| Effect of self-hosting | What is supported | Planning use |
|---|---|---|
| You run the server | A self-hosted credential manager lets you run the server yourself and gives you greater control over access. | Choose it if you want that control and will manage the host yourself. |
| Third-party exposure | Self-hosting can reduce exposure to third-party infrastructure when configured appropriately. | Treat the configuration as the safety feature, not the hosting location. |
| Patching | Self-hosting means patching promptly, every time. Vaultwarden must also be updated to match new Bitwarden client releases. | Decide who applies updates before you migrate any passwords. |
| No-server option | KeePassXC has no server, no account and no subscription. The vault is one KDBX file, and syncing it is your job. | Suits one person who wants the least infrastructure and accepts manual sync. |
Figures and statements above come from Psono and a comparison of open-source password managers.
A self hosted password manager can be safer than a cloud service only when you configure and maintain it well; the control it gives you comes with duties for updates, backups and access protection.
A vault is one layer in a wider routine, and the guide on how to protect yourself from hackers covers the other layers.
Safety trade-off: control versus responsibility
Self-hosting moves risk rather than removing it. Psono, which sells a self-hosted credential manager, says running the server yourself gives you greater control over access and can reduce exposure to third-party infrastructure when configured appropriately. The condition matters: a neglected server that you control can be a weaker target for you than a professionally run service.
The cloud risk is real too. In November 2022, LastPass told its users that attackers had stolen encrypted vault backups. That is the scenario self-hosting is meant to avoid: your vault data does not sit alongside other customers’ vaults. It does not remove the need to protect your own copy, so the same kind of backup file becomes your responsibility.
Bitwarden advises placing a self-hosted installation behind a proxy, a firewall and other safeguards for extra data security. Read that as a baseline: do not expose a vault directly to the internet without those layers.
What you take on as the owner
The honest trade-off is that you own the uptime, the backups and the updates, as one comparison puts it. Before you commit, weigh these consequences.
- Patching is not optional. The advice from the open-source comparison is to patch promptly, every time. Vaultwarden release 1.37.4 in October 2026 fixed seven advisories, one rated high, which shows how much a delay can leave exposed.
- Client and server must stay in step. New Bitwarden client releases regularly require a matching Vaultwarden update, so a vault that works today can break for a device that updated its app first.
- Recovery depends on you. With KeePassXC, if you lose the file and the master password, nobody can help you. Passbolt takes a different route, where account recovery needs admin approval, which means someone must hold that admin role.
- Availability is your problem. If the host is down, so is access from your other devices, unless you have a local copy or a fallback.
If that list sounds like a part-time job, a cloud service may suit you better. If it sounds manageable, the options below differ mostly in how much of it they ask of you.
Comparing the main self-hosted options
The choice comes down to how much infrastructure you are willing to run. Each project below is described by its own documentation or by the open-source comparisons linked in the text.
Bitwarden (official server)
The official server supports installs on Windows, Linux, Docker or Kubernetes. In practice it is a fleet of Docker containers with SQL Server underneath, installed by script, and needs a minimum of 2GB of RAM across a stack of 6+ Docker services. Bitwarden states that it regularly undergoes third-party audits and that audit results and compliance information are published and updated annually. It suits people who want the vendor’s own stack and have a host with spare memory.
Vaultwarden
Vaultwarden works with Bitwarden clients and is much lighter: it runs as a single Rust binary using under 50MB of RAM. It is one Docker container on SQLite by default, and MySQL and Postgres also work. It suits a small home server, with the caveat that you track updates against Bitwarden client releases.
KeePassXC
KeePassXC has no server at all. Your passwords live in an encrypted .kdbx file on your device, so there is nothing to patch on a network service and nothing to expose to the internet. The cost is that syncing across devices is your job, using a tool you choose such as Syncthing, iCloud or Dropbox. It suits an individual who values simplicity over seamless sync.
Passbolt
Passbolt can run behind your firewall and can be used in an air-gap environment. It states that it is audited by independent third parties several times a year. Its admin-approved account recovery fits a team with a designated administrator more than a single user.
Setting up a vault
Setup differs by project, but the common requirement is a host you can keep patched and a secure connection to it. Vaultwarden needs HTTPS, because the web vault will not work without a secure context, so plan a domain and certificate before you start. Pick the sequence that matches your choice.
- Place the host behind safeguards. Put it behind a proxy and firewall, as Bitwarden’s documentation advises, before adding real passwords.
- Vaultwarden: run docker compose up -d for the single container, then put HTTPS in front of it.
- Bitwarden: run the install script, configure your domain and SSL, then start it with ./bitwarden.sh start, as described in the comparison.
- Passbolt: download the compose file, verify it with sha512sum -c docker-compose-ce-SHA512SUM.txt, then launch it with docker compose -f docker-compose-ce.yaml up -d, following Passbolt’s instructions.
- KeePassXC: create the encrypted KDBX file on your device and choose how you will sync and copy it.
The checksum step in the Passbolt route is worth copying for any download you run as an installer: confirm the file matches what the project published before you execute it. Afterwards, sign in from each device you plan to use before relying on the vault.
Backups, updates and recovery
Treat the backup as part of the vault, not an extra. Bitwarden notes that its Docker or Kubernetes containers fit into an existing high-availability and recovery strategy, so a self-hosted install belongs inside whatever backup routine your host already has. A backup copy of an encrypted vault is still sensitive, which is the lesson of the LastPass incident, so store it with the same care as the live data.
- Server-based vaults: back up the container data, including the database (SQLite by default for Vaultwarden), and keep a copy on a separate device from the host.
- KeePassXC: copy the single KDBX file, and remember that the master password is as essential as the file itself.
- Restore test: practise restoring to a spare machine so the first time you attempt recovery is not an emergency.
- Updates: apply security updates promptly, and when a new Bitwarden client release appears, check for a matching Vaultwarden update.
Tie updates to release notices from your project rather than to a fixed calendar date, because the evidence stresses promptness and a single release can fix several advisories.
If the host machine is compromised
A vault is only as safe as the machine and network around it. If you suspect the server or the computer you manage it from has been breached, the recovery plan in Your Computer Was Hacked: A Practical Step-By-Step Recovery Plan For 2026 – Cubeguard sets out what to do next. To understand how the threats differ, read Ransomware vs Malware: How They Differ And How To Protect Yourself In 2026 – Cubeguard.
Frequently asked questions
Is a self-hosted password manager safer than cloud?
Not automatically. Psono says self-hosting can reduce third-party exposure only when configured appropriately, and the owner takes on patching, backups and uptime.
How long does a first install take?
A single-container Vaultwarden setup with docker compose up -d completes in under 10 minutes. The official Bitwarden server is a multi-container install and takes longer to configure.
Can Bitwarden’s server run on Windows?
Yes. The official self-hosted server supports Windows, Linux, Docker or Kubernetes. One comparison says the stack needs at least 2GB of RAM on Linux and 4GB on Windows.
Do I need a server at all?
No. KeePassXC keeps your vault in one encrypted file with no server, no account and no subscription, but you handle syncing and backups yourself.
