Self-Hosting Vaultwarden: What You Need to Know

Vaultwarden is a lightweight server that speaks the same protocol as Bitwarden, so the official Bitwarden apps and browser extensions work with it while your vault data stays on your own network. There is one requirement that catches people out: the apps will not connect without HTTPS, even on your own network.

Reading is great. Tracking makes it stick. Sign up for a free Dashboard to tick off tasks and see your Security Score.

Get my free Dashboard →

CE: Secure Configuration⏱ 6 min read

A secure electronic safe with a key and keypad

Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.

Why HTTPS is not optional here

The Bitwarden apps and browser extensions refuse to connect to a server over plain HTTP, with one exception: connecting to "localhost" on the same device. Anywhere else on your network, including your own LAN, needs a valid HTTPS certificate. This is a Bitwarden client restriction, not a Vaultwarden setting you can switch off, so it is worth planning for before you install anything.

Your realistic options for HTTPS at home

A few approaches actually work well for home use, in rough order of how much effort they take.

Pair it with a VPN like WireGuard or Tailscale: some VPN tools can issue a proper HTTPS certificate for a private address reachable only over the VPN, giving you a real certificate with no public exposure at all
Run a reverse proxy such as Caddy in front of Vaultwarden: Caddy can fetch a genuine certificate automatically if you own a domain name, even one only ever used internally
A self-signed certificate works for browser extensions, once you accept the one-time warning, but the official mobile apps are stricter and usually will not accept one without extra setup

3 steps

10 Self-Hosted Servers Worth Running for a More Secure Home Lab

Installing it

Vaultwarden is distributed as a Docker image, which is the officially supported way to run it. A basic setup is one container plus a persistent folder for its data, with your reverse proxy sitting in front of it handling HTTPS.

Use the official "vaultwarden/server" image rather than an unofficial fork
Store its data folder outside the container, on a volume that survives an update or rebuild
Create your own account first, then disable public sign-ups in the settings, otherwise anyone who can reach the server can create one

3 steps

After it is running

Back up the data folder regularly, this is your password vault, losing it is far worse than losing most other self-hosted data
Keep the container image updated, security tools are exactly the kind of thing worth staying current on
Do not forward its port directly to the internet, use a VPN for access away from home rather than exposing it publicly

3 steps

Frequently asked questions

Can I just use Vaultwarden over plain HTTP on my home network?

Only from the same device using "localhost". Anywhere else on your network, the Bitwarden apps require a valid HTTPS certificate to connect at all.

Is Vaultwarden the same as Bitwarden?

No, it is a separate, independently written server that implements the same protocol, so the official Bitwarden apps work with it. It is not made or officially supported by Bitwarden itself.

What happens if I lose the server or its data?

You lose your entire vault unless you have a backup. Treat backups of the data folder as essential, not optional, from day one.

Track your AI safety progress. Free.

Create a free account to tick off tasks, see your Security Score improve, and know exactly what you've done and what's still to do.

Start your free security check

← Back to AI Homelab Projects Hub