Vaultwarden and Bitwarden get compared like they’re two competing password managers, and that framing is most of what makes the decision confusing. Vaultwarden is Bitwarden, or more precisely it’s an unofficial, lightweight reimplementation of the Bitwarden server written in Rust, and it speaks the same API the official Bitwarden apps already talk to. The real question isn’t which product is better. It’s whether you want to run the server yourself.
I run Vaultwarden myself and I’d still tell most people to pay for Bitwarden instead, so here’s the honest version of that trade-off rather than the usual feature grid.
The short answer
Pay for Bitwarden Premium if you want a password manager that just works. It’s $1.65 per month, billed annually at $19.80, and somebody else owns the uptime, the updates, and the backups. For a piece of software that holds every credential you have, that’s cheap.
Run Vaultwarden if you want the vault on hardware you control, or you want the premium features without a subscription, and you’re genuinely fine being the person who fixes it when it won’t start. That last part is the whole decision, and it’s the part most comparisons skip.
Vaultwarden is Bitwarden’s server, reimplemented
Bitwarden publishes an official self-hosted server, and the standard deployment is built for organizations. It runs as a stack of eleven containers, it expects a reasonable amount of memory, and it’s more machinery than most people want on a Raspberry Pi or a NAS.
That’s the comparison most articles are still making, and it’s out of date. Bitwarden’s unified deployment left beta in December 2025 and now ships as Bitwarden lite, which is a single container aimed at individuals rather than organizations and will run on SQLite instead of expecting SQL Server. If your objection to the official server was that it was far too heavy for a NAS, that objection has largely been answered.
What lite doesn’t change is the licensing. Premium features on any official server still sit behind the paid tier, and Bitwarden itself says lite isn’t what it recommends for organizations. So the honest 2026 framing isn’t that the official server is too heavy to self-host. It’s that Vaultwarden is still lighter and still free of the licensing layer, while the official route has become a reasonable option for one person who specifically wants first-party code.
Vaultwarden got there years earlier, and it’s a single container implementing the same API in Rust that runs comfortably on hardware the standard official server would struggle with. Because the API matches, the official Bitwarden browser extensions and mobile apps connect to it without any modification. You point them at your server address instead of Bitwarden’s and everything behaves the way you’d expect.
It also hands you the premium feature set for free, because there’s no licensing layer to enforce. TOTP codes, file attachments, emergency access, and the security reports are all just available.
Vaultwarden vs. Bitwarden at a glance
| Bitwarden (hosted) | Vaultwarden (self-hosted) | |
|---|---|---|
| Cost | Free tier, or $19.80/year Premium | Free, plus your hardware and power |
| Premium features | Paid tier | Included |
| Lightweight self-host | Bitwarden lite, one container, premium still licensed | One container, premium included |
| Official apps and extensions | Yes | Yes, same API |
| Who owns backups | Bitwarden | You |
| Who owns uptime | Bitwarden | You |
| TLS certificate | Handled | You set it up and renew it |
| Remote access | Works anywhere | Needs a VPN, tunnel, or reverse proxy |
| Family sharing | $47.88/year, up to 6 users | Included, you manage the users |
| Audited server code | Yes, official | Third-party implementation |
| Support | Bitwarden support | GitHub issues and the community |
What Bitwarden actually costs
A lot of the advice still floating around says Bitwarden Premium costs $10 a year, and that number is simply out of date now. Premium is currently $1.65 a month, billed annually at $19.80, and the Families plan covering up to six users is $3.99 a month, billed annually at $47.88.
The free tier is genuinely usable, and that’s worth saying plainly, because a lot of people pay without needing to. Unlimited passwords, unlimited devices, and syncing across all of them costs nothing at all. Premium adds TOTP code storage, file attachments, emergency access, and the vault health reports, and those are precisely the features Vaultwarden hands you for free because there’s no license check standing in the way.
So the money argument is smaller than it looks. If you’re weighing $19.80 a year against running a container, keeping it patched, and owning the backups yourself, the subscription isn’t the expensive option here, it’s comfortably the cheap one. The reason to self-host is control over where the data lives, not saving money.
Is Vaultwarden safe?
This is the question that actually worries people, and it deserves a straight answer rather than a shrug.
