Vaultwarden vs Bitwarden: Which One Fit Your VPS?

Wetín Vaultwarden and Bitwarden self-hosted really be

Vaultwarden vs Bitwarden self-hosted na choice between two servers wey dey speak the same client API, no be choice between two password managers. Bitwarden own stack dey run about a dozen containers behind nginx, dey store everything for Microsoft SQL Server, and e dey tied to an installation ID wey you register with an email address. Vaultwarden na unofficial reimplementation of the Bitwarden client API, wey dem write for Rust, and e dey run as one container against one SQLite file. Your browser extension and your phone no fit tell dem apart, because both of dem dey answer the same endpoints.

The encryption na the same for both options. Bitwarden clients dey encrypt the vault before anything comot from the device, so the server dey store blobs wey e no fit read, and Bitwarden own the vault format for both cases. Wetin different na how much machine you rent, who dey maintain the code, which features cost money, and wetin you need back up.

The Vaultwarden README talk the project status clearly: "This project is not associated with Bitwarden or Bitwarden, Inc." Na volunteer project wey no get support desk and no warranty. One active maintainer dey work for Bitwarden and dey contribute during personal time, wey be courtesy, no be endorsement.

Di three stacks wey you fit install

Most comparisons dey miss say Bitwarden ships two different self-hosted products.

Bitwarden standard. Na the vendor deployment, and shell script dey drive am.

curl -Lso bitwarden.sh "https://func.bitwarden.com/api/dl/?app=self-host&platform=linux" \
  && chmod 700 bitwarden.sh
./bitwarden.sh install

The installer go ask for your domain, whether e suppose request Let's Encrypt certificate, database name, plus installation ID and key wey you collect from https://bitwarden.com/host after you enter email address. ./bitwarden.sh start go then pull the images and bring the stack up. Bitwarden document 2 GB of RAM and 12 GB of storage as the minimum, 4 GB and 25 GB as the recommended values, plus Docker Engine 26 or newer with the Compose plugin. The database na MSSQL Express image, and that edition cap relational database for 10 GB unless you point the deployment to external database.

Bitwarden lite. Na this deployment dem bin dey call Bitwarden Unified before. E comot from beta and dem rename am for December 2025. Na one application container plus database wey you choose:

services:
  bitwarden:
    depends_on:
      - db
    env_file:
      - settings.env
    image: ghcr.io/bitwarden/lite
    restart: always
    ports:
      - "80:8080"
    volumes:
      - bitwarden:/etc/bitwarden
  db:
    environment:
      MARIADB_USER: "bitwarden"
      MARIADB_PASSWORD: "super_strong_password"
      MARIADB_DATABASE: "bitwarden_vault"
      MARIADB_RANDOM_ROOT_PASSWORD: "true"
    image: mariadb:10
    restart: always
    volumes:
      - data:/var/lib/mysql
volumes:
  bitwarden:
  data:

E accept MariaDB or MySQL, PostgreSQL, SQLite and MSSQL. E ask for 200 MB of RAM and 1 GB of storage. Two warnings dey inside Bitwarden own documentation. Dem document am for personal use and home labs, no be business use. E no dey take automatic database backups, so na you get full responsibility for that work.

Vaultwarden. Na one container, straight from the project README:

docker run --detach --name vaultwarden \
  --env DOMAIN="https://vw.domain.tld" \
  --volume /vw-data/:/data/ \
  --restart unless-stopped \
  --publish 127.0.0.1:8000:80 \
  vaultwarden/server:latest

The publish line bind port 8000 to loopback only, and na deliberate arrangement. Vaultwarden dey serve plain HTTP and e expect reverse proxy to terminate TLS (transport layer security) in front of am. TLS no be optional here: web vault dey use browser WebCrypto API to do encryption. Browsers dey expose that API only inside secure context, so with plain http, login page go fail for browser before your server even get request. The full Vaultwarden installation walkthrough dey cover the proxy and certificate.

Vaultwarden dey use how much RAM beside self-hosted Bitwarden?

Vendor minimums dey tell you the level wey installer no go run below, no be the actual software size. The rows below come from docker stats --no-stream for idle installations, one user each, small vault, and no attachments, for Ubuntu 24.04 machine wey get 4 GB RAM. Disk na the images plus data directory after the first successful start.

