Keep control of where your password-vault service runs. Deploy a supported Vaultwarden recipe, connect compatible clients and use My Apps or an authorized AI assistant for supported platform operations. Keep vault passwords and recovery secrets out of prompts.
Why host your own vault
- Bitwarden-compatible clients, with the server and client versions checked before rollout
- Lightweight: the Rust server runs comfortably in 512 MB of memory
- One-click install with HTTPS issued automatically
- Offshore and no KYC, paid in crypto, with no card tied to the vault
Get it running
Pick a small VPS
Choose resources for your users, attachments and installed version. Include capacity for recovery copies and maintenance, then test the clients you intend to use.
Install it in one click
Install Vaultwarden from the catalog, give it a hostname, and the certificate is issued for you. See how one-click installs work.
Create your account, then close the door
Open the web vault, register your account, and immediately turn signups off so nobody else can register on your server.
Connect your clients
Point the Bitwarden apps and extensions at your own server URL instead of the hosted service. Same clients, your infrastructure.
A fresh install accepts new registrations. If you leave that on, anyone who finds the URL can create an account on your vault server. Set signups to false the moment your own account exists, and treat it as part of the install, not a later chore.
Protect the vault database and attachments, plus the configuration and keys needed by your deployment. Include Send files if you need existing Sends to survive recovery. For SQLite, follow Vaultwarden’s supported backup procedure instead of assuming a copy of a live database is consistent. Backup configuration can contain sensitive data, so protect backup access too.
Check the Impreza app backup coverage and test recovery in an isolated destination. Before a server move, verify sign-in, vault synchronization, attachments and the server URL configured in your clients. A platform recovery code does not reset a vault’s master password.
An optional onion address can provide access through Tor. To restrict the vault to that path, review public routing, exposed ports and client compatibility; adding an onion address alone does not remove public access. See the Tor publishing guide.
End-to-end encryption means the server never sees your master password, and neither do we. That is the point, and it also means nobody can reset it for you. Store it somewhere you will not lose it.
Keep platform and vault access separate
For supported deployments with the Impreza Agent online, use app inspection and maintenance to check deployment health without placing vault secrets in shared logs. Then verify sign-in and synchronization in a test account.
If an assistant needs delegated app access, limit the resources, actions and duration to the maintenance task. Keep the vault master password and recovery information out of that delegation. Platform access does not replace vault authentication or the tested recovery procedure above.
Choose the recipe and plan your updates
The Impreza catalog offers an updated Vaultwarden recipe for new installations. A catalog update does not upgrade an existing app or convert its data. Review the version available in My Apps, back up the app’s covered data and follow the application’s supported upgrade path before changing an installed instance. Confirm the restored or upgraded app’s important functions before moving users to it.
For the installation flow and version shown at deploy time, use the app catalog guide.
Start now
Spin up an offshore VPS and install from the catalog, or read the documentation first.