps — so you get the full experience without paying Bitwarden to host your data. You run the server yourself.

It's small. On my 1-core VPS it uses about 10 MB of RAM at idle. It runs in a single Docker container and has been rock-solid for me since I set it up.

The setup

The stack is simple: Docker Compose runs the Vaultwarden container, and Caddy sits in front of it as a reverse proxy handling HTTPS automatically via Let's Encrypt. The whole thing took about an hour to get right.

The Caddyfile entry is four lines:

vault.yourdomain.com {
    reverse_proxy vaultwarden:80
}

Caddy handles certificate issuance, renewal, and HTTPS redirect. You never touch a cert file. That part genuinely surprised me — I expected it to be the most annoying part, and it was the easiest.

The trade-offs

Self-hosting means you own the responsibility. If your server goes down, you can't log in to new sites until it's back. If you forget to take backups and your VPS provider has a bad day, your vault is gone. These are real risks you need to plan for.

My mitigations:

  • Daily automated backups of the SQLite database to a separate location
  • Bitwarden's own emergency access feature as a fallback
  • The official mobile apps cache your vault locally, so short outages are invisible

Why it's worth it

Control. Privacy. Cost. My passwords live on hardware I manage, in a jurisdiction I chose. No subscription fee beyond the $6/month VPS I was already running. No terms-of-service changes that could lock me out or change how my data is handled.

There's also something clarifying about running your own critical infrastructure. You understand exactly what's happening and why. That understanding compounds — every problem I've debugged on this server has taught me something that's useful elsewhere.

Would I recommend it?

If you're already comfortable with Docker and a terminal, yes — do it this weekend. If you're not, start there first. The Vaultwarden setup itself is genuinely easy; the prerequisite is being able to manage a Linux server without panicking.

The thing I wish someone had told me: the hardest part isn't the setup, it's building the habit of actually taking those backups.

← Back to Writing