← All posts
6 min readDashCaddy Team

Self-Host Vaultwarden in 10 Minutes (Your Own Password Manager)

self-host vaultwardenself hosted password managerbitwarden alternativevaultwarden dockerhomelab security

If you are deciding between Bitwarden and Vaultwarden, you are asking the wrong question. They are not competing products. Bitwarden is the company that runs a cloud service and publishes the open-source client apps. Vaultwarden is a lightweight, unofficial server that speaks the same protocol, so the official Bitwarden apps and browser extensions can talk to it. The real question is simpler: do you want your password database sitting on someone else's server, or on hardware you control? That is the whole decision. Vaultwarden just happens to be the easiest way to answer it.

What Vaultwarden is

Vaultwarden is an unofficial, Bitwarden-compatible password manager server written in Rust. It implements the Bitwarden API closely enough that the official Bitwarden clients work against it unchanged. Because it is built for small deployments rather than millions of accounts, it stays small: one container, a data directory, and very little memory. DashCaddy ships it as a one-click template in the app catalog, which means the container, the reverse proxy, the DNS record, and the certificate are handled for you.

Why this is the best thing to self-host first

If you self-host one service, make it the password manager. Every other service you deploy will need credentials: an admin account, an API key, a database password. If that pile of secrets lives in a consumer cloud vault, you have moved the most valuable data you own to a third party and accepted their uptime, their breach history, and their business model. A self-hosted vault flips that. Your encrypted database stays on your disk, and the only thing crossing the network is ciphertext the server cannot read. The case for self-hosting is strongest here.

What "10 minutes" actually covers

Ten minutes is honest if you have the prerequisites ready. It covers deploying the container, getting a valid TLS certificate, creating your account, and pointing the Bitwarden apps at your server. It does not cover buying a domain, waiting for DNS to propagate, or setting up backups, which is why those are worth doing before you start.

Prerequisites

  • A domain. This is not optional. Bitwarden's browser extensions and mobile apps refuse to talk to a plain http:// origin; they need a real TLS origin. So you need a hostname like vault.example.com that resolves to your server.
  • A server running Linux with Docker, with ports 80 and 443 reachable from the internet.
  • The decision to keep working backups. A password vault on one disk is one disk failure away from losing every credential you own. Decide now where the second copy goes.

Then install DashCaddy on that host:

curl -fsSL https://get.dashcaddy.net | bash

The installation guide covers the details.

Deploy Vaultwarden

From the dashboard:

  1. Sign in and open the App Selector.
  2. Pick Vaultwarden from the Security category.
  3. Accept the suggested subdomain (vault) and port (8088), or change them.
  4. Click Deploy.

DashCaddy pulls the vaultwarden/server:latest image, creates the persistent volume at /opt/vaultwarden/data, writes the Caddy reverse-proxy route, creates the DNS record, and requests the certificate. It waits for the container's health check to pass before it reports the service as Running. When it does, the URL is clickable.

If you would rather script it, the same deploy is one API call with an X-API-Key header:

curl -X POST https://your-dashboard/api/v1/apps/deploy \
  -H "X-API-Key: $DASHCADDY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"appId":"vaultwarden","config":{"subdomain":"vault","port":8088}}'

The response is synchronous and returns success, containerId, url, message, and setupInstructions. There is no polling step.

Make sure it is on HTTPS

If the DNS record resolved and ports 80/443 were reachable, the certificate was issued during deploy and you are already done. If DashCaddy fell back to direct-IP access or a self-signed certificate, the usual cause is DNS not pointing at the host yet, or a firewall blocking the certificate challenge. The troubleshooting guide walks through it layer by layer. Verify the certificate is trusted before you create your account, because the apps will refuse a bad origin anyway.

Create your account, then close the door

The default Vaultwarden template ships a DOMAIN and an ADMIN_TOKEN, and the first thing to do is change the admin token. Then create your own account, and once it exists, disable further signups so nobody else can register on your instance. This is the single most common mistake with a fresh Vaultwarden: leaving public registration open on a server that is now findable. The Vaultwarden install guide lists this in its post-install checklist.

Connect the real Bitwarden apps

You do not need any Vaultwarden-specific client. Install the official Bitwarden browser extension, desktop app, or iOS/Android app, and before logging in, open the settings and set the self-hosted environment server URL to your own https://vault.example.com. Log in with the account you just created. Your vault now syncs to your hardware. If you want to reach it from outside your home network safely, read accessing self-hosted apps remotely.

Backups are not optional here

An encrypted vault on one disk is a single point of failure for every account you own. Export your vault periodically from the client, and back up the volume, which DashCaddy keeps at /opt/vaultwarden/data. Store the copy somewhere that is not the same machine. If you have not thought about this before, the catalog guide covers how backups fit into a self-hosted stack.

Honest caveats

  • You are now the operator. Uptime, upgrades, and backups are your job. DashCaddy manages the container lifecycle and the certificate, but it will not fix a broken restore for you.
  • Vaultwarden is not the official Bitwarden server. It is a compatible reimplementation, and it can occasionally lag new Bitwarden client features. For most personal and family use this does not matter; for an enterprise with compliance requirements, it might.
  • Real secrets deserve real protection. Turn on two-factor authentication on your account, use a strong master password you have not reused anywhere, and keep the admin token private.

If self-hosting is new to you, start with what DashCaddy is and getting started, then come back. The software itself is free; what you pay for, if anything, is DashCaddy's premium features, which are described on the pricing page.

FAQ

Is Vaultwarden the same as Bitwarden?

No. Bitwarden is the official product and cloud service. Vaultwarden is an unofficial, Bitwarden-compatible server you run yourself. The official Bitwarden client apps connect to it because it implements the same API.

Does the official Bitwarden app work with my own server?

Yes. In the app's settings, before you log in, select the self-hosted environment option and enter your own server URL. Everything else works the way it does against Bitwarden's cloud.

What happens if my server goes down?

Your vault stops syncing, but the copies already downloaded to your phone, browser, and desktop remain readable offline. That is exactly why you keep a second backup copy somewhere else.

You can run every one of these steps from one dashboard. Browse the catalog to see what else deploys the same way, or add Uptime Kuma to get alerted if the vault ever goes offline.