Self-host Vaultwarden to administer your own password-vault service and choose where it runs. Keep its software, access controls and recovery plan under review. Creating an Impreza account without email is separate from securing and recovering the accounts inside your vault.
Why host your own vault
- Bitwarden-compatible clients, with the server and client versions checked before rollout
- Lightweight: the Rust server runs comfortably in 512 MB of memory
- One-click install with HTTPS issued automatically
- Offshore and no KYC, paid in crypto, with no card tied to the vault
Get it running
Pick a small VPS
Choose resources for your users, attachments and installed version. Include capacity for recovery copies and maintenance, then test the clients you intend to use.
Install it in one click
Install Vaultwarden from the catalog, give it a hostname, and the certificate is issued for you. See how one-click installs work.
Create your account, then close the door
Open the web vault, register your account, and immediately turn signups off so nobody else can register on your server.
Connect your clients
Point the Bitwarden apps and extensions at your own server URL instead of the hosted service. Same clients, your infrastructure.
A fresh install accepts new registrations. If you leave that on, anyone who finds the URL can create an account on your vault server. Set signups to false the moment your own account exists, and treat it as part of the install, not a later chore.
Protect the vault database and attachments, plus the configuration and keys needed by your deployment. Include Send files if you need existing Sends to survive recovery. For SQLite, follow Vaultwarden’s supported backup procedure instead of assuming a copy of a live database is consistent. Backup configuration can contain sensitive data, so protect backup access too.
Check the Impreza app backup coverage and test recovery in an isolated destination. Before a server move, verify sign-in, vault synchronization, attachments and the server URL configured in your clients. A platform recovery code does not reset a vault’s master password.
An optional onion address can provide access through Tor. To restrict the vault to that path, review public routing, exposed ports and client compatibility; adding an onion address alone does not remove public access. See the Tor publishing guide.
End-to-end encryption means the server never sees your master password, and neither do we. That is the point, and it also means nobody can reset it for you. Store it somewhere you will not lose it.
Keep platform and vault access separate
For supported deployments with the Impreza Agent online, use app inspection and maintenance to check deployment health without placing vault secrets in shared logs. Then verify sign-in and synchronization in a test account.
If an assistant needs delegated app access, limit the resources, actions and duration to the maintenance task. Keep the vault master password and recovery information out of that delegation. Platform access does not replace vault authentication or the tested recovery procedure above.
Start now
Spin up an offshore VPS and install from the catalog, or read the documentation first.