For most people who want to host their own password manager, Vaultwarden is the answer: it is a small server that works with the official Bitwarden apps and browser extensions. Teams that share credentials and want a strict, auditable setup should look at Passbolt. If you don't want a server at all, a KeePass file synced between your devices does the job.
Hosting your own vault moves responsibility to you. The second half of this guide covers the parts you can't skip: backups, two-factor authentication and locking down the admin page.
Should you self-host a password manager at all?
It is a fair question. 1Password and Bitwarden's cloud service are run by people whose full-time job is keeping vaults safe. When you host it yourself, a missed backup or a server you forgot to update is your problem.
What you get in return: your encrypted vault lives on a machine you control, you are not tied to a vendor's pricing, and features that cost money elsewhere are often included. If you already run a few apps of your own and you are disciplined about backups, self-hosting is a reasonable choice. If you have never restored a backup, start there before you move your passwords.
Vaultwarden
Vaultwarden is an "alternative server implementation of the Bitwarden Client API, written in Rust." In plain terms: you run Vaultwarden on your server, then use the official Bitwarden apps for Windows, macOS, Linux, Android, iOS and the browsers, and point them at your own address instead of Bitwarden's cloud.
It is by far the most popular option here, with about 69,000 GitHub stars (October 2026). Version 1.37.4 came out on 5 October 2026. The repository is licensed under the AGPL-3.0. The project is not affiliated with Bitwarden, Inc., and asks you not to send bug reports to Bitwarden's support.
The README calls it "a nearly complete implementation of the Bitwarden Client API". That covers the personal vault, Send, attachments, organizations with collections and groups, emergency access and two-factor login with authenticator apps, email, FIDO2 keys, YubiKey and Duo.
Vaultwarden is lightweight. It runs as a single container, uses SQLite by default and is happy on a small VPS or a home server. The web vault needs HTTPS, because browsers only allow the cryptography it uses in a secure context.
Who it is for: individuals, families and small teams who want the Bitwarden experience without running Bitwarden's own server stack.
Bitwarden (official server)
The official Bitwarden server is open source too, with about 20,000 GitHub stars (October 2026) and an AGPL-3.0 license. You can host it yourself with Docker. It is the heavier option, and Vaultwarden describes itself as made for setups "where running the official resource-heavy service might not be ideal". Choose it if you want the vendor's own code and the option of buying support from Bitwarden.
Passbolt
Passbolt is built for teams. It has about 6,200 GitHub stars (October 2026), released v5.16.0 on 17 September 2026 and uses the AGPL-3.0 license. Encryption is based on OpenPGP: each user has a key, and the server has its own GPG key.
The free Community Edition has no user limit. It includes password sharing, private and shared folders, users and groups, two-factor authentication, browser extensions, a CLI, an API and role-based access control. The paid Pro edition adds things companies ask for, such as LDAP sync, SSO with Microsoft, Google or OpenID, account recovery and an activity log.
Setup is a Docker Compose file. You also need a working SMTP server, because Passbolt sends invitations and recovery emails, and a working time sync on the host, otherwise the GPG authentication can fail.
Who it is for: IT teams and agencies that share many credentials and want clear control over who sees what. For one person it is more machinery than needed.
Psono
Psono is a password manager aimed at companies. It encrypts vault data in the client before it reaches the server, has apps for Windows, macOS, Linux, Android and iOS, and browser extensions for Chrome, Firefox and Edge. Every component can run on your own servers. According to its website, the business features are free for up to 10 users. The code lives on GitLab and is licensed under Apache 2.0.
Who it is for: small companies that want team features without paying from the first user. It has a smaller community than Vaultwarden, so expect fewer tutorials.
AliasVault
AliasVault is newer and smaller, with about 3,200 GitHub stars (October 2026) and an MIT license. Besides an end-to-end encrypted password vault it has a built-in email alias generator and its own mail server, so every account you create can get its own address. Interesting if you care about spam and tracking, but it is a younger project than the others here.
