Vaultwarden

Vaultwarden (formerly known as bitwarden_rs) is a Bitwarden server-side rewrite in the Rust language, typically requiring only 50–100MB of memory, and is fully compatible with official Bitwarden clients.

Vaultwarden implements the vast majority of the official Bitwarden API, supporting connections from the official desktop client, browser extensions, mobile apps, and CLI tools.

Typical self-hosted projects include replacing Google Drive with Nextcloud, replacing Netflix with Jellyfin, and replacing LastPass with Bitwarden.

Triwarden is a native Mac password manager app built with Swift and SwiftUI, compatible with Bitwarden's official service and self-hosted Vaultwarden.

Vaultwarden is a lightweight open-source compatible implementation of the Bitwarden server API, written in Rust, fully compatible with the official clients, with extremely low resource usage, able to run smoothly on a Raspberry Pi or a low-spec VPS, and supporting core features such as organizations, attachments, and two-factor authentication.

The complete service stack deployed by the user includes Immich, Pi-hole, Vaultwarden, Tailscale, Cloudflare Tunnel, Jellyfin, Seerr, Prowlarr, Sonarr, Radarr, Bazarr, SABnzbd, Gotify, and Watchtower.

Common self-hosted alternatives include using Nextcloud in place of Google Drive, Vaultwarden in place of the Bitwarden cloud, Home Assistant for smart home management, and Jellyfin for building a private media library.

Vaultwarden is a completely independent community project with no direct employment relationship with the Bitwarden company.

Vaultwarden's bus factor has historically been low, driven primarily by a small number of core developers, presenting a centralization risk.

Users can export their vault as an encrypted file or JSON/CSV through the client's export vault feature, then import it into an official self-hosted instance or Bitwarden cloud, achieving migration from Vaultwarden to the official server.

Vaultwarden and official Bitwarden use the same client and data format, making the export-import path independent of the specific server-side implementation.

In scenarios where hardware resources are sufficient, resource consumption is no longer a decisive factor in choosing between Vaultwarden and official Bitwarden.

When a self-hosted password manager is exposed to the public internet, access rate limiting and IP blocking should be configured at the Vaultwarden or Nginx/Caddy reverse proxy layer to prevent brute-force attacks.

Both Vaultwarden and official Bitwarden support TOTP-based two-step verification and can be used with authenticator apps such as Aegis and Authy.

Vaultwarden's core selling point is its extremely low resource consumption, capable of running smoothly with just a few dozen MB of memory.

Vaultwarden may experience brief compatibility lag periods after new client versions are released, requiring the community to follow up and adapt to official feature updates.

Vaultwarden is a lightweight rewrite of the Bitwarden server.

Vaultwarden, Paperless, and Jellyfin are regarded as practical and interesting flagship projects in the self-hosting space.

It is recommended that backups of self-hosted password managers follow at least the 3-2-1 principle (3 copies, 2 types of media, 1 offline copy).

It is recommended to restrict Vaultwarden access to private networks such as a VPN or Tailscale, avoiding direct exposure to the public internet.