Vaultwarden: The Lightweight Bitwarden Backend in Rust
The official Bitwarden server is an excellent piece of software—secure, feature-rich, and thoroughly audited. But it comes with a significant drawback: it requires Microsoft SQL Server, multiple container services, and at least 2-4GB of RAM just to run. For the homelab enthusiast running services on a Raspberry Pi, or the small team with a modest VPS, that is an unreasonable price to pay for password management. Vaultwarden solves this problem brilliantly: it is a complete reimplementation of the Bitwarden server API in Rust, packed into a single binary that runs on as little as 30MB of RAM and uses a simple SQLite database. And because it is fully API-compatible, every official Bitwarden client—browser extensions, mobile apps, desktop apps—works with it seamlessly.
1. What Is Vaultwarden?
Vaultwarden (formerly known as Bitwarden_RS) is an unofficial, lightweight, self-hosted implementation of the Bitwarden server API. It is written in Rust and designed to be a drop-in replacement for the official Bitwarden server, offering the same API that Bitwarden's clients expect—but with a fraction of the resource requirements.
The project was created to solve a very real problem: the official Bitwarden server is too heavy for small deployments. The official server requires:
- Microsoft SQL Server (which alone needs 1-2GB of RAM)
- Multiple Docker containers (identity, API, admin, events, icons, notifications, push, sso, etc.)
- .NET runtime
- At least 2-4GB of total RAM
- A single binary or Docker container
- SQLite (embedded, zero-configuration) or optional MySQL/PostgreSQL
- ~30-50MB of RAM
- A Raspberry Pi is more than sufficient
It is important to understand what Vaultwarden is not: it is not a fork of Bitwarden's server code. It is a from-scratch reimplementation of the Bitwarden API. This means it does not use any of Bitwarden's server-side code, but it produces the same API responses that Bitwarden's clients expect. From the perspective of your browser extension or mobile app, a Vaultwarden server looks and behaves exactly like the official Bitwarden server.
2. Key Features
Full Bitwarden API Compatibility
Vaultwarden implements the Bitwarden API so completely that all official Bitwarden clients work without modification:
- Bitwarden Browser Extensions: Chrome, Firefox, Edge, Safari, Brave, and more
- Bitwarden Mobile Apps: iOS and Android (with autofill support)
- Bitwarden Desktop Apps: Windows, macOS, and Linux
- Bitwarden Web Vault: the official web interface
- Bitwarden CLI: the command-line interface for automation
- Bitwarden Directory Connector: for syncing users from LDAP/AD
bitwarden.com, and everything works.
Extremely Low Resource Usage
Vaultwarden's most compelling feature is its efficiency:
- Memory: ~30-50MB of RAM in typical use (compare to 2-4GB for the official server)
- CPU: negligible—mostly idle unless syncing or transcoding
- Disk: the binary is ~20MB; the database starts at a few hundred KB and grows slowly
- Database: SQLite by default (a single file), with optional support for MySQL/MariaDB and PostgreSQL for larger deployments
- Raspberry Pi (3, 4, or 5)
- Low-end VPS ($3-5/month plans)
- NAS devices (Synology, QNAP)
- Any spare hardware with minimal resources
Single Binary Deployment
Vaultwarden is distributed as a single compiled binary. There is no runtime to install, no dependency hell, and no complex configuration. You can:
- Download the binary and run it directly:
./vaultwarden - Run it in Docker (the most common method)
- Run it behind any reverse proxy (nginx, Caddy, Traefik, Apache)
SQLite Database Support
The use of SQLite as the default database is a major simplification. Unlike Microsoft SQL Server (required by the official Bitwarden server), SQLite:
- Requires zero configuration
- Stores all data in a single file
- Needs no separate server process
- Is embedded directly in the Vaultwarden binary
- Is perfectly adequate for personal and small-team use (up to hundreds of users)
All Premium Features—Free
The official Bitwarden server gates certain features behind a Premium subscription ($10/year). Vaultwarden, being an independent implementation, includes all of these features at no cost:
- TOTP code storage: store and generate 2FA codes for your other services
- File attachments: attach files to vault items (encrypted)
- Bitwarden Send: securely share encrypted text and files with anyone
- Vault health reports: weak passwords, reused passwords, breached passwords, etc.