[
  {
    "label": "Vaultwarden (SQLite)",
    "idle_ram_mb": 58,
    "containers": 1,
    "disk_gb": 0.4
  },
  {
    "label": "Bitwarden lite + MariaDB",
    "idle_ram_mb": 470,
    "containers": 2,
    "disk_gb": 1.6
  },
  {
    "label": "Bitwarden standard (MSSQL)",
    "idle_ram_mb": "2,400",
    "containers": 12,
    "disk_gb": 6.5
  }
]

Vaultwarden dey idle around 58 MB for one container. Standard Bitwarden stack dey idle near 2,400 MB across 12 containers, and MSSQL container dey hold most of that memory. Bitwarden lite use 470 MB with its MariaDB container, so e dey between the two. Run the same command for your own machine before you trust any of these figures, because user count, attachments, and sync traffic fit change dem. MSSQL working set also dey grow the longer e runs.

The practical meaning for small VPS be say: Vaultwarden with SQLite dey comfortable for 1 GB plan, but standard Bitwarden stack no go start there. For 2 GB plan, standard stack meet the documented minimum and leave very little memory for operating system, so kernel out of memory killer fit become real problem. When e fire, dmesg go print one line wey name the process e kill, and for this stack na usually sqlservr. Give the standard deployment 4 GB.

Which paid features are free for Vaultwarden?

To run Bitwarden server, you no need pay anything. But paid features go remain locked until you upload licence file. Premium individual accounts and every paid organisation tier (Families, Teams, Enterprise) need one. You fit download am from the cloud web vault. For individual account, go Settings then Subscription. For organisation, go Admin Console, then Billing and Subscription. After that, upload am to your own instance. Organisation licences dey issued against the installation ID wey dey stored for ./bwdata/env/global.override.env. So, self-hosted organisation still get paid subscription and still dey connect to Bitwarden cloud for billing.

Vaultwarden turns on these same features without licence or subscription. The project wiki lists dem:

• organisations, collections and groups
• file attachments
• two-step login with email, Duo, YubiKey and FIDO2
• Emergency Access
• Bitwarden Send
• personal API keys
• SSO through OpenID Connect

SSO na the newest feature among dem. You configure am with SSO_ENABLED, SSO_AUTHORITY, SSO_CLIENT_ID and SSO_CLIENT_SECRET. E only authenticates the login. The wiki talk am clearly: master password still dey required, and your identity provider no dey control am, because that password dey derive the key wey decrypt the vault. Point SSO_AUTHORITY to the discovery issuer for self-hosted Authentik identity provider. Users go sign in there, then unlock the vault with their master password. The value must match the issuer field wey the discovery endpoint returns, without the /.well-known/openid-configuration suffix for the end.

The thing wey Vaultwarden no give you na vendor support. Bitwarden get SOC 2 Type 2 and ISO 27001, dey publish third-party audit reports, and dey run private HackerOne bug bounty. These cover Bitwarden code and service, not the server wey you install. But if auditor want a named supplier behind your password manager, volunteer reimplementation fit make the discussion difficult.

Official Bitwarden apps dey work with Vaultwarden?

Yes. Vaultwarden dey implement client API, so browser extensions, desktop apps, mobile apps, and the bundled web vault all dey work with am. For each client, set the self hosted server URL for the environment screen before you log in, no be after.

One feature need extra configuration: push notifications go mobile apps. Without am, the app go sync when you open am or according to its own timer. So, password wey you change for your laptop no go show for your phone until you check am. Vaultwarden fit use Bitwarden's push relay, and e need installation ID and key from the same https://bitwarden.com/host page wey official installer dey use.

PUSH_ENABLED=true
PUSH_INSTALLATION_ID=<your installation id>
PUSH_INSTALLATION_KEY=<your installation key>

Servers for EU region still need PUSH_RELAY_URI=https://api.bitwarden.eu and PUSH_IDENTITY_URI=https://identity.bitwarden.eu. The wiki document two traps wey you suppose know before you spend one hour debugging this. App wey you install from F-Droid or Neo Store no get Firebase support, and e no go ever receive push, no matter wetin the server do. App wey connect before Vaultwarden 1.30.2 need you clear its data so e fit register push token.

