Self-host the Vaultwarden password manager: domain, closing sign-ups, team sharing and backups

Vaultwarden is an open-source password manager server that works with Bitwarden's official clients: the browser extension, desktop app, mobile apps and CLI all connect to it directly. It's written in Rust and uses very little memory, so one small server can serve a whole team.

Keeping your vault on your own server means your data doesn't pass through a third party's cloud. It also means the domain, the sign-up switch, backups and upgrades are up to you. This guide uses Zenavo's Vaultwarden template and goes from deployment all the way to backups.

Vaultwarden is a community project and has no connection to Bitwarden, Inc.

Deploy Vaultwarden

First connect a Linux server to Zenavo, then open the Vaultwarden template, choose the server and deploy.

The template currently sets:

Setting	Value or purpose
Image	vaultwarden/server:latest
HTTP port	80
Volume	/data: the SQLite database, attachments, Send files, the keys used for sign-in, and settings saved in the admin panel

The template sets no environment variables. The steps below fill them in.

Bind the domain before you register

Vaultwarden's web vault relies on the browser's crypto APIs, which only work over HTTPS. So bind the domain before you create an account.

On the vaultwarden service's Networking tab, bind a domain such as vault.example.com to port 80, add a DNS A record pointing to the server, and wait for HTTPS. See Domains for the steps.

Then add this on the Variable tab:

DOMAIN=https://vault.example.com

Save and restart. DOMAIN must match the address you actually use exactly, https:// included. Links in emails and some client features depend on it.

Create your account, then close sign-ups

Open https://vault.example.com, click Create account, and set your email and master password.

The master password can't be recovered. Vaultwarden stores only encrypted data, and even the server admin can't decrypt it. Forgetting your master password means losing your whole vault. Keep it somewhere safe, or turn on biometric unlock in the clients for everyday use.

By default the template lets anyone sign up. Once everyone on your team has registered, add this in Variable:

SIGNUPS_ALLOWED=false

Save and restart. After that, only people invited to an organization can join (INVITATIONS_ALLOWED is on by default). If you only want to allow company email addresses, you can keep sign-ups open and use SIGNUPS_DOMAINS_WHITELIST=example.com instead.

Set up email (needed to invite teammates)

Invitations, email verification and new-device login alerts all go by email. Add your SMTP service in Variable:

SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURITY=starttls
SMTP_FROM=vault@example.com
SMTP_USERNAME=your SMTP user name
SMTP_PASSWORD=your SMTP password

If your provider uses port 465, change SMTP_SECURITY to force_tls. Save and restart. Zenavo stores variable values encrypted and hides them from team viewers.

Team sharing: organizations and collections

In the web vault, click New organization to create an organization, then create Collections by purpose, such as "Servers", "Third-party accounts" and "Finance". Put the items you want to share into collections, then invite members and choose which collections each can access.

After a member accepts the invitation, an organization admin still has to Confirm them once in the member list before they can see shared items. This step exchanges encryption keys, and it's expected.

Connect the Bitwarden clients

Every Bitwarden client lets you choose a server on its login page:

1. On the login page, find the server option (or "Logging in on") and choose Self-hosted.
2. Enter https://vault.example.com as the server URL.
3. Log in with your email and master password.

The browser extension, desktop app and mobile apps all keep an encrypted copy of the vault locally, so you can still view existing items while the server is briefly down.

Admin panel (optional)

Vaultwarden has an admin panel at /admin where you can view users, delete accounts and change settings. It's off when ADMIN_TOKEN isn't set. We suggest leaving it off and turning it on only when you need it.

To turn it on, don't use a plain-text password. Run this in the vaultwarden service's Command panel:

/vaultwarden hash

Enter a password twice when prompted, and it prints a string starting with $argon2id$. Save the whole string as the value of ADMIN_TOKEN, restart, then log in to https://vault.example.com/admin with the password you just entered.

Note: settings saved in the admin panel are written to /data/config.json and override environment variables of the same name. If changing a variable later has no effect, first check whether it's also set in the admin panel.

Back up

All of a server's data is in the /data volume. Back it up from the vaultwarden service's Backup & Restore tab:

1. Pick a time when no one is using it and stop the project (volume backups require the project to be stopped).
2. Create the backup, then start the project once it's done. Clients can still read their local cache during those few minutes.
3. Download a copy of the backup to keep.

The backup holds the encrypted vaults, but also attachments and the keys used for sign-in, so guard it as you would a password. We also suggest that everyone regularly exports an encrypted JSON from the web vault with Tools → Export vault, as a second copy that doesn't depend on the server.

A backup is only reliable once you've restored and checked it. Restore it into a new project and log in to confirm your items are there.

Upgrade

The template uses the latest tag, so any redeploy may pull a new version. For long-term use, go to the service's Settings → Source and pin the image to a fixed version, such as vaultwarden/server:1.37.5 (go by the versions on the releases page). Back up before upgrading, and read the release notes before changing the version.

FAQ

The web vault won't open, or says it needs a secure connection? The web vault only works over HTTPS. Check that the domain is bound, the certificate is active, and you're using https://.

I closed sign-ups. How do I add people? Invite them to your organization. With SMTP set up, they get an invitation email; without SMTP, the invited address can sign up directly in the web vault.

What if I forget my master password? It can't be recovered; nothing on the server can decrypt it. The only option is to delete the account and register again, and the old items are lost. That's why you should export your vault regularly.

No real-time sync on my phone? The web vault and desktop app sync in real time over WebSocket. Push notifications for the mobile apps need an installation ID and key from bitwarden.com/host, then PUSH_ENABLED=true, PUSH_INSTALLATION_ID and PUSH_INSTALLATION_KEY. Without them, the mobile apps sync when opened or when you pull to refresh.

How big a server do I need? Vaultwarden itself usually uses only a few tens of MB of memory, so it can easily share a small server with other apps.

Start from the Vaultwarden template: bind the domain first, then register and close sign-ups, and finally set up backups.