Every self-hoster hits this decision eventually. You already run your own files, your own notes, maybe your own analytics. The passwords feel like the last thing sitting in someone else’s cloud, and moving them is either the most satisfying migration you will do or the most nerve-wracking, depending on how much you trust yourself with backups.

Here are the six self-hosted password managers actually worth considering in 2026, what each one costs, and the one thing that decides it for most people: whether there are good client apps.

Want the short version? The self-hosted password manager comparison table puts all six side by side with current prices. This post is the long read, with the reasoning behind each pick.

TL;DR: Which One to Pick

Tool Client apps Server footprint Cost Best for
1. Vaultwarden Official Bitwarden apps on every platform Single Rust binary, fine in 512 MB Free + a $3/mo server Almost everyone
2. Bitwarden (self-hosted) Official Bitwarden apps Multi-service Docker stack, ~2 GB recommended Free tier, or paid for premium/org features Teams that need a published audit and vendor support
3. Passbolt Browser extension first, mobile apps available PHP + MariaDB, moderate Community Edition free, Pro $4.9/user/mo billed annually (10 user minimum) Teams that need granular sharing and audit trails
4. Psono Web client and browser extensions Django + PostgreSQL, moderate Community Edition free, paid Enterprise Edition Businesses that want SSO and admin controls
5. KeePassXC + your own sync Great desktop, third-party mobile apps No server at all Free Solo users who want zero infrastructure
6. Padloc Web and desktop, smaller ecosystem Node.js, light Free, open source People who want a simple, modern vault and do not mind a smaller project

Short version: pick Vaultwarden unless you have a specific reason not to. It is the only option on this list where the client apps are polished, official, on every platform, and free, because they are Bitwarden’s. Everything else is a tradeoff you take on purpose.

How I Judged These

Password managers are judged badly when you compare feature checklists. What actually determines whether a self-hosted vault survives contact with real life is three things:

  1. Client apps. You will open this thing ten times a day on your phone and in your browser. A great server with mediocre autofill loses to a decent server with excellent autofill every time.
  2. Server footprint. A vault is a background service that should be boring and cheap. If it needs 2 GB of RAM and five services, that is a real machine you now maintain.
  3. Honest cost at your team size. Free-for-one-user tells you nothing. The number that matters is what it costs when six people or twenty people need it.

Every price below was checked against the vendor’s own pricing page in July 2026.

1. Vaultwarden: The Default (Official Bitwarden Apps, 512 MB Server)

Vaultwarden is a community reimplementation of the Bitwarden server, written in Rust, AGPL-3.0, around 62,000 GitHub stars. It implements the Bitwarden API, which is the entire trick: you run your own server and keep using the official Bitwarden apps. iOS, Android, desktop, all the browser extensions, the CLI. You set a self-hosted server URL at login and everything else is the client you already know.

Why it wins: every other self-hosted vault asks you to accept worse apps. Vaultwarden does not, because it is not writing apps at all.

Footprint: a single Rust binary with a SQLite database. It is comfortable in well under 512 MB, which is why it is the option people run on a Raspberry Pi or the cheapest VPS they can find.

What it costs: the software is free. You pay for a small server. On InstaPods that is $3/mo on the Launch plan, and that number does not change when you add your family or your team to the same server. Compare that to Bitwarden Teams at $4 per user per month, where a 10-person team is $480/yr.

Premium features are unlocked. The integrated authenticator, file attachments, emergency access and organizations all work for every account, because there is no billing tier gating them.

The honest caveat: Bitwarden Inc. commissions and publishes independent third-party security audits of its official server and clients. Vaultwarden has had no equivalent formal audit. The encryption model is identical (client-side, zero-knowledge, the server never sees your master password), and the project is widely used and openly reviewed, but “openly reviewed” is not “audited” and you should not pretend otherwise. If a published audit is a hard requirement, item 2 on this list is your answer.

Best for: individuals, families and small teams who want the Bitwarden experience on their own hardware. Full side-by-side: Vaultwarden vs Bitwarden. Setup walkthrough, both the Docker route and the one-click route: How to self-host Vaultwarden.