How safe a reimplementation dey?

Bitwarden audit history long and public. Cure53 review am for 2018, 2021, 2022 and 2023. IOActive and Mandiant review clients for 2024, Fracture Labs handle web and network assessments across 2024 and 2025, Unit 42 assess the mobile apps for 2025, and ETH Zurich Applied Cryptography Group review the cryptography for 2025.

Outsiders don also examine Vaultwarden, even though some people dey surprised say anybody dey look am. Germany's Federal Office for Information Security (BSI) get mgm security partners to test am between February and May 2024 under the Caos 3.0 code analysis project, and that review rate two findings as high. Separately, ERNW report an authentication bypass wey affect versions below 1.32.5 (CVE-2024-55225), and dem fix am for November 2024. Version 1.37.0, for July 2026, release fixes for SSRF (server side request forgery) through the icon endpoint, cross organisation cipher access, and organisation policy bypass on directory imports.

That history show say the project get working disclosure process. E also show the surface wey dey appear often: the admin page. So treat that page as the sensitive thing wey e be. E dey off unless ADMIN_TOKEN dey set, and you suppose store hash instead of plaintext token.

docker run --rm -it vaultwarden/server /vaultwarden hash

That go print Argon2 PHC string (password hashing competition format) wey you go paste into ADMIN_TOKEN. Enable HTTPS before you enable the admin page, because dem dey send the token inside the request, and anything wey dey for the path fit read plaintext token for plain HTTP connection. Keep /admin away from public internet where you fit, and combine am with normal host hardening like locking down SSH access for the server.

Wetin go break when official API change

Na risk wey people dey underrate be this. Bitwarden dey release the clients, and those clients dey update themselves from app stores overnight. Vaultwarden must follow. When client release change the API contract, Vaultwarden wey never upgrade go meet client wey don already move, and login or sync fit start failing for devices wey you never touch.

The release notes get one clear example. Vaultwarden 1.37.0 talk say: "This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them." As of August 2026, current release na 1.37.1, wey dem publish on 29 July 2026.

Two habits fit make this matter straightforward. Pin one specific image tag instead of latest, so unattended pull no fit move your server for 3am. Then monitor the release feed and upgrade deliberately. Read the notes first, because breaking changes dey show for there and nowhere else. For example, version 1.35.5 invalidate every existing two factor remember token during upgrade. This log people out from one step wey dem think say dem don save.

The standard Bitwarden deployment get the opposite side of this problem. Upgrades dey run through ./bitwarden.sh updateself and ./bitwarden.sh update, and the update dey apply database migrations. Backup wey you take before the migration no be rollback for the schema after the migration. So take the backup, and note the version wey dey run when you take am.

Backup, na where people actually dey lose vaults

Vaultwarden data directory na the server. Keep these ones:

• db.sqlite3
• every rsa_key* file, including rsa_key.pem and rsa_key.der
• attachments/
• config.json
• sends/

No copy db.sqlite3 with cp while the container dey run. SQLite fit dey write at that time, so the copy fit be corrupt database wey go look correct until you restore am. Use the online backup API instead:

sqlite3 data/db.sqlite3 ".backup '/path/to/backups/db-$(date '+%Y%m%d-%H%M').sqlite3'"

Since 1.32.1, image get built-in /vaultwarden backup command too. Anyhow, the snapshot still dey for the same disk with the original until you move am, so push am comot from the box with restic snapshots go off-site storage on schedule. The rsa_key files important just like the database: server dey sign its session tokens with that key, so if you restore database beside newly generated key, e go log everybody out and spoil organisation invitations wey dey in progress.

Bitwarden standard dey back up more parts of itself. The mssql container dey write nightly database backups inside ./bwdata/mssql/backups and dey keep 30 days of them, as long as the container dey run, and you fit force one:

docker exec -i bitwarden-mssql /backup-db.sh

The directories wey you need keep na ./bwdata/env (environment variables, including database and certificate passwords), ./bwdata/core/attachments, ./bwdata/mssql/data, and ./bwdata/core/aspnet-dataprotection. Na that last one people dey forget. E hold framework-level data protection material, including authentication tokens and some database columns, so if you restore the database without am, the columns wey e protect go remain unreadable. Bitwarden lite no dey take automatic backups at all, so choosing lite mean say na you get to maintain dump schedule, exactly as you go do with Vaultwarden.

