Vaultwarden Hosting: Your Own Password Manager Server

Vaultwarden is an open-source (AGPL-3.0) password manager server written in Rust. It implements the same API as Bitwarden's server, so the official Bitwarden browser extensions, desktop and mobile apps can use it, but it is a separate community project, not made or endorsed by Bitwarden, Inc. Choose it with a plan, pay, and we build the VPS (KVM, NVMe, Ubuntu 24.04 LTS) and install it in about two minutes after boot. You get:

• Vaultwarden 1.37.4 with its web vault, on its own small database.
• An HTTPS address like yourname-x7k2.devoster.app with a Let's Encrypt certificate. The apps require HTTPS, so this matters.
• Sign-ups closed from the start. Only your account email is invited, so nobody else who finds the address can create an account.
• The /admin page for users, invitations and server settings, unlocked with the password shown in the Devoster dashboard.
• Dashboard controls to open the vault, reset the admin password, restart, stop or start it, read its logs, run an update and connect your own domain.

The app is free; you pay only the VPS plan, with 10% off yearly. The server comes with full root, free nightly backups kept 3 days plus one snapshot, a dedicated IPv4 and DDoS protection. Already have a Devoster VPS? You can install Vaultwarden on it from VPS Control, after the panel checks the OS, free ports 80/443 and disk, or reinstall the server with it, at no charge. Other apps that install this way are on the One-Click Apps page.

Unlike most one-click apps, Vaultwarden doesn't come with a login we created for you, and that is deliberate. A vault is end-to-end encrypted with a key derived from your master password on your own device. If we set that password, we would hold a key to your vault. So:

• Open your address and choose "Create account" with the email address of your Devoster account. It is the only address invited.
• Choose your own master password. Devoster never sees it, and it never leaves your device in a form that could unlock the vault.
• Do it right away, as soon as the app is ready, so the invitation is used by you.

The password in the Devoster dashboard is something else: it unlocks the /admin page, not your vault. Resetting it from the dashboard changes only the admin page's password.

A lost master password can't be recovered, by us or anyone else; that is what end-to-end encryption means. The only way back is to delete the user at /admin and start again with an empty vault. Write the master password down and keep it somewhere safe, and keep an encrypted export of the vault too.

Install the official Bitwarden extension for your browser, or the app for your phone or computer. On the login screen, choose the self-hosted server option and enter your HTTPS address, then log in with your email and master password. Everything you save syncs through your server.

• Importing: export from your current password manager (most can write a CSV or JSON file) and import it in the web vault under Tools. Delete the plain export file afterwards.
• Live sync: the web vault and the desktop apps get changes instantly over a websocket connection.
• Mobile push: instant push to the mobile apps needs an installation ID and key of your own from bitwarden.com/host. Without them, the mobile apps sync when you open them or pull to refresh, which is enough for most people.
• Your own domain: connect it before you set up the apps, and before you register security keys or passkeys for two-factor, since those are tied to the address. The devoster.app address then redirects to it.

Outbound mail ports are blocked by default on Devoster VPS plans, and the install has no SMTP set up. That shapes a few things:

• Two-factor: use an authenticator app (TOTP) or a security key. Email codes as a second factor need SMTP and don't work. Save the recovery code Vaultwarden gives you.
• No emails for invitations, emergency access or new-device logins. If you want them, Vaultwarden's /admin page has SMTP settings for an external mail provider, whose SMTP submission port can be opened on request after approval.
• Family or team members: invite their email address at /admin. Without SMTP, an invited address can go straight to "Create account" and choose its own master password; tell them the address yourself.
• Sharing passwords: create an organization in the web vault and share collections with the people in it.

Very little. Vaultwarden is a single lightweight service, and a vault is mostly small encrypted text. The Nano plan (1 vCPU, 1 GB, 25 GB) runs it comfortably for a person, a family or a small team, so it is both the minimum and the recommended plan.

Choose Micro (1 vCPU, 2 GB, 50 GB) only if you plan to store many large file attachments, or want room to run something else on the same server. Since the server is yours with full root, you can; just remember that anything else you add shares the machine that holds your passwords.

Backups: nightly backups (kept 3 days) and your snapshot slot cover the whole VPS. Because a vault is critical, also export it now and then from the web vault (an encrypted export is best) and keep that file somewhere off the server. The Bitwarden apps keep an offline copy of your vault on each device too, so a short server outage doesn't lock you out of your passwords.

Updates: we check new Vaultwarden versions and apply them in a maintenance hour you choose, or when you press Update now. A snapshot of the VPS is taken first, and if Vaultwarden doesn't come back healthy the server is rolled back automatically.

The server is unmanaged: you have full root, and its security is your responsibility. Your passwords are encrypted before they reach it, but the server is still worth hardening: our VPS hardening checklist covers SSH keys and the firewall, and you can keep the vault off the open internet by reaching it through our WireGuard VPN server.