The best self-hosted password manager for most people in 2026 is Vaultwarden. It lets you run your own server and keep the official Bitwarden apps on iOS, Android, desktop and the major browsers, with every premium feature unlocked, on a 512 MB server that costs about $3/mo no matter how many people share it. Pick something else in four cases: you need a vendor with compliance paperwork (Bitwarden’s own server), you need per-credential sharing, with an access log on its paid plan (Passbolt), you need business admin controls for up to 10 users at no cost (Psono), or you want no server at all (KeePassXC).

I build InstaPods, which hosts Vaultwarden as a one-click app, so read the ranking with that in mind. Every price below was re-checked against the vendor’s own page on 2026-10-05.

Want the short version? The self-hosted password manager comparison table puts the options side by side with current prices. This post is the long read, with the reasoning behind each pick.

TL;DR: Which Self-Hosted Password Manager to Pick

Tool Client apps Server footprint (RAM) Cost (USD) Best for
1. Vaultwarden Official Bitwarden apps on every platform Single Rust binary, fine in 512 MB Free software + a $3/mo server, any number of users Almost everyone
2. Bitwarden (self-hosted) Official Bitwarden apps Standard: 2 GB minimum, 4 GB recommended. Lite: 200 MB Free for 1 user, Premium $1.65/mo, Families $3.99/mo, Enterprise $6/user/mo, all billed annually (Teams is cloud-only) Teams that need a certified vendor and support
3. Passbolt Browser extension first, mobile apps available PHP + MariaDB, moderate Community Edition free, Pro $4.9/user/mo billed annually (10 user minimum) Teams that need granular sharing (free) and an access log (Pro)
4. Psono Web, browser extensions, desktop and mobile apps Django + PostgreSQL, moderate All business features free up to 10 users, then paid per user Small businesses that want admin controls
5. KeePassXC + your own sync Great desktop, third-party mobile apps No server at all Free Solo users who want zero infrastructure

Short version: pick Vaultwarden unless you have a specific reason not to. Everything else on this list is a tradeoff you take on purpose, and the section when Vaultwarden is the wrong pick says which one.

This list had six entries when I first wrote it in July 2026. Padloc is gone from the ranking, and the reason is further down.

How I Judged These Password Managers

Self-hosted password managers are judged badly when you compare feature checklists. What decides whether a self-hosted vault survives contact with real life is three things:

  1. Client apps. You will open this thing ten times a day on your phone and in your browser. A great server with mediocre autofill loses to a decent server with excellent autofill every time.
  2. Server footprint. A vault is a background service that should be boring and cheap. If it needs 2 GB of RAM and several services, that is a real machine you now maintain.
  3. Honest cost at your team size. Free-for-one-user tells you nothing. The number that matters is what it costs when six people or twenty people need it.

Prices checked 2026-10-05 on bitwarden.com/pricing, passbolt.com/pricing and psono.com. Bitwarden’s system requirements come from its install docs, linked in its section. Vaultwarden publishes no minimum, so the 512 MB figure is the size of the plan InstaPods runs it on.

1. Vaultwarden: The Default (Official Bitwarden Apps, 512 MB Server)

Vaultwarden is a community reimplementation of the Bitwarden server, written in Rust and licensed AGPL-3.0, with about 68,500 GitHub stars and version 1.37.3 released on 13 September 2026. It implements the Bitwarden API, which is the entire trick: you run your own server and keep using the official Bitwarden apps. iOS, Android, desktop, all the browser extensions, the CLI. You set a self-hosted server URL at login and everything else is the client you already know.

Why it wins: every non-Bitwarden vault on this list asks you to accept less polished apps. Vaultwarden does not, because it is not writing apps at all, and unlike Bitwarden’s own server it does not gate features behind a license.

Footprint: a single Rust binary with a SQLite database. It is comfortable in well under 512 MB, which is why it is the option people run on a Raspberry Pi or the cheapest VPS they can find.

What it costs: the software is free. You pay for a small server. On InstaPods that is $3/mo on the Launch plan, and that number does not change when you add your family or your team to the same server. Compare that to Bitwarden’s hosted Teams plan at $4 per user per month billed annually, where a 10-person team is $480/yr, or to Enterprise at $6 per user per month, the cheapest business plan Bitwarden lets you self-host, at $720/yr.

Premium features are unlocked. The integrated authenticator, file attachments, emergency access and organizations all work for every account, because there is no billing tier gating them.

