If you want a password manager where you hold the data - not a company's cloud - self-hosting is the answer. The appeal is real: your encrypted vault lives on infrastructure you control, with no third-party provider in the trust chain. The trade-off is just as real: you become responsible for updates, backups and security. This guide ranks the serious self-hosted options honestly, and helps you decide whether self-hosting is actually right for you.
Prefer auditable code? See our roundup of the best open-source password managers.
What is the best self-hosted password manager?
- For most people: Vaultwarden. A lightweight, open-source server that speaks the Bitwarden protocol, runs in one Docker container (even on a Raspberry Pi), and works with the official Bitwarden apps. Best balance of power and simplicity. See our Vaultwarden self-host tutorial for the full setup.
- Want the official stack: Bitwarden self-host. The vendor's own server - more resource-hungry, but first-party.
- Prefer file-based, no server: KeePassXC + your own sync. A local encrypted database you sync yourself.
- Team / business self-hosting: Passbolt or Psono. Built around shared access and granular permissions.
What do you gain and lose by self-hosting?
What you gain:
- Control & privacy. The encrypted vault sits on your hardware or VPS. No third-party provider can be compelled, breached, or change terms in a way that exposes your data.
- No subscription for the software itself (open-source).
- Auditability. These projects are open-source, so the code can be inspected.
What you take on:
- Maintenance. Security updates, TLS certificates, server hardening - on you.
- Backups. If you don't back up, nobody does. A lost disk = a lost vault.
- Uptime. If your server is down and you're travelling, so is your vault (mitigated by offline app caches).
In short: self-hosting trades convenience for control. That's a great trade if you'll actually maintain it.
Which self-hosted options are worth considering?
Vaultwarden - the default pick
Vaultwarden (formerly "bitwarden_rs") is an unofficial, Rust-based server that implements the Bitwarden API. It's remarkably light - a single Docker container that happily runs on a Raspberry Pi or the cheapest VPS - yet it works with all the official Bitwarden clients (desktop, mobile, browser extensions). You get organisations, attachments, and 2FA without paying for Bitwarden's hosted Premium. For the overwhelming majority of self-hosters, it's the right answer. Our step-by-step Vaultwarden tutorial covers Docker Compose, a reverse proxy, TLS and automated backups.
Bitwarden self-host - the official route
Bitwarden offers an official self-hosted server. It's first-party and fully featured, but it's a heavier, multi-container deployment (more RAM, more moving parts) than Vaultwarden. The published system requirements make the gap concrete: Bitwarden's standard self-host deployment asks for a x64 processor with 2 cores, 4 GB of RAM and 25 GB of storage, and it stands up a set of separate Docker containers rather than one. Vaultwarden is a single container that runs comfortably in a fraction of that, which is why it fits on a Raspberry Pi and the official stack does not. Choose the official route if you specifically want the vendor's own stack and don't mind the extra resource footprint.
KeePassXC + your own sync - no server at all
KeePassXC is a local, open-source manager that stores everything in a single encrypted .kdbx file. The current KDBX 4 format encrypts that file with AES-256 or ChaCha20 and derives the key with Argon2d or Argon2id, so the "just a file" simplicity does not cost you modern cryptography. There's no server to run: you sync that file yourself with Syncthing, Nextcloud, or any storage you trust. It's the most minimal, most private option - and the most manual, since you manage sync and conflict resolution. Excellent for people who want zero server and full file ownership.
Passbolt - team-oriented
Passbolt is built for teams: granular sharing, user/group permissions, and an admin model designed for organisations. It's heavier to deploy than Vaultwarden and aimed at collaborative use rather than a single person. A strong pick for a small company that wants self-hosted, shared credentials.
Psono - business self-hosting
Psono is another team/business-focused self-hosted manager with role-based access and an API. Like Passbolt, it's overkill for an individual but well-suited to organisations that want to keep credentials on their own infrastructure.
Should you self-host your password manager?
