Tool
Vaultwarden
An unofficial Bitwarden-compatible server written in Rust. You keep the vault database on hardware you control, and official Bitwarden clients talk to it like a private vault backend — lighter to run than the full Bitwarden stack for many home labs.
What it is
Vaultwarden (formerly bitwarden_rs) implements enough of the Bitwarden server API that desktop, browser, and mobile Bitwarden clients can sync against your instance. People usually run it in Docker with HTTPS in front, an admin token for rare ops, and a SQLite or Postgres backend. It is not published or endorsed by Bitwarden Inc.
What it replaces
It replaces Bitwarden / 1Password / LastPass cloud hosting when you want the same client apps but your ciphertext and metadata stay on your VPS or NAS. It does not replace a tested backup of the vault DB, TLS termination, or the discipline to keep clients and server versions in a working band.
License
The dani-garcia/vaultwarden repository is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). Network use of a modified server triggers source-share obligations. Official Bitwarden clients and trademarks remain Bitwarden’s; Vaultwarden is a compatible server implementation, not a rebrand of Bitwarden the company.
Where it falls over
- Feature lag vs Bitwarden’s hosted SaaS — some org / Secrets Manager / SSO paths won’t match.
- You own backups, restores, and disk failure. Lost DB without a backup is a lost vault.
- Exposing the admin panel or HTTP without TLS turns a password vault into an incident.
- Not affiliated with Bitwarden Inc.; support is community GitHub, not a vendor SLA.
- AGPL-3.0 is copyleft — modifying and offering the service has compliance work.
Who it's for
Homelab and small-team operators who already run Docker, Tailscale/reverse-proxy, and off-site backups, and who accept AGPL. Wrong tool if you wanted zero-ops hosted Bitwarden or enterprise SSO guarantees from Bitwarden Inc.
Related in this cluster
- Docker — how most people package Vaultwarden
- Nginx Proxy Manager — TLS / reverse proxy in front
- Tailscale — keep the vault off the public internet
- Nextcloud — files/sync suite, not a dedicated password vault
Verdict
Use Vaultwarden when AGPL self-hosting plus Bitwarden clients beats paying for hosted vaults, and you will treat the database like nuclear backups. Skip it if you need Bitwarden Inc. enterprise features or refuse to own TLS and restore drills.