🩺 Vitals
- 🟢 Last active: 2026-09-18
- 📦 Latest release: 1.37.3 (2026-09-13)
- 🐞 Open issues: 79
- 🌟 Stars: 67.8k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: Vaultwarden Wiki
- Source: github.com/dani-garcia/vaultwarden
- License: AGPL-3.0
- Deployment: Docker
- Data Model: SQLite (default) / PostgreSQL / MariaDB
- Jurisdiction: Spain 🇪🇸 (Individual Maintainer)
- Compliance (SaaS): N/A
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (1/5) - Single container, binary plus SQLite
- Maintenance: Low (2/5) - You own updates, TLS and backups
- Enterprise Ready: Medium (3/5) - Org policies, event logs and SSO included, but no vendor SLA or foundation
1. The Executive Summary
What is it? Vaultwarden is a self-hosted password manager that reimplements the Bitwarden server API in Rust. Your organisation keeps the entire Bitwarden client ecosystem (browser, desktop, mobile, CLI) while the server it syncs to runs on infrastructure you control, as a single container rather than the official server's multi-service stack. It unlocks the organisation features Bitwarden charges for (collections, groups, event logs, SSO, admin password reset) at no licence cost.
The Strategic Verdict:
- 🟢 For SMEs and teams leaving a SaaS vault: Strong Buy. A single container on a small VPS gives an entire company a shared, self-hosted vault with paid-tier features, at zero licence cost and under EU jurisdiction.
- 🔴 For regulated enterprises needing a vendor to sign: Caution. The project is maintained by one developer with no foundation, no commercial SLA and no certification you can inherit. If procurement requires a counterparty, run the official Bitwarden server instead.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | 1Password Business (SaaS) | Vaultwarden (Self-Hosted) |
|---|---|---|
| Per-Seat Licensing | Recurring monthly fee per user | None (unlimited users) |
| Data Jurisdiction | Vendor cloud, US-governed | Your infrastructure, your jurisdiction |
| Infrastructure | Included in subscription | One small VPS (single container) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A single Docker container bundling the binary and a SQLite database. This is the lightweight contrast to the official server's Identity, Api and Admin service split, and is what makes it the default choice for a home-lab or a small business box.
- Hardening is yours: The container speaks plain HTTP. You are responsible for terminating TLS at a reverse proxy such as Traefik or Caddy, restricting the admin panel, and backing up the database. None of this is optional for a credential store.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & the Hosting Question: The maintainer is based in Spain, so the code carries EU provenance with no US CLOUD Act or foreign-localisation exposure at the project layer. The nuance is that the project ships no hosted service of its own. Every public Vaultwarden instance you find online is operated by an independent vendor, and inherits the jurisdiction and custody risk of whoever runs that box. The only deployment that actually holds the sovereignty the project makes possible is the one you run yourself on infrastructure you control.
- The Compliance Shift: Vaultwarden moves 100% of the compliance burden onto you. There is no SaaS offering and therefore no SOC 2 or ISO 27001 report to inherit. The software provides the technical controls (encryption at rest, event logs, RBAC), but infrastructure security, reverse-proxy hardening and any formal certification of the deployment are entirely your responsibility.
- Bus Factor and the AGPL Clause: The commercial risk is governance, not popularity. Sixty-six thousand stars do not change the fact that the project rests on a single maintainer with no foundation or corporate backing, which is a real long-term sustainability question for a credential store. Separately, the AGPL-3.0 licence is safe for internal corporate use but triggers a source-disclosure obligation if you modify it and offer it as a network service.
4. Market Landscape
🏢 Proprietary Incumbents
- 1Password
- LastPass
🤝 Open Source Ecosystem
- Bitwarden: The official heavyweight sibling. Where Vaultwarden is a single community-maintained container, the official server ships a vendor-backed multi-service stack with a commercial SLA and inheritable certifications.
- KeePassXC: The offline counterpart. Where Vaultwarden syncs a shared organisational vault, KeePassXC holds break-glass and air-gapped credentials in a local file that never reaches a server.