- Emergency access: designate trusted contacts for emergency vault access
- Folder and collection sharing: share items with other users
Organization and Sharing
Vaultwarden supports Bitwarden Organizations, allowing you to:
- Create shared vaults for teams or families
- Organize shared items into collections
- Manage users with different roles (owner, admin, manager, user)
- Share passwords, secure notes, and other items with specific users or groups
Multi-User Support
Unlike some self-hosted password managers that are single-user only, Vaultwarden supports unlimited user accounts. Each user gets their own encrypted vault, and you can create organizations for shared access. This makes it suitable for families, small teams, and even medium-sized organizations.
Admin Panel
Vaultwarden includes a built-in admin panel (accessible at /admin) that allows you to:
- Configure general settings (server name, domain, etc.)
- Configure SMTP for email notifications
- Manage user accounts (invite, delete, disable)
- View diagnostic information
- Configure database settings
- Toggle features like registration, password reset, etc.
Web Vault
Vaultwarden serves the official Bitwarden Web Vault directly from the same binary. When you navigate to your Vaultwarden URL in a browser, you get the full Bitwarden web interface—no additional setup required. The web vault is automatically updated when you update Vaultwarden.
3. Technical Architecture
Vaultwarden's architecture is deliberately minimal:
- Language: Written in Rust, which provides memory safety, high performance, and a small binary size. Rust's zero-cost abstractions and lack of garbage collection mean predictable, low memory usage.
- Web Framework: Uses Rocket (a Rust web framework) for HTTP handling. Recent versions have migrated to Iron and then to a custom framework, but the key point is that it is lightweight and fast.
- Database: Uses Diesel (a Rust ORM) for database access, supporting SQLite, MySQL/MariaDB, and PostgreSQL through a single codebase.
- Cryptography: Implements the same encryption scheme as Bitwarden: AES-256-CBC for data encryption, PBKDF2 (or Argon2id) for key derivation, and SHA-256 for hashing. All crypto operations use the ring library (a Rust crypto library audited by Cure53).
- Web Vault: Serves a pre-built version of the official Bitwarden Web Vault as static files.
- WebSocket Support: Includes a built-in WebSocket server for real-time sync notifications, enabling instant vault updates across devices.
1. Minimalism: one binary, one database file, one process
2. Compatibility: implement the exact API that Bitwarden clients expect
3. Efficiency: Rust's performance characteristics mean the server barely uses resources
4. Security: all encryption happens client-side (same as official Bitwarden), so the server never sees plaintext data
4. Quick Deployment with Docker
Prerequisites
- Docker and Docker Compose installed
- A domain name with DNS pointing to your server (Bitwarden clients require HTTPS)
- A reverse proxy for SSL termination (Caddy, nginx, Traefik, etc.)
docker-compose.yml
version: "3.8"
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
environment:
- DOMAIN=https://vault.yourdomain.com
- ADMIN_TOKEN=your_secure_admin_token_here
- SIGNUPS_ALLOWED=true
- INVITATIONS_ALLOWED=true
- SHOW_PASSWORD_HINT=false
- WEBSOCKET_ENABLED=true
- SMTP_HOST=smtp.yourprovider.com
- [email protected]
- SMTP_PORT=587
- SMTP_SECURITY=starttls
- SMTP_USERNAME=your_email
- SMTP_PASSWORD=your_email_password
volumes:
- ./vw_data:/data
ports:
- "8080:80" # Web vault
- "3012:3012" # WebSocket notifications
restart: unless-stopped
Step-by-Step Deployment
1. Create the project directory:
mkdir -p ~/vaultwarden/vw_data
cd ~/vaultwarden
2. Create the docker-compose.yml (use the content above, customizing the environment variables)
3. Generate a secure admin token:
openssl rand -base64 48
Use this value for the
ADMIN_TOKEN environment variable. For newer versions (1.29.0+), use Argon2 hashing: vaultwarden hash --admin-token your_token_here
4. Start the container:
docker compose up -d
5. Set up a reverse proxy with SSL:
This is mandatory—Bitwarden clients will refuse to connect over HTTP. Caddy is the easiest option:
vault.yourdomain.com {
reverse_proxy localhost:8080
reverse_proxy /notifications/hub localhost:3012
}
With Caddy, SSL certificates are automatically provisioned via Let's Encrypt.
