Self-Host a Password Manager: Vaultwarden in 10 Minutes

Your password manager is the one service where “trust someone else’s cloud” is the hardest sell — it’s literally the keys to everything. Vaultwarden is a lightweight, unofficial Bitwarden-compatible server that runs the whole vault on your hardware, works with the real Bitwarden apps and browser extensions, and sips resources. Ten minutes and you own your passwords.

Vaultwarden vs Bitwarden

Same clients, different server. Bitwarden’s official self-hosted stack is heavy (multiple containers, .NET). Vaultwarden is a single small Rust binary that speaks the same API, so the official Bitwarden browser extension and phone apps connect to it unchanged. It runs comfortably on a Raspberry Pi, never mind a proper mini PC.

Step 1 — run it

A minimal docker-compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: always
    environment:
      - SIGNUPS_ALLOWED=true   # we'll turn this OFF after making our account
    volumes:
      - ./vw-data:/data
    ports:
      - "8080:80"

docker compose up -d

That’s the whole server. But don’t create your account over plain HTTP yet — there’s one thing to get right first.

Step 2 — HTTPS, the safe way

The Bitwarden clients require a secure context (HTTPS) to work — the browser extension and mobile apps will refuse a plain http:// server (localhost is the only exception). You do not solve this by exposing Vaultwarden to the internet. Two clean homelab options:

• Tailscale Serve — if your devices are already on a tailnet, one command puts Vaultwarden behind a valid HTTPS certificate inside your private network, with zero public exposure:

  tailscale serve --bg https://localhost:8080

• Caddy reverse proxy — a two-line Caddyfile in front of Vaultwarden gives you automatic TLS on a local domain. Slightly more setup, no Tailscale dependency.

Either way the vault stays on your LAN/tailnet and never touches a public port.

Step 3 — lock it down

1. Open the HTTPS URL, create your account — this is your vault.
2. Now set SIGNUPS_ALLOWED=false in the compose file and docker compose up -d again. This stops anyone else from registering on your server. (For a family vault, invite people from the admin panel instead.)
3. Optionally set an ADMIN_TOKEN to reach the /admin panel for user management.

Step 4 — point your apps at it

In the Bitwarden browser extension or phone app, before logging in, tap Settings → Server URL (self-hosted) and enter your Vaultwarden HTTPS address. Log in with the account from Step 3 and every device syncs against your box. Import your existing passwords from the old manager’s export and you’re fully migrated.

Same rule as everything else here: keep it private. A password server has no business on the public internet — reach it over Tailscale or a VPN when you’re away from home, not through a port-forward.

Worth it?

For the one service that guards everything else, running it yourself — on the same mini PC that hosts the rest of the lab — is the highest-trust option there is, and it costs nothing. Pair it with an off-site backup of the vw-data folder and you’ve got a password manager no vendor can lock you out of.

The full build, including the Caddy config and backups, is in the video.