How to Self-Host a Password Manager at Home Without a Subscription

Owning your passwords instead of renting access to them is one of the most satisfying home-server projects you can take on. Self-hosting a password manager at home without a subscription means running a vault on your own hardware while keeping full compatibility with the standard Bitwarden browser extensions, desktop apps and mobile clients. The tool that makes this practical is Vaultwarden, a lightweight server that speaks the same language as Bitwarden at a fraction of the resource cost.

Quick Answer

Run Vaultwarden, an unofficial Bitwarden-compatible server written in Rust, in a container on a small always-on machine at home. It works with every official Bitwarden client, uses around 50MB of RAM versus the official server's 1GB to 2GB, and unlocks premium features such as TOTP, file attachments and emergency access with no per-user licence. The one firm requirement is HTTPS for any access beyond the host machine itself.

Why Vaultwarden Over the Official Server

The official self-hosted Bitwarden server is a heavyweight, expecting the kind of resources you would give a small business deployment. Vaultwarden, formerly known as bitwarden_rs, is a clean reimplementation of the Bitwarden API in Rust. It does the same job in a tiny footprint, sips CPU and memory, and is genuinely easy to stand up on modest hardware.

The compatibility is the clever part. Because Vaultwarden implements the Bitwarden server API, the official Bitwarden browser extensions and apps connect to it without any special build or fork. You point the standard client at your own server URL and everything works, including the premium features Bitwarden normally charges for.

A small, quiet, low-power box is the natural home for it, and the mini PC range at Evetech is full of machines that draw little power and run silently in a cupboard, which is exactly what an always-on vault wants.

Step One: Pick and Prepare Your Host

You need a machine that stays on. A mini PC or a small home server is ideal because it is quiet, sips electricity and lives happily out of the way. Install a Linux distribution and Docker, since the recommended and best-supported way to run Vaultwarden is as a container. The official images are published to the major container registries, so you pull one image and you are most of the way there.

1. Set up your always-on host with a current Linux install.
2. Install Docker so you can run and manage the Vaultwarden container.
3. Give the machine a fixed local IP address so your clients always find it.

Step Two: Run the Container

Pull and run the Vaultwarden server image. By default it stores its data in a lightweight SQLite database, which is part of why it is so easy to manage at home. Mount a data directory from the host into the container so your vault persists across restarts and updates, and you have a backup target. Once the container is up, the server is technically running, but you are not done, because of one critical security rule.

Step Three: Set Up HTTPS (Non-Negotiable)

This is the step people skip and then wonder why nothing works. The Bitwarden web vault and clients require a secure context, meaning either plain localhost on the same machine or any URL served over HTTPS. There is no setting to bypass this. If you try to reach Vaultwarden over plain HTTP from another device, the page may load but the cryptography silently fails and you cannot log in.

The standard solution is to put a reverse proxy in front of Vaultwarden to handle HTTPS with a valid certificate. With that in place, every device on your network reaches the vault securely and the clients function normally. Plan this in from the start rather than treating it as an afterthought.

Step Four: Backups and Updates

A password vault you cannot restore is a disaster waiting to happen. Set up a nightly backup of the data directory, ideally copied somewhere off the host as well, so a dead drive never means lost credentials. Keep the container image updated to pick up security fixes, and enable the admin page so you can manage users and check the vault's health. The operational burden is genuinely low once it is running: one host, one container, regular backups. To grow into a proper home lab around it, the best-selling desktops at Evetech offer more capable always-on hardware when a mini PC is not enough.

Frequently Asked Questions

Does Vaultwarden work with the official Bitwarden apps?

Yes, fully. It implements the Bitwarden server API, so the official browser extensions, desktop apps, mobile apps and CLI all connect to your server by pointing them at your own URL. There is no separate client to install.

Do I get premium Bitwarden features for free?

Effectively yes. Vaultwarden enables features Bitwarden normally gates behind a paid plan, including TOTP authenticator codes, file attachments, emergency access and vault health reports, with no per-user licensing.

Why can I not access my vault over plain HTTP?

Bitwarden clients require a secure context, which means localhost or HTTPS only. Over plain HTTP the interface loads but the encryption operations fail silently. You must serve Vaultwarden over HTTPS, typically through a reverse proxy, to use it from other devices.

How much hardware do I really need?

Very little. Vaultwarden runs comfortably in around 50MB of RAM, so a low-power mini PC or even a single-board computer is plenty for a household. The main requirement is that the machine stays on so your vault is always reachable.