DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-02
- 📦 Latest release: 1.37.5 (2026-11-01)
- 🐞 Open issues: 92
- 🌟 Stars: 70.1k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: Vaultwarden Wiki
- Source: github.com/dani-garcia/vaultwarden
- License: AGPL-3.0
- Deployment: Docker
- Data Model: SQLite (default) / PostgreSQL / MariaDB
- Jurisdiction: Undisclosed 🌐 (Community Project)
- Compliance (SaaS): N/A (No managed service)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (2/5) - Single container server (binary plus SQLite)
- Maintenance: Low (2/5) - You own updates, TLS and backups
- User Management: High (4/5) - Native OIDC SSO, org RBAC (collections/groups), and event-log auditing self-hosted; no SCIM
1. The Executive Summary
What is it? Vaultwarden is a self-hosted password manager that reimplements the Bitwarden server API in Rust. Your organisation keeps the entire Bitwarden client ecosystem (browser, desktop, mobile, CLI) while the server it syncs to runs on infrastructure you control, as a single container rather than the official server's multi-service stack. It unlocks the organisation features Bitwarden charges for (collections, groups, event logs, SSO, admin password reset) at no licence cost.
The Strategic Verdict:
- 🟢 For SMEs and teams leaving a SaaS vault: Strong Buy. A single container on a small VPS gives an entire company a shared, self-hosted vault with paid-tier features, at zero licence cost, on infrastructure and under a jurisdiction you choose.
- 🔴 For regulated enterprises needing a vendor to sign: Caution. A team of volunteer maintainers runs the project in their spare time, with no foundation or corporate backing, no commercial SLA and no certification you can inherit. If procurement requires a counterparty, run the official Bitwarden server instead.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | 1Password Business (SaaS) | Vaultwarden (Self-Hosted) |
|---|---|---|
| Per-Seat Licensing | Recurring monthly fee per user | None (unlimited users) |
| Data Jurisdiction | Vendor cloud (Canadian vendor; data region chosen at sign-up) | Your infrastructure, your jurisdiction |
| Infrastructure | Included in subscription | One small VPS (single container) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A single Docker container bundling the binary and a SQLite database. This is the lightweight contrast to the official server's Identity, Api and Admin service split, and is what makes it the default choice for a home-lab or a small business box.
- Hardening is yours: The container speaks plain HTTP. You are responsible for terminating TLS at a reverse proxy such as Traefik or Caddy, restricting the admin panel, and backing up the database. None of this is optional for a credential store.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & the Hosting Question: The project discloses no legal entity and no domicile: a team of volunteer maintainers runs it. The US CLOUD Act is moot at the project layer, since the project ships no hosted service of its own and holds none of your vault data. Every public Vaultwarden instance you find online is operated by a third party, and inherits the jurisdiction and custody risk of whoever runs that box. The only deployment that actually holds the sovereignty the project makes possible is the one you run yourself on infrastructure you control.
- The Compliance Shift: Vaultwarden moves 100% of the compliance burden onto you. There is no SaaS offering and therefore no SOC 2 or ISO 27001 report to inherit. The software provides the technical controls (encryption at rest, event logs, RBAC), but infrastructure security, reverse-proxy hardening and any formal certification of the deployment are entirely your responsibility.
- Bus Factor and the AGPL Clause: The commercial risk is governance, not popularity. Its popularity does not change the fact that the project rests on volunteer maintainers working in their spare time, with no foundation or corporate backing, which is a real long-term sustainability question for a credential store. Separately, the AGPL-3.0 licence is safe for internal corporate use but triggers a source-disclosure obligation if you modify it and offer it as a network service.
4. Market Landscape
🏢 Proprietary Incumbents
- 1Password
- LastPass
🤝 Open Source Ecosystem
- Bitwarden: The official heavyweight sibling. Where Vaultwarden is a single community-maintained container, the official server ships a vendor-backed multi-service stack with a commercial SLA and inheritable certifications.
- KeePassXC: The offline counterpart. Where Vaultwarden syncs a shared organisational vault, KeePassXC holds break-glass and air-gapped credentials in a local file that never reaches a server.