- Yes, self-host if you're comfortable running a small server, you'll keep it updated and backed up, and control is a real priority for you. Start with Vaultwarden.
- Probably not if you want something that "just works" everywhere with zero maintenance, or you're not confident about TLS, updates and backups. A misconfigured self-hosted vault is riskier than a good managed one.
If that second description is you, there's no shame in it - a reputable, open-source managed manager gives you most of the privacy benefits without the server admin.
Don't want to run a server? Try Proton PassOpen-source, end-to-end encrypted, Swiss, independently audited - with a free tier. The managed alternative to self-hosting.→How do you migrate an existing vault?
The migration is the step people underestimate, and it is also the one that decides whether self-hosting is reversible. Because Vaultwarden implements the Bitwarden API, the official Bitwarden clients talk to it unchanged: you point the app at your own server URL instead of the hosted one, and everything else stays the same. That compatibility is the whole reason Vaultwarden is the default pick.
The transfer itself is an export from the old manager and an import into the new one. Every serious manager can export, and the Bitwarden clients import from most of them directly, which spares you a conversion step.
There is one thing to be deliberate about. An export file is plaintext. It holds every credential you own, unencrypted, in your downloads folder, that is what makes it importable at all. Do the transfer on a machine you trust, keep the file only as long as the import takes, and delete it properly afterwards rather than leaving it to sit. If the import fails halfway, delete and re-export rather than editing the file by hand: a malformed entry is easier to redo than to debug.
Two-factor settings and stored passkeys do not always travel with the export. Set those up again on the new server and confirm each one works before you retire the old account: not after.
Can you get your data back out later?
This is worth knowing before you start, not after, because it is what makes the decision low-stakes. Self-hosting a vault is reversible: Vaultwarden exports in the same formats the hosted service imports, so moving back is the same operation in reverse.
That matters more than it sounds. The usual objection to self-hosting is "what if I get tired of maintaining it", and the honest answer is that you export, import into a hosted plan, and stop running the server. No lock-in, no proprietary container, no data you cannot retrieve. The cost of trying is one evening.
What is not reversible is losing the server without a backup. A hosted manager keeps redundant copies for you; a self-hosted one keeps exactly the copies you arranged. That asymmetry is the real trade, and it is why the backup question above is the one to answer honestly before the install, not after.
The bottom line
In 2026, the best self-hosted password manager for most people is Vaultwarden - light, open-source, Bitwarden-compatible, and easy to run. KeePassXC suits those who want no server at all; Passbolt and Psono fit teams. Whichever you pick, remember the two rules that make or break self-hosting: keep it updated, and back it up automatically. And if running a server isn't for you, a managed open-source manager is a perfectly honest choice.
Frequently asked questions
Is a self-hosted password manager safer than a cloud one?
It can be - but only if you secure it properly. Self-hosting removes the third-party provider from the trust equation: your encrypted vault lives on infrastructure you control. But you also inherit responsibility for updates, TLS, backups, and server hardening. A misconfigured self-hosted server can be *less* safe than a reputable audited cloud manager. Self-hosting wins for control and privacy; a managed service wins for convenience and a professionally maintained security posture.
What is the easiest self-hosted password manager to run?
Vaultwarden. It's a lightweight, Rust-based reimplementation of the Bitwarden server that runs in a single Docker container - light enough for a Raspberry Pi - and is fully compatible with the official Bitwarden apps and browser extensions. For most people who want to self-host, it's the path of least resistance.
Can I self-host a password manager for free?
Yes. Vaultwarden, the official Bitwarden self-host, KeePassXC, Passbolt Community Edition and Psono Community are all free and open-source. Your only real cost is the hardware (or a cheap VPS) and your time to maintain it.
Do I still need backups if I self-host?
Absolutely - more than ever. When you self-host, nobody else is backing up your vault. If your disk dies or a container is corrupted and you have no backup, your passwords are gone. Automated, encrypted, off-device backups are non-negotiable for any self-hosted setup.
