Wissensdatenbank

Vaultwarden is a lightweight, unofficial server implementation compatible with Bitwarden clients — letting you self-host a password manager while using the official Bitwarden apps and browser extensions to connect to it.

Prerequisites

• Docker Engine and Docker Compose installed
• A domain name with HTTPS (required — Bitwarden clients refuse to connect over plain HTTP)

Step 1 — Create a Project Directory

mkdir ~/vaultwarden && cd ~/vaultwarden

Step 2 — Create docker-compose.yml

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=true
      - ADMIN_TOKEN=${ADMIN_TOKEN}
    volumes:
      - vw_data:/data
    ports:
      - "8080:80"

volumes:
  vw_data:

Step 3 — Generate a Strong Admin Token

openssl rand -base64 48

Add this to a .env file:

ADMIN_TOKEN=your_generated_token_here

Step 4 — Start Vaultwarden

docker compose up -d

Step 5 — Add HTTPS (Mandatory)

See How to Install Nginx Proxy Manager with Docker — route your domain to port 8080 with a valid SSL certificate. Bitwarden clients will not connect to a self-hosted instance without valid HTTPS.

Step 6 — Create Your Account

https://vault.yourdomain.com

Register your first account through the web vault.

Step 7 — Disable Further Signups (Important)

After creating your account(s), disable open registration to prevent anyone else from creating accounts on your instance:

environment:
  - SIGNUPS_ALLOWED=false

docker compose up -d

Step 8 — Connect Bitwarden Clients

In the official Bitwarden desktop app, browser extension, or mobile app, go to settings and change the server URL to your self-hosted instance before logging in.

Accessing the Admin Panel

https://vault.yourdomain.com/admin

Use the admin token from Step 3 to manage users, view diagnostics, and configure organization settings.

Enabling Two-Factor Authentication

Configure 2FA for your Vaultwarden account through the web vault's account settings — strongly recommended given this instance stores all your passwords.

Backing Up Vaultwarden

docker run --rm -v vaultwarden_vw_data:/data -v $(pwd):/backup alpine tar czf /backup/vaultwarden-backup.tar.gz /data

This is one of the most critical backups you'll maintain, given it contains every password you have — follow the 3-2-1 rule strictly (see Backup Strategy 101: The 3-2-1 Rule Explained) and encrypt the backup (see Backup Encryption: Protecting Your Backups from Unauthorized Access).

Common Errors

Clients refuse to connect — verify HTTPS is properly configured with a valid, trusted certificate; self-signed certificates aren't accepted by official clients without additional configuration.

"Invalid admin token" — verify you're using the exact token set in the environment variable, with no extra whitespace.

Best Practices

• Disable signups after creating your intended accounts
• Always use valid HTTPS, never plain HTTP
• Enable 2FA on your Vaultwarden account itself
• Back up the data volume rigorously and encrypt those backups

Related Articles

• Backup Strategy 101: The 3-2-1 Rule Explained
• Backup Encryption: Protecting Your Backups from Unauthorized Access
• How to Install Nginx Proxy Manager with Docker