You want your passwords on hardware you control, and you do not want to give up the Bitwarden apps you already use on your phone and in your browser. That is exactly what Vaultwarden is for: a single Rust binary that implements the Bitwarden API, so the official clients talk to your server instead of bitwarden.com.

This guide covers both routes honestly. The manual Docker Compose route is real and it works, and it is more than a docker run one-liner because a password vault without HTTPS is not a password vault. If that HTTPS layer is where you are stuck, we wrote a separate guide to exposing a self-hosted app over HTTPS covering DNS, CGNAT, certificates and reverse proxies. The one-click route skips all of it.

TL;DR: The Two Routes Compared

  Manual Docker Compose InstaPods 1-Click
Time to a working vault 20-40 minutes About 30 seconds
What you set up yourself Docker, Compose file, reverse proxy, TLS certificate, DNS, backups Nothing
HTTPS You configure Caddy or nginx + certbot Included, with a domain
Backups You write the cron job Daily, included
Cost Whatever your VPS costs, plus your time $3/mo (Launch plan)
Root SSH access Yes Yes
Official Bitwarden apps work Yes Yes

If you want to understand the moving parts, read on. If you just want the vault, deploy Vaultwarden on InstaPods and skip to the client setup section.

What You Are Actually Installing

Vaultwarden is a community reimplementation of the Bitwarden server, written in Rust, AGPL-3.0 licensed, with around 62,000 GitHub stars. It is not made by Bitwarden Inc. and it is not affiliated with them.

Two things follow from that, and both matter:

  1. The clients are unchanged. You keep using the official Bitwarden iOS app, Android app, desktop app, browser extensions and CLI. You point them at your server URL at login. Nothing is a fork, nothing is a knockoff.
  2. The premium features are unlocked. The integrated authenticator (TOTP), file attachments, emergency access and organizations all work for every account on your server, because there is no billing tier to gate them behind.

The tradeoff is honest and worth saying plainly: Bitwarden Inc. commissions and publishes independent third-party security audits of its official server and clients. Vaultwarden has had no equivalent formal audit. The encryption model is the same (your vault is encrypted client-side, and the server never sees your master password), but if a published audit is a hard requirement in your threat model, use the official Bitwarden server instead. We wrote the full side-by-side here: Vaultwarden vs Bitwarden.

Before You Start: What You Need

Route 1: The Manual Docker Compose Setup

Step 1: Create the Compose file

Make a directory and a docker-compose.yml:

mkdir -p /opt/vaultwarden && cd /opt/vaultwarden
services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "false"
      ADMIN_TOKEN: "replace-me"
    volumes:
      - ./data:/data
    ports:
      - "127.0.0.1:8080:80"

Three of those settings do real work:

docker run --rm -it vaultwarden/server /vaultwarden hash

Bind the port to 127.0.0.1 as shown. The reverse proxy is the only thing that should be able to reach Vaultwarden directly.

Step 2: Put a reverse proxy with TLS in front

Caddy is the shortest path because it gets certificates automatically. A Caddyfile this small is enough:

vault.example.com {
    reverse_proxy 127.0.0.1:8080
}

If you prefer nginx, you are looking at a server block, a proxy_pass, proxy_set_header lines for Host and X-Forwarded-For, a certbot run, and a renewal timer. It works fine, it is just more moving parts to keep alive.

Point an A record for vault.example.com at your server before you start the proxy, or the certificate issuance will fail.

Step 3: Start it and create your account

docker compose up -d

Open https://vault.example.com, create your account, then set SIGNUPS_ALLOWED: "false" and run docker compose up -d again to apply it.

Step 4: Set up backups yourself

This is the step people skip and regret. Your entire vault is ./data/db.sqlite3 plus the attachments, sends and rsa_key* files next to it. Do not copy a live SQLite file with cp; use the SQLite backup API so you get a consistent snapshot:

sqlite3 /opt/vaultwarden/data/db.sqlite3 ".backup '/backups/vw-$(date +%F).sqlite3'"

Then copy the attachments/, sends/ and rsa_key* files, and get the whole lot off the machine, because a backup that lives on the same server is not a backup. Put it on a cron schedule and test a restore at least once.

Step 5: Keep it updated

vaultwarden/server:latest does not update itself. You are on the hook for pulling new images when security releases land:

docker compose pull && docker compose up -d

That is the honest full picture: a Compose file, a proxy, DNS, a certificate, an admin token, backup scripting and an update habit. Perfectly doable in an evening, and yours to maintain forever after.

Route 2: The One-Click Setup

If the above reads like six chores rather than a fun project, this is the shortcut.

InstaPods runs Vaultwarden as a 1-click app on a real Linux server, not a locked-down sandbox. You pick the app, click deploy, and about 30 seconds later you have:

It is $3/mo on the Launch plan (1 vCPU, 512 MB RAM, 10 GB storage), which is plenty for a vault. That price does not change when you add your family or your team to the server, which is the part that matters when you compare it to per-user pricing.

Connect the Official Bitwarden Apps

Same for both routes, and this is the bit that surprises people with how easy it is.

Browser extension and desktop app: on the login screen, click the region or settings selector before you enter your email, choose Self-hosted, and enter your server URL (https://vault.example.com). Then log in normally.

iOS and Android: same flow. Tap the settings icon on the login screen, pick self-hosted, enter the server URL, log in.

CLI:

bw config server https://vault.example.com
bw login

Everything else behaves the way it always has: autofill, biometrics, sync, the lot. This is why Vaultwarden is not a compromise on the client side at all.

Things Worth Doing Once You Are Running

Is Vaultwarden the Right Password Manager to Self-Host?

For most people, yes, and largely because of the client story: nothing else in the self-hosted world gives you polished, actively maintained apps on every platform for free. Passbolt is a strong choice if you want a team-first tool with granular sharing, and KeePassXC with your own file sync is the most minimal option if you do not want a server at all. We ranked the realistic options here: Best Self-Hosted Password Managers in 2026.

If you already know Vaultwarden is what you want, you can deploy it in one click for $3/mo and be pointing the Bitwarden apps at your own server in about a minute. Vaultwarden is one of many self-hosted apps you can run on InstaPods.