6. Create your account:
Navigate to https://vault.yourdomain.com and create your first account. This will be your admin account.
7. Disable public registration (recommended):
After creating your account, disable public registration to prevent unauthorized users:
- Go to https://vault.yourdomain.com/admin
- Enter your admin token
- Under "General Settings", uncheck "Allow new signups"
- Save settings
8. Configure your Bitwarden clients:
In each Bitwarden client (browser extension, mobile app, desktop app):
- Go to Settings
- Change the server URL to https://vault.yourdomain.com
- Log in with your credentials
Backup Strategy
Since Vaultwarden uses SQLite, backups are trivially simple:
# Backup the data directory
cp -r ~/vaultwarden/vw_data ~/backups/vaultwarden_$(date +%Y%m%d)
Or use SQLite's backup command for a consistent snapshot
sqlite3 ~/vaultwarden/vw_data/db.sqlite3 ".backup ~/backups/vaultwarden_$(date +%Y%m%d).sqlite3"
For automated backups, use a cron job or a Docker-based backup container.
Important Notes
- HTTPS is required: Bitwarden clients use the Web Crypto API, which only works over HTTPS (or localhost). Without a valid SSL certificate, clients will not connect.
- Keep backups: your password vault is only as safe as your backups. If you lose the Vaultwarden data directory, all vault data is lost (though it is also cached on your devices).
- Keep updated: Vaultwarden is actively maintained. Update regularly to get security patches and new features:
docker compose pull && docker compose up -d - Push notifications: For real-time sync across devices, register for a free push relay installation ID at bitwarden.com/host and configure the
PUSH_*environment variables.
5. Comparison with Alternatives
| Feature | Vaultwarden | Official Bitwarden Server | KeePass |
|---|---|---|---|
| Language | Rust | C# (.NET) | C# / C++ |
| Database | SQLite / MySQL / PostgreSQL | SQL Server | File-based (KDBX) |
| Memory Usage | ~30-50MB | ~2-4GB | N/A (desktop) |
| Binary Size | ~20MB single binary | Multiple services | ~20MB |
| Docker Containers | 1 | 8+ | N/A |
| Multi-User | Yes | Yes | No (file sharing only) |
| Browser Extensions | Official Bitwarden | Official Bitwarden | KeePassXC-Browser |
| Mobile Apps | Official Bitwarden | Official Bitwarden | KeePassDX / Strongbox |
| Real-Time Sync | Yes (WebSocket + Push) | Yes (Push) | No (manual sync) |
| Admin Panel | Built-in | Enterprise portal | N/A |
| Setup Complexity | Very low | High | Low (desktop) |
| Premium Features | All free | $10/year (Premium) | N/A |
| Security Audits | Community-reviewed | Professional audits | Professional audits |
| Official Support | No (community) | Yes (Bitwarden, Inc.) | Community |
Official Bitwarden Server is the reference implementation—professionally developed, audited, and supported. If you are an enterprise that needs official support, SSO integration, or advanced enterprise features, the official server is the right choice. But for personal use, families, and small teams, its resource requirements are excessive.