2. Bitwarden Self-Hosted: The Audited Original

You can run Bitwarden Inc.’s own server yourself. Same apps, same vault, and the thing Vaultwarden cannot offer: a server that gets independently audited every year, from a company you can buy a support contract from.

The cost of that is weight. The official self-hosted deployment is a multi-service Docker stack with MSSQL behind it, and the documentation recommends around 2 GB of RAM. That is roughly four times what Vaultwarden needs, for the same job, on the same clients.

Pricing: Bitwarden is free for one user with unlimited passwords on unlimited devices. Premium is $1.65/mo (billed annually at $19.80). Families is $3.99/mo for up to 6 users (billed annually at $47.88). Teams is $4 per user per month and Enterprise is $6 per user per month, both billed annually. Self-hosting does not remove the licensing for premium and organization features.

Best for: organizations with a compliance requirement that names a published audit, or anyone who wants a vendor with an SLA on the other end of the phone.

3. Passbolt: Team Sharing With an Audit Trail

Passbolt is built team-first rather than individual-first. Its model is OpenPGP-based, sharing is granular down to the individual credential, and it keeps an activity log of who accessed what, which is the feature that sells it to companies.

Pricing: the Community Edition is free with unlimited users. Pro is $4.9 per user per month billed annually, with a 10 user minimum, so the realistic entry point for Pro is about $588/yr. Enterprise is custom.

The tradeoff: the browser extension is the primary experience and it is good. Mobile is available but does not feel as complete as Bitwarden’s, and the PHP + MariaDB stack is a heavier thing to run than a single Rust binary.

Best for: teams that need per-credential sharing rules and an access audit trail, and are willing to give up some client polish to get them.

4. Psono: Enterprise Controls, Self-Hosted

Psono is a self-hosted password manager aimed at businesses. The Community Edition is open source and free; a paid Enterprise Edition adds the admin-side features companies ask for, like SSO integration and central user management.

The stack is Django with PostgreSQL, plus a separate web client, which makes it a heavier install than Vaultwarden but a familiar one if you already run Python services.

Clients are the web client and browser extensions. This is the weak spot relative to Bitwarden’s native app lineup.

Best for: companies that want SSO and administrative control on infrastructure they own, and who live mostly in the browser anyway.

5. KeePassXC Plus Your Own Sync: No Server at All

Not every answer is a server. KeePassXC is a local application built around a single encrypted .kdbx file. There is no backend to run, patch or back up beyond the file itself. Sync it with Syncthing, Nextcloud, or whatever file sync you already have, and you have a password manager with the smallest possible attack surface: nothing is listening on a port.

The catch is mobile and sharing. The official project is desktop; mobile means third-party apps (KeePassDX on Android, Strongbox on iOS) that are good but are not one unified product. And file-based sync means conflict files are a real thing that will happen to you eventually if two devices write at once.

Cost: free.

Best for: one person who wants maximum control and minimum infrastructure, and who is not sharing credentials with anyone.

6. Padloc: The Simple Modern Option

Padloc is an open-source, end-to-end-encrypted password manager with a clean modern interface and a self-hosting option. It is genuinely pleasant, and it is the lightest full vault here after Vaultwarden.

The honest assessment is ecosystem size. It is a much smaller project than Bitwarden or KeePass, the app coverage is thinner, and the community you would turn to when something breaks is correspondingly smaller. For a password manager, which is the single application you least want to be stuck with, that matters more than it would elsewhere.

Best for: people who want something simple and modern and are comfortable being on a smaller project.

What Most People Should Actually Do

Run Vaultwarden. The reasoning is not complicated: it is the only self-hosted vault where you get first-class official apps on every platform, it runs on the cheapest server you can buy, and the per-user pricing disappears entirely. The audit gap is real and you should know about it, but for a household or a small team it is a reasonable trade for owning your own vault.

If you want to try it without spending an evening on Docker, a reverse proxy and a certificate, you can deploy Vaultwarden on InstaPods in one click for $3/mo, with HTTPS, a domain, SSH access and daily backups already handled. Then point the Bitwarden apps at it and get on with your day.

More reading: Vaultwarden vs Bitwarden, how to self-host Vaultwarden step by step, and the full self-hosted apps directory.