Vaultwarden: Self-Hosted Bitwarden in Rust

TL;DR: Vaultwarden is an unofficial Rust rewrite of the Bitwarden server. It speaks the same protocol as the official server, so all official Bitwarden clients (desktop, mobile, browser, CLI) work against it unchanged. For self-hosters it replaces a heavier, resource-hungry stack with a single lightweight binary.

Source and Accuracy Notes

• Repository: dani-garcia/vaultwarden
• License: AGPL-3.0
• Stars: 67,535 (as of September 2026)
• Language: Rust
• Topics: bitwarden, bitwarden-rs, docker, rocket, rust

What It Is

Vaultwarden is a community-maintained server implementation of the Bitwarden protocol. It started life as bitwarden_rs and was renamed to reflect its unofficial status relative to the upstream Bitwarden server.

The interface is identical to a self-hosted Bitwarden install from the client’s perspective: you point your existing Bitwarden apps (mobile, desktop, browser extension, CLI) at your Vaultwarden instance instead of Bitwarden’s cloud, and everything just works. The protocol, encryption model, and client UX are unchanged.

What you gain by switching is operational simplicity. Where the official server typically runs as a stack of containers (API, Identity, Admin, MSSQL/Postgres, etc.), Vaultwarden is a single binary with SQLite as the default backing store. A typical install is one container, one volume, one configuration file.

Why It Matters

Bitwarden’s official server is fine for cloud and enterprise, but for self-hosters the resource footprint and operational complexity are real obstacles. Vaultwarden exists because a large chunk of the Bitwarden community wanted something leaner:

• Single binary. No microservices, no SQL Server required. SQLite is enough for most home and small-team deployments.
• Low resource usage. It runs happily on a Raspberry Pi or the smallest VPS tier. Idle memory is tens of megabytes, not hundreds.
• Full client compatibility. Every official Bitwarden client works against it because the wire protocol is identical.
• Active development. Despite being unofficial, the project has years of continuous releases and a healthy contributor base.

For most personal and family-team self-hosted password manager deployments, Vaultwarden is the path of least resistance. You get the official clients, the official extensions, the official mobile apps — without the official server.

Practical Trade-Offs

A few things to know before you commit:

• AGPL-3.0. Strong copyleft. Fine for personal and internal use; if you build a hosted product on top, the AGPL terms apply.
• Unofficial. Bitwarden the company does not support Vaultwarden. If the protocol changes in a breaking way, there’s a delay before Vaultwarden catches up.
• Some premium-only features are stubbed. Bitwarden’s paid-tier features (SSO with SAML, directory connector, etc.) may not be implemented. The core password manager, vault sharing, and 2FA features all work.
• Backups are your responsibility. With SQLite as the default store, a regular file-system backup is the simplest disaster recovery. Treat the data directory as the canonical state.

None of these are deal-breakers for the use case Vaultwarden targets. They just shape the boundary between “easy personal self-hosting” and “running it for an enterprise.”

Who Should Care

Vaultwarden is a near-perfect fit if:

• You want to self-host a password manager without standing up a multi-container stack.
• You already use Bitwarden clients and just want to move the backend off someone else’s cloud.
• You have a small team, family, or friend group that needs shared vaults with strong end-to-end encryption.
• You run a homelab on modest hardware and want your password manager to be a quiet, low-overhead service.

If you’re a Bitwarden enterprise customer relying on SSO, audit logs, or directory sync, the official server is a better fit.

Summary

Vaultwarden is the de-facto self-hosted Bitwarden implementation. It is unofficial, but it is mature, well-maintained, and aggressively simple to operate. For personal and small-team self-hosting it does everything most people actually need from a password manager, and it does it with a fraction of the operational overhead.