Vaultwarden: Self-Hosted Password Management Done Right

Password reuse is the number one cause of business account compromises. One employee reuses their personal password for their work email. That personal account gets breached. Now the attacker has access to your business email. Vaultwarden solves this by making unique, strong passwords effortless for every employee.

What Vaultwarden Is

Vaultwarden is a self-hosted implementation of the Bitwarden password manager API, written in Rust for efficiency. It is fully compatible with all Bitwarden clients: browser extensions for Chrome and Firefox, desktop apps for Windows, Mac, and Linux, and mobile apps for iOS and Android. Your team installs the Bitwarden app, points it at your Vaultwarden server, and uses it exactly like they would use Bitwarden's commercial service. But your passwords are on your server, not Bitwarden's.

Vaultwarden is free and open-source. It includes all premium Bitwarden features (TOTP two-factor code generation, file attachments, organisation support, and emergency access) at no cost. The commercial Bitwarden charges 3 to 5 US dollars per user per month for these features. Vaultwarden includes them for everyone.

Setting It Up

Vaultwarden deploys via Docker in five minutes. A single container with a SQLite database handles up to 50 users without performance issues. Enable HTTPS (this is mandatory for the browser extension to work), configure SMTP for email verification and password reset, and invite your team.

The admin panel lets you manage users, enforce two-factor authentication policies, and view audit logs. You can see who accessed which password and when. For a business with compliance requirements, this audit trail is essential.

Organisational Sharing

Vaultwarden supports organisations: shared collections of passwords that teams can access. Create a Finance collection with bank logins. Create an IT collection with server credentials. Create a Marketing collection with social media account passwords. Assign users to collections based on their role. When someone leaves, remove them from the organisation and they lose access to everything immediately.

This granular sharing is what separates a business password manager from a personal one. Every employee has their own private vault, plus access to shared collections they need for their job. No one shares passwords over email or WhatsApp. No one stores passwords in a spreadsheet. No one reuses passwords because they cannot remember unique ones.

Two-Factor Authentication Built In

Vaultwarden can generate TOTP codes for any account that supports two-factor authentication. Instead of using a separate authenticator app, your team stores TOTP seeds in Vaultwarden. When they log into an account, the browser extension auto-fills both the password and the TOTP code. This makes two-factor authentication effortless, which means your team actually uses it.

Vaultwarden itself supports two-factor authentication for login: TOTP, WebAuthn (hardware security keys), Duo, and YubiKey OTP. Require 2FA for all users through the admin panel. A password manager protecting all your passwords must itself be protected by the strongest authentication available.

The Cost

Bitwarden Teams: 3 US dollars per user per month. For 15 people, that is 540 dollars per year. Vaultwarden on your existing server costs zero dollars per year in software licensing. The server is already running for other applications. Vaultwarden adds roughly 100MB of RAM and negligible CPU. It is the simplest cost-saving deployment in your entire stack.

VPS1 deploys Vaultwarden with SSO and enforced 2FA policies. Your team gets a professional password manager. You get the assurance that every account in your business is protected by a unique, strong password.