Migration for either direction

Migration dey pass through clients, no be servers, because na clients get export and import features. So both directions use the same procedure.

Each user go export from the web vault or desktop app, create account for the new server, then import. The formats na plaintext .json, plaintext .csv, encrypted .json, and one .zip wey hold the JSON plus file attachments for individual vaults. Cards, identities, stored passkeys and SSH keys go survive only for the JSON formats, so CSV migration go silently drop dem. No export format include trash items or Sends, and organisation-owned data no dey part of individual export.

Treat plaintext export like live secret, because na exactly wetin e be: your complete vault in clear text for disk. Export am, import am, then delete am for one sitting. Never send am through email or chat.

One trap dey catch people during migration. Encrypted export wey tie to your account no fit import into different account, and moving servers mean different account by definition. Choose password-protected export option instead, because e portable.

Vaultwarden to standard Bitwarden na the harder direction, because organisation structure no dey travel inside export. You go recreate the organisation for the new server, invite the users again, and each user go import their own vault. Plan maintenance window for am instead of discovering this on the day.

Which one you suppose run?

Run Vaultwarden if na you alone, your family, or home lab for 1 GB or 2 GB VPS. Organisations, Emergency Access and Send dey free. E idle memory cost na roughly like one browser tab. Backup na one SQLite file plus small directory. Na this combination make Vaultwarden dominate self-hosted password management.

Run Bitwarden own server when other people dey depend on am professionally: company wey need support contract, compliance requirement wey specify the vendor, or enterprise features wey you don already pay for. Give the standard deployment 4 GB. Treat the licence file and installation ID as part of the deployment, no be mere paperwork.

Bitwarden lite dey for awkward middle ground. Na vendor code wey get small fraction of the weight, and this one genuinely attractive. But Bitwarden document am for personal and home lab use, and e no get automatic backups. You go carry Vaultwarden operational load without Vaultwarden free feature set. Choose am when vendor code matter to you pass features, and you dey okay to run the database yourself.

If you still dey decide wetin else the box go host, the wider self-hosting shortlist put this choice beside other services wey dey compete for the same RAM.

FAQ

Vaultwarden safe reach for real password manager?

For personal and family use, yes, but some conditions dey. The clients encrypt the vault before e reach server, so Vaultwarden no dey see your master password or any plaintext. Dem don review am externally: BSI use mgm security partners test am between February and May 2024, and ERNW report authentication bypass wey dem fix for 1.32.5. Keep the version current, keep the admin page disabled or put am behind an Argon2 hashed ADMIN_TOKEN, and serve am only over HTTPS. Business wey need vendor support or audit documentation suppose run Bitwarden own server.

How much RAM Vaultwarden need compared to Bitwarden self-hosted?

For idle installs wey dem measure with docker stats --no-stream, Vaultwarden with SQLite use about 58 MB for one container, while Bitwarden standard deployment use around 2,400 MB across 12 containers. Most of the memory na for the MSSQL database. Bitwarden document 2 GB as the minimum and 4 GB as recommended for the standard stack, and 200 MB for Bitwarden lite. Vaultwarden fit run for 1 GB VPS with plenty space remain.

I need Bitwarden licence to self-host?

No, if na free individual vault. Running the server na free. You need licence file to unlock premium individual features and any paid organisation plan. This one cover Families, Teams and Enterprise. You download am from the cloud web vault and upload am to your instance. Organisation licences dey issued against the installation ID stored for ./bwdata/env/global.override.env. Vaultwarden no need licence and e enable the organisation features by itself.

I fit move from Vaultwarden go Bitwarden later, or move back?

Yes, both directions dey possible through the clients. Each user export their vault from the web vault or desktop app, then import am into the new server after dem create account there. The .zip export carry attachments for individual vaults. The JSON forms carry cards, identities, passkeys and SSH keys. Trash items and Sends no dey inside any export format. Organisation-owned items user must export separately as owner. So plan to recreate the organisation and invite users again for the new server.