--- title: "Self-host the Vaultwarden password manager: domain, closing sign-ups, team sharing and backups" description: "Deploy Vaultwarden on your own server from Zenavo's template, bind an HTTPS domain, close public sign-ups once you've registered, set up email to invite teammates, connect the Bitwarden clients, and handle backups and upgrades." date: 2026-11-13 language: en url: https://zenavo.app/blog/self-host-vaultwarden --- # Self-host the Vaultwarden password manager: domain, closing sign-ups, team sharing and backups [Vaultwarden](https://github.com/dani-garcia/vaultwarden) is an open-source password manager server that works with Bitwarden's official clients: the browser extension, desktop app, mobile apps and CLI all connect to it directly. It's written in Rust and uses very little memory, so one small server can serve a whole team. Keeping your vault on your own server means your data doesn't pass through a third party's cloud. It also means the domain, the sign-up switch, backups and upgrades are up to you. This guide uses Zenavo's Vaultwarden template and goes from deployment all the way to backups. Vaultwarden is a community project and has no connection to Bitwarden, Inc. ## Deploy Vaultwarden First [connect a Linux server](https://docs.zenavo.app/servers/add-a-server) to Zenavo, then open the [Vaultwarden template](https://zenavo.app/deploy?template=vaultwarden), choose the server and deploy. The template currently sets: | Setting | Value or purpose | |---|---| | Image | `vaultwarden/server:latest` | | HTTP port | `80` | | Volume | `/data`: the SQLite database, attachments, Send files, the keys used for sign-in, and settings saved in the admin panel | The template sets no environment variables. The steps below fill them in. ## Bind the domain before you register Vaultwarden's web vault relies on the browser's crypto APIs, which only work over HTTPS. So bind the domain **before you create an account**. On the vaultwarden service's **Networking** tab, bind a domain such as `vault.example.com` to port `80`, add a DNS A record pointing to the server, and wait for HTTPS. See [Domains](https://docs.zenavo.app/networking/domains) for the steps. Then add this on the **Variable** tab: ```sh DOMAIN=https://vault.example.com ``` Save and restart. `DOMAIN` must match the address you actually use exactly, `https://` included. Links in emails and some client features depend on it. ## Create your account, then close sign-ups Open `https://vault.example.com`, click **Create account**, and set your email and master password. **The master password can't be recovered.** Vaultwarden stores only encrypted data, and even the server admin can't decrypt it. Forgetting your master password means losing your whole vault. Keep it somewhere safe, or turn on biometric unlock in the clients for everyday use. By default the template lets anyone sign up. Once everyone on your team has registered, add this in **Variable**: ```sh SIGNUPS_ALLOWED=false ``` Save and restart. After that, only people invited to an organization can join (`INVITATIONS_ALLOWED` is on by default). If you only want to allow company email addresses, you can keep sign-ups open and use `SIGNUPS_DOMAINS_WHITELIST=example.com` instead. ## Set up email (needed to invite teammates) Invitations, email verification and new-device login alerts all go by email. Add your SMTP service in **Variable**: ```sh SMTP_HOST=smtp.example.com SMTP_PORT=587 SMTP_SECURITY=starttls SMTP_FROM=vault@example.com SMTP_USERNAME=your SMTP user name SMTP_PASSWORD=your SMTP password ``` If your provider uses port 465, change `SMTP_SECURITY` to `force_tls`. Save and restart. Zenavo stores variable values encrypted and hides them from team viewers. ## Team sharing: organizations and collections In the web vault, click **New organization** to create an organization, then create **Collections** by purpose, such as "Servers", "Third-party accounts" and "Finance". Put the items you want to share into collections, then invite members and choose which collections each can access. After a member accepts the invitation, an organization admin still has to **Confirm** them once in the member list before they can see shared items. This step exchanges encryption keys, and it's expected. ## Connect the Bitwarden clients Every Bitwarden client lets you choose a server on its login page: 1. On the login page, find the server option (or "Logging in on") and choose **Self-hosted**. 2. Enter `https://vault.example.com` as the server URL. 3. Log in with your email and master password. The browser extension, desktop app and mobile apps all keep an encrypted copy of the vault locally, so you can still view existing items while the server is briefly down. ## Admin panel (optional) Vaultwarden has an admin panel at `/admin` where you can view users, delete accounts and change settings. It's off when `ADMIN_TOKEN` isn't set. We suggest leaving it off and turning it on only when you need it. To turn it on, don't use a plain-text password. Run this in the vaultwarden service's **Command** panel: ```sh /vaultwarden hash ``` Enter a password twice when prompted, and it prints a string starting with `$argon2id$`. Save the whole string as the value of `ADMIN_TOKEN`, restart, then log in to `https://vault.example.com/admin` with the password you just entered. Note: settings saved in the admin panel are written to `/data/config.json` and **override** environment variables of the same name. If changing a variable later has no effect, first check whether it's also set in the admin panel. ## Back up All of a server's data is in the `/data` volume. Back it up from the vaultwarden service's **Backup & Restore** tab: 1. Pick a time when no one is using it and stop the project (volume backups require the project to be stopped). 2. Create the backup, then start the project once it's done. Clients can still read their local cache during those few minutes. 3. Download a copy of the backup to keep. The backup holds the encrypted vaults, but also attachments and the keys used for sign-in, so guard it as you would a password. We also suggest that everyone regularly exports an encrypted JSON from the web vault with **Tools → Export vault**, as a second copy that doesn't depend on the server. A backup is only reliable once you've restored and checked it. Restore it into a new project and log in to confirm your items are there. ## Upgrade The template uses the `latest` tag, so any redeploy may pull a new version. For long-term use, go to the service's **Settings → Source** and pin the image to a fixed version, such as `vaultwarden/server:1.37.5` (go by the versions on the [releases page](https://github.com/dani-garcia/vaultwarden/releases)). Back up before upgrading, and read the release notes before changing the version. ## FAQ **The web vault won't open, or says it needs a secure connection?** The web vault only works over HTTPS. Check that the domain is bound, the certificate is active, and you're using `https://`. **I closed sign-ups. How do I add people?** Invite them to your organization. With SMTP set up, they get an invitation email; without SMTP, the invited address can sign up directly in the web vault. **What if I forget my master password?** It can't be recovered; nothing on the server can decrypt it. The only option is to delete the account and register again, and the old items are lost. That's why you should export your vault regularly. **No real-time sync on my phone?** The web vault and desktop app sync in real time over WebSocket. Push notifications for the mobile apps need an installation ID and key from [bitwarden.com/host](https://bitwarden.com/host), then `PUSH_ENABLED=true`, `PUSH_INSTALLATION_ID` and `PUSH_INSTALLATION_KEY`. Without them, the mobile apps sync when opened or when you pull to refresh. **How big a server do I need?** Vaultwarden itself usually uses only a few tens of MB of memory, so it can easily share a small server with other apps. Start from the [Vaultwarden template](https://zenavo.app/deploy?template=vaultwarden): bind the domain first, then register and close sign-ups, and finally set up backups.