Self-host Vaultwarden

Vaultwarden is an independent implementation of the Bitwarden server protocol. You operate the server, backups, TLS and updates. Review the upstream deployment guide before installation.

Choose a reviewed image digest, bind the service to loopback and place it behind your TLS reverse proxy. Set your own canonical domain. Enable registration only while creating the first account, then disable it. Use a strong master password and enable a second factor.

Back up the data volume with the service stopped or use a consistent SQLite backup. Keep an encrypted off-host copy and prove restoration on an isolated host before relying on it. Update deliberately after reviewing upstream release notes.

services:
  vaultwarden:
    image: vaultwarden/server@${VAULTWARDEN_REVIEWED_SHA256:?Set a reviewed sha256 digest}
    restart: unless-stopped
    ports: ["127.0.0.1:8081:80"]
    environment:
      DOMAIN: ${VAULTWARDEN_DOMAIN:?Set your own HTTPS domain}
      SIGNUPS_ALLOWED: "false"
    volumes: ["./vault-data:/data"]
# Configure your TLS reverse proxy separately; never expose the loopback port.

• Upstream deployment guide (read 2026-11-05 UTC)
• Hosted alternative