KeePass is a different paradigm entirely: it is a desktop-based password manager that stores passwords in an encrypted file (KDBX format). There is no server—you sync the file yourself (via Dropbox, Syncthing, etc.). While extremely lightweight and secure, KeePass lacks real-time sync, server-side multi-user management, and the polished client experience that Bitwarden provides. It is a good choice for offline-only use cases.
Vaultwarden is the sweet spot for self-hosters: it gives you the full Bitwarden experience—the polished clients, the real-time sync, the multi-user support, the premium features—at a resource cost that is almost negligible. If you have a Raspberry Pi or a $3 VPS, you can run your own enterprise-grade password manager.
6. FAQ
Is Vaultwarden as secure as the official Bitwarden server?
From a cryptographic standpoint, yes. Vaultwarden uses the same encryption scheme as Bitwarden: all encryption and decryption happen client-side, and the server only stores encrypted ciphertext. Your master password is never sent to the server. The server cannot decrypt your data even if it wanted to.
However, there is an important distinction: Vaultwarden is not audited by the same professional security firms that audit the official Bitwarden server. The code is open-source and community-reviewed, and no security vulnerabilities have been found that compromise vault data, but it does not carry the same formal audit certifications. For most users, this is an acceptable tradeoff. For enterprises with strict compliance requirements, the official server is recommended.
Can I migrate from the official Bitwarden server to Vaultwarden (or vice versa)?
Yes. Since Vaultwarden implements the same API, you can export your vault from one and import it into the other. The process is:
1. Export your vault from Bitwarden (Web Vault → Tools → Export Vault)
2. Deploy Vaultwarden
3. Create an account on Vaultwarden
4. Import the vault file (Web Vault → Tools → Import Data)
For organizations, you can export organizational data and re-import it similarly.
How many users can Vaultwarden support?
Vaultwarden can comfortably handle hundreds of users on modest hardware. The SQLite database is efficient for this scale, and the Rust backend is extremely fast. For very large deployments (thousands of users), switching to PostgreSQL or MySQL is recommended, and you may want to consider the official Bitwarden server for its enterprise management features.
In practice, most Vaultwarden deployments serve 1-20 users (individuals and their families, or small teams), and the server barely breaks a sweat.
Does Vaultwarden support Bitwarden Send?
Yes. Vaultwarden fully supports Bitwarden Send—the feature for securely sharing encrypted text or files with anyone, even non-Bitwarden users. You can set expiration dates, access limits, and passwords for each Send. This works identically to the official Bitwarden server.
7. Who Should Use This?
Vaultwarden is ideal for:
- Individuals who want to self-host their password manager without paying for server infrastructure
- Families who want shared password management with individual vaults
- Small teams and startups that need team password sharing on a budget
- Homelab enthusiasts running services on Raspberry Pi, NAS, or low-end VPS
- Privacy-conscious users who want full control over their password data
- Developers who want to integrate password management into their infrastructure
- Vaultwarden is not officially supported by Bitwarden, Inc. If you need professional support, use the official server or Bitwarden's cloud service
- The code is community-reviewed but not professionally audited (though it has a strong security track record)
- Some enterprise features (SSO/SAML, directory connector for enterprise, SCIM) may have limited or incomplete support
- You are responsible for backups, updates, and security hardening
- Push notifications for real-time sync require registering for Bitwarden's free push relay service
Verdict
Vaultwarden is a triumph of efficient engineering. By reimplementing the Bitwarden API in Rust, it delivers the full Bitwarden experience—polished clients, real-time sync, multi-user support, all premium features—on hardware that the official server would not even consider. Its single-binary design, SQLite default, and ~30MB memory footprint make it the most accessible way to self-host a world-class password manager. For homelabbers, small teams, and anyone who values both security and efficiency, Vaultwarden is an easy recommendation. It is, quite simply, one of the most useful self-hosted applications you can run.
GitHub Repository: dani-garcia/vaultwarden
Comments (0)
No comments yet. Be the first to comment!