Self-Hosted Bitwarden Fork: What You Need to Know

If you quit your Bitwarden subscription and self-hosted it with an open-source fork, you’re using a community-maintained version of the Bitwarden server that runs on your own hardware, with no per-user fees. This article explains what that means in practice, the main forks available, how to choose one, common pitfalls, and whether it’s a safe alternative to the official paid service.

Why People Leave Bitwarden’s Paid Plan

Bitwarden’s free tier already covers unlimited passwords and sync across devices, but the paid Premium plan (about $10/year) adds features like TOTP authenticator codes, hardware-key support, and encrypted file attachments. Some users quit because they want those features without paying, others because they object to any cloud dependency, and a few because they want to control the server code themselves.

Self-hosting the official Bitwarden server is free and open source, but it’s heavy: it requires Docker, a database, and a reverse proxy, and it consumes a lot of RAM (often 2 GB+). That’s why forks exist—they strip out the enterprise parts, simplify deployment, or add features the official server lacks.

The Main Open-Source Forks

Three forks dominate the self-hosting community. Each takes a different approach, so “which is best” depends on your priorities.

Vaultwarden (formerly bitwarden_rs) – Written in Rust, it’s a lightweight reimplementation of the Bitwarden server API. It uses SQLite or MySQL, runs in under 100 MB RAM, and supports nearly all Bitwarden clients. It’s the most popular fork by far and the one most people mean when they say “self-hosted Bitwarden fork.”
Passky – Not a fork of Bitwarden’s code, but a separate password manager with a similar self-hosted model. It has its own clients and server, and is much simpler to deploy, but it’s not compatible with existing Bitwarden apps.
Bitwarden’s own server with a custom script – Some users run the official server but use community scripts (like bitwarden-selfhost) to reduce the setup overhead. This isn’t a fork, but it’s a common alternative.

How Vaultwarden Works

Vaultwarden replicates the Bitwarden API endpoints that clients need: login, sync, vault items, attachments, and TOTP generation. You install it on a Linux server (or a Raspberry Pi), expose it via HTTPS, and point your Bitwarden apps to your custom server URL. The clients don’t know they’re talking to a fork—they just see a compatible server.

Key differences from the official server:

Single binary, no Docker required (though Docker images are available).
SQLite by default, so no separate database setup.
Admin panel for user management, which the official server lacks.
Built-in support for TOTP, attachments, and even some premium features without a license.

Choosing a Fork: What to Look For

Before you commit, consider these factors:

Client compatibility – Vaultwarden works with all official Bitwarden apps (desktop, mobile, browser). Passky does not, so you’d have to switch apps.
Update frequency – Vaultwarden releases regularly, but not as fast as Bitwarden. If a client adds a new feature, the fork may lag.
Security posture – Forks are audited less frequently than the official server. Vaultwarden has had independent audits, but you’re relying on community review.
Resource footprint – Vaultwarden runs on a 1 GB RAM VPS. The official server needs at least 2 GB and often more.
Backup strategy – You must back up the SQLite database and any attachments. Some forks have built-in backup scripts; others don’t.

Common Problems and How to Fix Them

Self-hosting any password manager comes with pitfalls. Here are the ones users hit most often:

HTTPS certificate issues – Bitwarden clients require a valid SSL certificate; they won’t accept self-signed ones. Use Let’s Encrypt with a real domain, or a reverse proxy like Caddy that auto-issues certificates.
Port conflicts – Vaultwarden defaults to port 80 for HTTP and 3012 for WebSocket. If you already run a web server, change the ports or use a subdomain.
Mobile app can’t connect – On iOS and Android, you must set the server URL to https://yourdomain.com (no trailing slash). If you use a self-signed cert, the app will refuse to connect.
Database corruption – SQLite can corrupt if the server crashes during a write. Enable WAL mode and back up regularly.
Missing push notifications – Bitwarden’s official server sends push notifications to mobile apps. Vaultwarden supports a workaround using a free push relay, but it requires extra setup.

Cost Comparison: Fork vs. Paid Subscription

The monetary cost of self-hosting is not zero. You need a server (a $5/month VPS is typical), a domain name (around $10/year), and your time for maintenance. Over three years, that’s roughly $180–$200, versus $30 for Bitwarden Premium. However, if you already own a server for other purposes, the marginal cost is near zero.

More important than money is the cost of responsibility: you are now the one who must apply security updates, monitor for breaches, and restore from backups. A paid service does that for you.

Safety and Security Considerations

Your vault is encrypted with your master password before it leaves your device, so even if your server is compromised, an attacker cannot read your passwords without that password. That said, the server still handles your encrypted blob, and a malicious server could serve you a fake client or tamper with the web vault. For this reason, always use the official apps (not the web vault) and verify the server’s certificate.

Another risk: forks may not implement every security feature. For example, Vaultwarden supports hardware keys, but some advanced enterprise policies (like IP allowlists) are not implemented. If you use those features, a fork may not be safe for you.

Finally, consider that Bitwarden’s official server has been audited by third parties. Vaultwarden has also had audits (e.g., by Cure53 in 2023), but not on the same schedule. If you’re a high-value target, the official cloud may be safer.

Alternatives to a Fork

If you’re not comfortable with a community fork, you have other options:

Stay on Bitwarden Free – It’s genuinely free and lacks only Premium features like TOTP and attachments. You can use a separate TOTP app.
Run the official Bitwarden server – It’s free, but resource-heavy. You get all features, including enterprise policies, without paying.
Use a different password manager – KeePassXC is fully offline, and Proton Pass has a self-hosted option (though it’s newer).

Frequently Asked Questions

Is Vaultwarden legal to use?

Yes. Bitwarden’s server code is under GPL-3.0, and Vaultwarden is a separate project that reimplements the API, not a copy of Bitwarden’s code. It’s legal to run and modify.

Will my Bitwarden apps work with Vaultwarden?

Yes, all official Bitwarden clients (desktop, mobile, browser extension) can connect to a Vaultwarden server by changing the server URL. Some features like Bitwarden Send and password generator history work, but a few enterprise-only features may not.

Can I migrate from Bitwarden cloud to a fork?

Yes. Export your vault from Bitwarden as a JSON or CSV file, then import it into Vaultwarden via the web interface. Attachments and TOTP seeds are included in the JSON export, but not in CSV.

How often should I update Vaultwarden?

At least monthly, or whenever a security release is published. Vaultwarden posts release notes on GitHub. You can set up a cron job to pull the latest Docker image and restart the container.

What happens if the fork is abandoned?

You can still use the last version, but you won’t get security fixes. To mitigate, export your vault regularly and keep a copy of your master password. You can also switch to the official server later, since the data format is compatible.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →