Install Vaultwarden Password Manager on VPS

June 2026 · 7 min read

Vaultwarden is a Bitwarden-compatible server written in Rust that uses significantly less resources than the official Bitwarden server — up to 10 times fewer resources. It runs comfortably on a VPS with just 512 MB of RAM. The best part is that you can use any official Bitwarden app (iOS, Android, Chrome extension) to access it, and all passwords are stored exclusively on your own server.

Install Vaultwarden with Docker

mkdir -p ~/vaultwarden
cd ~/vaultwarden

cat > docker-compose.yml << 'EOF'
version: "3.8"
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    ports:
      - "8080:80"
    environment:
      DOMAIN: https://vault.yourdomain.com
      SIGNUPS_ALLOWED: "false"   # Disable signups after creating your account
      ADMIN_TOKEN: "your-super-secret-admin-token-here"
      SMTP_HOST: smtp.yourdomain.com
      SMTP_PORT: 587
      SMTP_SECURITY: starttls
      SMTP_USERNAME: [email protected]
      SMTP_PASSWORD: yoursmtppass
      SMTP_FROM: [email protected]
    volumes:
      - ./data:/data
EOF

docker compose up -d

Set Up SSL with Nginx

sudo certbot --nginx -d vault.yourdomain.com

sudo nano /etc/nginx/sites-available/vaultwarden

server {
    listen 443 ssl;
    server_name vault.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/vault.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vault.yourdomain.com/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /notifications/hub {
        proxy_pass http://localhost:3012;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

sudo nginx -t && sudo systemctl reload nginx

Create User Account

# Open https://vault.yourdomain.com
# Click "Create Account" and set up your account with email + master password
# (You must remember your master password — if you forget it, there's no recovery)

# After creating your account, disable signups by setting
# SIGNUPS_ALLOWED: "false"
# in docker-compose.yml and restart the container

# Access the admin panel
# https://vault.yourdomain.com/admin
# Enter the ADMIN_TOKEN you configured

Connect Bitwarden App to Vaultwarden

# In Bitwarden app (iOS/Android/Chrome extension)
# Go to Settings > Server URL
# Enter: https://vault.yourdomain.com
# Log in with the email + master password you created

# For Bitwarden Desktop/Browser extension:
# Click the region icon > Self-hosted
# Server URL: https://vault.yourdomain.com

Verify Vaultwarden is Working Correctly

# Check container status
docker compose ps

# View logs
docker compose logs -f

# Verify HTTPS
curl -I https://vault.yourdomain.com

# Check admin panel
curl -I https://vault.yourdomain.com/admin

Common Issues & Troubleshooting

Bitwarden app won't connect (SSL error)

Your SSL certificate must be trusted by the browser and operating system. Self-signed certificates will cause errors — you must use Let's Encrypt:

# Check SSL certificate
curl -v https://vault.yourdomain.com 2>&1 | grep -E "SSL|certificate|expire"

2FA email not received

Your SMTP configuration is incorrect. Test it using the admin panel:

# Admin panel > Diagnostics > SMTP test
# https://vault.yourdomain.com/admin/diagnostics

Vaultwarden is slow or times out during sync

WebSocket notifications may not be working, which causes slow syncing. Verify that your nginx configuration includes the /notifications/hub route:

docker logs vaultwarden 2>&1 | grep -i "websocket\|notification"

Forgot the admin token (locked out of admin panel)

Update the environment variable in docker-compose.yml and restart:

ADMIN_TOKEN: "new-token-here"
docker compose up -d

Frequently Asked Questions

How is Vaultwarden different from the official Bitwarden server?

Vaultwarden is a third-party server implementation that uses the Bitwarden protocol but is written in Rust instead of .NET. It requires significantly less RAM — the official Bitwarden server needs multiple GB of RAM, while Vaultwarden runs comfortably on 100-200 MB of RAM.

Are passwords encrypted on the server?

Yes. Vaultwarden stores only encrypted data that is encrypted with your master password on the client side before being uploaded to the server. The server never "sees" your actual passwords. Even administrators cannot read your passwords without the master password.

Can I import passwords from LastPass or 1Password?

Yes, you can import from Bitwarden Web Vault > Tools > Import Data. It supports formats from LastPass, 1Password, Dashlane, KeePass, and CSV exports from Chrome and Firefox. The import happens entirely on the client side for security.