The honest caveat is who checks the code. Two outside examinations of Vaultwarden have been published, and both found real problems. Germany’s Federal Office for Information Security announced its code analysis of Vaultwarden 1.30.3 on 14 October 2024, with two vulnerabilities rated high. An ERNW penetration test at the end of October 2024 found three issues: an authentication bypass and two lesser ones, an email HTML injection and a self-XSS. Those fixes were completed in version 1.32.5 on 18 November 2024. The BSI says the developers had already responded to its findings when it published. Both are a reminder to keep the server updated. What Vaultwarden still does not have is what Bitwarden Inc. has: a recurring audit programme the vendor pays for and a compliance certification. The encryption model is identical (client-side, zero-knowledge, the server never sees your master password). If certification is a hard requirement, item 2 on this list is your answer.

Best for: individuals, families and small teams who want the Bitwarden experience on their own hardware. Full side-by-side: Vaultwarden vs Bitwarden. Setup walkthrough, both the Docker route and the one-click route: How to self-host Vaultwarden.

2. Bitwarden Self-Hosted: The Certified Original

Bitwarden Inc.’s own server can be self-hosted, with the same apps and the same vault as Vaultwarden. What Bitwarden adds is the thing Vaultwarden cannot offer: a server that is independently audited on a schedule, from a company you can buy a support contract from.

There are now two ways to run it. The standard deployment is a multi-service Docker stack with MSSQL Express behind it. Bitwarden’s docs list 2 GB of RAM and 12 GB of storage as the minimum and 4 GB of RAM as recommended, which is four to eight times the 512 MB server Vaultwarden fits in, for the same job on the same clients. The second is Bitwarden lite, which left beta in December 2025: a single Docker image that needs 200 MB of RAM, runs on ARM, and can use SQLite, PostgreSQL or MySQL instead of MSSQL.

Bitwarden lite closes most of the footprint gap, with one limit. Bitwarden’s own page says lite is “intended for personal use and home-labs, not for use in business contexts”. So for a home-lab, what separates Vaultwarden from Bitwarden lite is now licensing rather than RAM.

Pricing: Bitwarden is free for one user with unlimited passwords on unlimited devices. Premium is $1.65/mo (billed annually at $19.80). Families is $3.99/mo for up to 6 users (billed annually at $47.88). Teams is $4 per user per month and Enterprise is $6 per user per month, both billed annually. Self-hosting does not remove the licensing for premium and organization features, which is the practical difference from Vaultwarden. Bitwarden’s plans page says only Families and Enterprise organizations can be moved to a self-hosted server, so Teams is cloud-only.

Best for: organizations with a compliance requirement that names a certified vendor, or anyone who wants a vendor’s support queue to file a ticket with. The certificates cover Bitwarden as a vendor. A server you host yourself is still yours to secure.

3. Passbolt: Team Sharing With an Access Log

Passbolt is a self-hosted password manager built team-first rather than individual-first. Its model is OpenPGP-based and sharing is granular down to the individual credential. Granular sharing is in the free Community Edition. The activity log of who accessed what is a Pro feature, so if the log is why you are here, budget for Pro.

Pricing: the Community Edition is free and open source under AGPL-3.0. Pro is $4.9 per user per month billed annually, with a 10 user minimum, so the realistic entry point for Pro is about $588/yr. Enterprise is custom.

The tradeoff: the browser extension is the primary experience and it is good. Mobile is available but does not feel as complete as Bitwarden’s, and the PHP + MariaDB stack is a heavier thing to run than a single Rust binary. The project is active: version 5.16.0 of the API shipped on 17 September 2026.

Best for: teams that need per-credential sharing rules, or an access log on the Pro plan, and are willing to give up some client polish to get them.

4. Psono: Business Controls, Free Up to 10 Users

Psono is a self-hosted password manager aimed at businesses. Its site states the offer in one line: “All business features free up to 10 users”. Past 10 users it is paid per user: Psono’s enterprise page says pricing starts at EUR 2.5 per user for teams of at least 25, and professional support or an SLA is by quote.

The stack is Django with PostgreSQL, plus a separate web client, which makes Psono a heavier install than Vaultwarden but a familiar one if you already run Python services.

Clients cover more than they used to. Psono lists apps for macOS, Windows and Linux and for iOS and Android, on top of the web client and browser extensions. They are Psono’s own apps, so the comparison with Bitwarden’s much larger install base still favors Bitwarden on polish.

Best for: companies of 10 people or fewer that want admin-side controls on infrastructure they own without paying per seat.

5. KeePassXC Plus Your Own Sync: No Server at All

Not every self-hosted password manager is a server. KeePassXC is a local application built around a single encrypted .kdbx file. There is no backend to run, patch or back up beyond the file itself. Sync it with Syncthing, Nextcloud, or whatever file sync you already have, and you have a password manager with the smallest possible attack surface: nothing is listening on a port.

The catch is mobile and sharing. The official project is desktop; mobile means third-party apps (KeePassDX on Android, Strongbox on iOS) that are good but are not one unified product. And file-based sync means conflict files are a real thing that will happen to you eventually if two devices write at once.

Cost: free. The current release is 2.7.12, from March 2026.

Best for: one person who wants maximum control and minimum infrastructure, and who is not sharing credentials with anyone.

When Vaultwarden Is the Wrong Pick

Vaultwarden is my default pick, and there are four situations where I would send you elsewhere:

Why Padloc Is No Longer on This List

Padloc was the sixth pick when this post went up in July 2026, described as the simple modern option. I took it off the ranking in October 2026 because the project has gone quiet. The last tagged release on the Padloc GitHub repository is v4.3.0 from 6 March 2023, and the last commit on its main branch is from 10 December 2023. Padloc still works and the code is still AGPL-3.0, but a password manager is the one application you least want to be on when security fixes stop arriving. I would not start a new vault on it today.

What Most People Should Actually Do

Run Vaultwarden. The reasoning is not complicated: Vaultwarden gives you the official Bitwarden apps on every platform without Bitwarden’s licensing, it runs on the cheapest server you can buy, and the per-user pricing disappears entirely. The certification gap is real and you should know about it, but for a household or a small team it is a reasonable trade for owning your own vault.

If you want to try it without spending an evening on Docker, a reverse proxy and a certificate, you can deploy Vaultwarden on InstaPods in one click for $3/mo, with HTTPS, a domain, SSH access and a nightly backup already handled. Adding a card gets you a one-time $10 credit, which covers about 3 months on that plan. Then point the Bitwarden apps at it and get on with your day.

Self-Hosted Password Manager FAQ

What is the best self-hosted password manager?

For most individuals, families and small teams it is Vaultwarden. Vaultwarden is a Rust server that implements the Bitwarden API, so you keep using the official Bitwarden apps on every platform while the vault lives on your own server. It runs in well under 512 MB of RAM. Pick Bitwarden’s own server instead if you need a vendor with SOC 2 and ISO 27001 paperwork, Passbolt if you need per-credential sharing, with an access log on its paid plan, and KeePassXC if you want no server at all.

Is Vaultwarden safe to use?

Vaultwarden uses the same client-side, zero-knowledge encryption as Bitwarden, so the server never sees your master password. Two outside examinations have been published: Germany’s BSI announced a code analysis of Vaultwarden 1.30.3 on 14 October 2024 with two high-severity findings, and an ERNW penetration test in late October 2024 found an authentication bypass and two lesser issues, fixed in version 1.32.5. What Vaultwarden does not have is a recurring vendor-commissioned audit programme or a compliance certification.

Can I self-host Bitwarden for free?

Yes. Bitwarden’s server can be self-hosted at no charge in two forms: the standard deployment, which needs at least 2 GB of RAM (4 GB recommended), and Bitwarden lite, a single Docker image that needs 200 MB of RAM and is intended for personal use and home-labs. Premium and organization features still need a paid Bitwarden license when you self-host.

How much does a self-hosted password manager cost?

The software is free for Vaultwarden, KeePassXC, Passbolt Community Edition and Bitwarden’s self-hosted server. What you pay for is the server. Vaultwarden fits a 512 MB machine, which is $3/mo on the InstaPods Launch plan, and that price does not change with the number of users. Bitwarden’s hosted Teams plan is $4 per user per month billed annually, so 10 people cost $480 a year, and the Enterprise plan you need to self-host a business organization is $6 per user per month, or $720 a year.

Do I need a server to self-host a password manager?

No. KeePassXC stores the whole vault in one encrypted .kdbx file that you sync with Syncthing, Nextcloud or any file sync you already run. Nothing listens on a port. The tradeoff is that mobile needs third-party apps and sharing credentials with other people is awkward.

More reading: Vaultwarden vs Bitwarden, how to self-host Vaultwarden step by step, and the full self-hosted apps directory.