Bitwarden is an open-source password manager, and you can run its official server yourself. Your vault data then lives on your own VPS, while users keep the polished official apps and browser extensions. There are two ways to self-host Bitwarden: the official server from Bitwarden Inc. (this guide), or Vaultwarden, a lightweight community reimplementation. Here’s how to deploy the official one, and when you might prefer the alternative.

Official Bitwarden vs Vaultwarden

Official Bitwarden Vaultwarden
Maintained by Bitwarden Inc. Community
Language / stack .NET, several containers (or a single “lite”/unified container) + database Rust, single container
Resources ~2 GB RAM (standard), less for the lite deployment Very small (~50–100 MB)
Paid features (SSO, enterprise policies, reports) Need a licence Many implemented, unofficially
Security audits Official, regular third-party audits Community-reviewed
Support Commercial support available Community

Choose official Bitwarden for organisations that want vendor support, audited code and enterprise features. Choose Vaultwarden for personal or family use on a tiny VPS. See Vaultwarden with Docker and team password managers.

Requirements

  • A VPS with 2 vCPU and 2–4 GB RAM (standard deployment), with Docker and Docker Compose. See install Docker.
  • A domain, e.g. vault.example.com, pointing to the server.
  • An installation ID and key from bitwarden.com/host (free).
  • SMTP credentials for invitations and verification emails. See transactional email services.

Standard deployment with the install script

sudo adduser --disabled-password bitwarden
sudo usermod -aG docker bitwarden
sudo mkdir /opt/bitwarden && sudo chown bitwarden: /opt/bitwarden
sudo -iu bitwarden
cd /opt/bitwarden
curl -Lso bitwarden.sh "https://func.bitwarden.com/api/dl/?app=self-host&platform=linux" && chmod 700 bitwarden.sh
./bitwarden.sh install

Read the script before running it. The installer asks for:

  • the domain (vault.example.com);
  • whether to use Let’s Encrypt (the script can obtain certificates itself if ports 80/443 are free);
  • the installation ID and key;
  • the database name.

Configure SMTP and admin email addresses in ./bwdata/env/global.override.env:

globalSettings__mail__smtp__host=smtp.example.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__startTls=true
globalSettings__mail__smtp__username[email protected]
globalSettings__mail__smtp__password=…
adminSettings__admins[email protected]
globalSettings__disableUserRegistration=true

Then start it:

./bitwarden.sh restart

disableUserRegistration=true stops strangers from creating accounts. Invite users through organisations instead.

Lite / unified deployment

Bitwarden also offers a single-container deployment (“Bitwarden lite”, formerly “unified”), using an external database (MariaDB, PostgreSQL, MySQL or SQLite). It’s lighter and fits small VPSes and Docker Compose setups well. Follow Bitwarden’s current documentation for its environment variables. The principles (domain, installation key, SMTP, HTTPS via a reverse proxy) are the same.

Organisations and users

  • Users create accounts (or accept invitations), and set a strong master password. It can’t be recovered, by design.
  • Create an organisation with collections (e.g. “Servers”, “Marketing”) to share items with groups. See team password managers.
  • The System Administrator Portal (/admin) shows users and organisations. Access is via a magic link sent to the adminSettings__admins addresses.

Backups

Your vault is encrypted with users’ keys, but losing the database still means losing access to everything.

  • Back up ./bwdata regularly. The MSSQL container also creates nightly database backups under bwdata/mssql/backups.
  • Copy backups off-server, and test restoring them. See backup strategy.

Updates

./bitwarden.sh updateself
./bitwarden.sh update

Update promptly. A password manager is a high-value target. See updating self-hosted apps.

Security checklist

  • HTTPS only, registration disabled, SMTP configured.
  • Enforce 2FA for users (an organisation policy, with a licence) or encourage it.
  • Firewall: only 80/443 public. SSH restricted. See Linux server hardening.
  • Consider VPN-only access if your team works from known locations. Clients cache vaults offline anyway. See zero trust networking.

Quick reference

Task Command
Install ./bitwarden.sh install
Start / stop / restart ./bitwarden.sh start / stop / restart
Update ./bitwarden.sh updateself && ./bitwarden.sh update
Settings bwdata/env/global.override.env
Admin portal https://vault.example.com/admin

Related: Vaultwarden with Docker and secrets management.

  • Self-Hosting
  • Security
  • Docker