dani-garcia/vaultwarden

What It Is

Vaultwarden is an alternative server implementation of the Bitwarden Client API written in Rust. It is designed for self-hosting where the official server's resource requirements may be too heavy, and it works with the official Bitwarden clients (downloads). The README calls it an unofficial project that is not associated with Bitwarden or Bitwarden, Inc. (disclaimer).

The server covers personal vaults, Send, attachments, website icons, personal API keys, organizations with collections, sharing, roles, groups, event logs, policies, multi-factor login (authenticator, email, FIDO2 WebAuthn, YubiKey, Duo), emergency access, an admin backend, and a modified web vault bundled in the containers (feature list).

It is aimed at individuals, families, and small organizations that want to run their own password store while continuing to use Bitwarden-compatible clients.

Quick Start

The recommended path is a container image. The image is published on GitHub Container Registry, Docker Hub, and Quay; the README points to the wiki for tag selection. Pull the image and run it with a persistent volume and an HTTPS public domain:

docker pull vaultwarden/server:latest
docker run --detach --name vaultwarden \
  --env DOMAIN="https://vw.domain.tld" \
  --volume /vw-data/:/data/ \
  --restart unless-stopped \
  --publish 127.0.0.1:8000:80 \
  vaultwarden/server:latest

The README states that this preserves persistent data under /vw-data/, and the path can be adapted. The web vault requires HTTPS and a secure context for the Web Crypto API; without it, the web interface will not work. The project suggests putting a reverse proxy in front of the service and provides proxy examples in the wiki. Point the Bitwarden clients at the resulting domain to sign in and use the vault.

A Docker Compose alternative is shown in the README with the same DOMAIN, volume, and loopback port mapping. Community packages and building from source are also documented, but those packages may lag or differ in configuration. Detailed installation and configuration guidance lives in the Vaultwarden wiki.

Constraints

HTTPS is not optional for the web vault because of the Web Crypto API requirement. The README recommends a reverse proxy rather than relying on Rocket's built-in TLS. Persistent storage must be mounted; otherwise, vault data will not survive container replacement.

The README explicitly disclaims liability for data loss and advises regular backups of files and database. The project is licensed AGPL-3.0 (license file).

Because this is an unofficial server implementation, bugs and suggestions should go to the Vaultwarden issue tracker and community channels, not official Bitwarden support. The README notes that one active maintainer is employed by Bitwarden but contributes on their own time.

HotRepo's take

In the HotRepo records, Vaultwarden appears on the daily all-language list in late August and mid-September 2026 with daily gains between 68 and 176 stars, then on the Rust weekly list on 2026-11-07 with 438 stars gained and a best position of 16. The repository now has over 70,000 stars and 3,400 forks, reflecting sustained interest in self-hosted password infrastructure.

The Hacker News threads provide useful context rather than product validation. A 2025 discussion around the OpenID Connect SSO commit drew self-hosters explaining that SSO matters both for many users across few tools and many tools across few users, and a nonprofit volunteer manager described avoiding per-seat billing. In the same thread, a long-time user raised concerns about Docker Hub account security and third-party dependencies. Since Vaultwarden often holds the most sensitive credentials in a homelab, those operational concerns are worth weighing alongside the feature set.