KeePass: no server at all
KeePass-style managers keep everything in one encrypted .kdbx file. KeePassXC is a desktop app for Windows, macOS and Linux that keeps the data in "an offline, encrypted file that can be stored in any location". KeeWeb is a browser and desktop app that opens the same files and can load them from Dropbox, Google Drive or OneDrive.
To use the file on several devices, you sync it yourself, for example with Syncthing or a Nextcloud folder. This works well for one person. For a family it gets messy, because two people editing the same file at the same time leads to conflicts, and sharing single entries is not possible.
Who it is for: individuals who want zero servers and full control over one file.
Comparison table
| Vaultwarden | Bitwarden server | Passbolt | Psono | KeePass file | |
|---|---|---|---|---|---|
| Best for | Individuals, families, small teams | Organizations wanting vendor code | Teams sharing credentials | Small companies | One person |
| Apps | Official Bitwarden apps | Official Bitwarden apps | Browser extensions, CLI | Desktop, mobile, browser | KeePassXC, KeeWeb and others |
| Sharing | Organizations, collections | Organizations, collections | Folders, groups, roles | Team features | Not per entry |
| Free tier limits | None | See Bitwarden's plans | CE: unlimited users | Business features up to 10 users | None |
| Runs as | One container | Docker | Docker Compose + SMTP | Own server | No server |
| License | AGPL-3.0 | AGPL-3.0 | AGPL-3.0 | Apache 2.0 | Depends on app |
Security notes you should not skip
Backups
A password manager without backups is a liability. For Vaultwarden with its default SQLite database, the wiki lists what to save: db.sqlite3 (take it with SQLite's .backup command or Vaultwarden's built-in backup, not a plain copy while the server runs), the attachments/ folder, config.json and the rsa_key* files. Copy them somewhere off the server, and restore them once on another machine to prove it works. The Vaultwarden maintainers say plainly that they "cannot be held liable for any data loss" and strongly recommend regular backups.
Two-factor authentication
Turn it on for every account, starting with your own. An authenticator app or a hardware key both work with Vaultwarden. Keep the recovery codes outside the vault, on paper if you like.
The admin page
Vaultwarden's admin page at /admin is protected by ADMIN_TOKEN. Treat that token like a root password. The wiki recommends storing it as an Argon2 hash so it can't be read from your configuration, enabling HTTPS before you switch the page on, and keeping sessions short. If you don't need the admin page, leave the token unset and the page stays disabled.
Signups
After you and your family have accounts, set SIGNUPS_ALLOWED=false so strangers can't create accounts on your server. You can still invite people from the admin page.
Updates
Follow the release notes and update promptly. A password server facing the internet is not something to leave on last year's version.
How to run them
The common route is your own server with Docker: Vaultwarden is one container with a volume, Passbolt ships a Compose file. Put a reverse proxy with HTTPS in front and set up backups on day one. If self-hosting is new to you, read self-hosting for beginners first.
The other route is a managed host. On blitz.cloud, Vaultwarden installs in one click from its App Store, hosted in the EU with HTTPS included. The free plan needs no credit card, but apps sleep after 30 minutes without visitors, so the first sync after a quiet spell takes a moment. The other tools on this page are not in its store, so for those Docker on your own server is the way.
More options are listed under 1Password alternatives.
FAQ
Is Vaultwarden safe to use?
The vault is encrypted on your device before it reaches the server, the same as with Bitwarden. The risks are in how you run it: missing backups, an exposed admin page, open signups or old versions. Fix those and it is a solid setup.
Can I use the Bitwarden app with Vaultwarden?
Yes. Install the official Bitwarden app or browser extension, choose the self-hosted option at login and enter your server's address.
Which password manager is best for a team?
Passbolt if you want fine-grained sharing with groups and roles and an unlimited free edition. Vaultwarden organizations are enough for many small teams, and you keep the Bitwarden apps everyone knows.
Do I need a server for KeePass?
No. KeePass keeps everything in one encrypted file. You only need a way to sync that file between devices, such as Syncthing.
What happens if my server goes down?
An unlocked Bitwarden app can still show your vault in read-only mode. You can't add or change entries until the server is back.