Vaultwarden is a third-party implementation of a password vault server that isn’t written or audited by Bitwarden themselves. It is a well-established open-source project with a long history and a lot of users, and the encryption happens on the client side, which means the server stores data it can’t read. That last point matters: your vault is encrypted by the Bitwarden app before it ever reaches the server.
But client-side encryption doesn’t make the server irrelevant, and it’s worth being clear about why. A server you expose badly is still a server somebody can reach and attack, and you’re the one deciding how it’s exposed, how quickly it gets patched, and whether the admin panel is sitting there reachable from the internet. With hosted Bitwarden, a security team makes those calls for you. With Vaultwarden, every one of them is yours, and the encryption only protects the data at rest rather than the decisions you make around it.
If you run it, don’t put it directly on the internet with a port forward. Use Tailscale or a Cloudflare Tunnel so there’s no open port pointing at your vault, keep the container updated, and disable the admin page unless you’re actively using it.
As always, security changes constantly and nothing here is a guarantee. Treat any setup that holds your passwords as something you re-check periodically rather than configure once and forget.
What self-hosting actually costs you
The container itself is the easy part, and it’s everything around it that people tend to underestimate, so here’s the realistic list of what moves onto your plate.
- Backups are now yours. If the storage dies and you don’t have a copy of the data directory, every password is gone. Not locked, gone.
- Uptime is now yours. If the machine is down and you’re away from home, you can’t reach your vault unless your clients have a cached copy.
- TLS is now yours. A certificate that quietly expires means apps stop syncing, and the failure isn’t always obvious.
- Updates are now yours. Containers don’t patch themselves, and this is the one you don’t want to leave stale.
- The lockout problem. If the server won’t start and your admin password is stored in the vault the server is hosting, you have a genuinely annoying afternoon ahead.
None of that is a reason to avoid self-hosting, it’s a reason to go in knowing what you’re taking on. Before you migrate anything, export an encrypted backup of your existing vault somewhere off the machine, and keep an offline copy of the handful of credentials you’d need to rebuild the server if it disappeared tomorrow.
What running it is actually like
Day to day, it’s uneventful, and that’s the honest answer. The container sits there using very little memory, the apps sync the way they always did, and weeks go by without you thinking about it. That’s exactly why the maintenance is easy to let slide, because nothing forces you to pay attention until something breaks.
The friction really shows up in two places. The first is remote access, because a vault sitting on your home network isn’t reachable from a coffee shop unless you’ve set up a tunnel or a VPN, and that’s a second piece of infrastructure you now depend on for something you need constantly. The second is the update habit, and while it’s a fast container to pull and restart, it’s entirely on you to remember, because a password server quietly running months-old code is the sort of thing you’d rather not discover later.
Neither one is difficult on its own, but they’re the kind of small recurring obligations that a $19.80 subscription makes disappear entirely, which is worth weighing honestly before you commit to running this yourself.
Do the official Bitwarden apps work with Vaultwarden?
Yes. This is the blocker people expect and it isn’t one. The browser extensions and the iOS and Android apps all let you set a custom server URL on the login screen, and once you point them at your instance they work normally. Autofill, sync, TOTP, and the rest all behave the same way.
The one thing to know is that a client can only talk to one server at a time. If you’re moving from hosted Bitwarden to Vaultwarden, export your vault first, then log out, change the server URL, and import.
Which one should you use?
Use hosted Bitwarden if you want it to work without thinking about it, you’re setting it up for family who won’t debug anything, or you travel and need the vault reachable from anywhere with no VPN in the way. The free tier is fine, and $19.80 a year for premium features is not a real obstacle.
Use Vaultwarden if you want your credentials living on your own hardware, you already run a home server and backups you trust, or you want premium features across several people without paying per seat. Running it on a NAS or a Pi is straightforward, and I’ve covered both: self-hosting on a Synology NAS and self-hosting on a Raspberry Pi.
If you specifically need the official server rather than Vaultwarden, Bitwarden documents that path in their on-premise install guide. It’s heavier, and for a home setup I don’t think it’s worth it over Vaultwarden.
Final thoughts
Vaultwarden isn’t a competitor to Bitwarden, it’s a lighter way to run the same thing yourself, and the choice comes down to how much operational responsibility you want for the one piece of software you can’t afford to lose access to.
I self-host mine because I like knowing exactly where that data sits, and because I already run the backups and the networking it needs. If you don’t have that in place, the subscription is the better answer, and there’s nothing wrong with picking it.
