Setup guide, 2026

Self-hosted password manager. Your vault, on your server.

Your passwords are the keys to everything else. Here’s how to keep them on a server you control, set up right the first time.

10 min read
5 chapters
Updated 3 November 2026

Your Windows PC

id_ed25519Private key. Never leaves this PC.

id_ed25519.pubPublic key. Safe to share.

Your server

~/.ssh/authorized_keysOne line per key it trusts.

The short answer

The easiest way to self-host a password manager is Vaultwarden, a lightweight server that works with the official Bitwarden apps and browser extensions. Run it in Docker behind HTTPS on a small VPS, close sign-ups once your accounts exist, and back up its data folder every day.

A LiteKeep Lite 2 ($4 a month) runs it with room to spare. The generator below writes your setup files for your domain.

Most guides to self-hosting a password manager stop once the login page loads. The parts that protect you come after: HTTPS, closing sign-ups, and backups you’ve tested.

This guide does the whole job: which manager to pick, a generator that writes your Docker and HTTPS files, the settings to change on day one, and how to back up and restore.

In this guide you’ll learn

Which manager to self-host: Vaultwarden, Bitwarden or KeePassXC
A setup generator: your compose file, HTTPS and backups
Lock it down: sign-ups, admin page, two-factor
Back up and restore, tested

Chapter 1

Which password manager to self-host

Three good options, for different people.

Self-hosted password managers
	Vaultwarden	Bitwarden (official)	KeePassXC
What it is	An unofficial, lightweight server compatible with Bitwarden apps	Bitwarden’s own server	A desktop app with an encrypted file, no server
Apps	The official Bitwarden apps and extensions	The same apps	Its own apps; sync the file yourself
Needs	Docker, HTTPS; no published RAM figure	Lite edition: 200 MB RAM; standard: 2 GB minimum, 4 GB recommended	No server
Licence	Open source (AGPL-3.0)	Free to self-host with an installation key from Bitwarden	Open source
LiteKeep plan	Lite 2	Lite 6	A Vault for synced copies

Our pick: Vaultwarden. It runs the apps you know, for a family or a small team, on the smallest server. Bitwarden’s standard edition asks for 4 GB, so give it a Lite 6.

Chapter 2

Generate your Vaultwarden setup

Deploy a Lite with the one-click Docker app, point a domain at it, then paste these files. Caddy fetches the HTTPS certificate by itself, and only Caddy is reachable from the internet.

Your password vaultDomain for the vault My accounts are created: close sign-ups

Point the domain’s A record at your server first. Nothing you type leaves this page.

Your files (example domain until you enter yours)

~/vaultwarden/docker-compose.yml

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data:/data
  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-data:/data

~/vaultwarden/Caddyfile

vault.example.com {
  reverse_proxy vaultwarden:80
}

Then run docker compose up -d in that folder and open https://vault.example.com. Create your accounts, then tick the box above and run it again.

Daily backup (copy the folder off the server too):

sudo apt install -y sqlite3
mkdir -p ~/vw-backup
sqlite3 ~/vaultwarden/vw-data/db.sqlite3 ".backup '$HOME/vw-backup/db-$(date +%F).sqlite3'"
tar czf ~/vw-backup/files-$(date +%F).tar.gz -C ~/vaultwarden/vw-data attachments rsa_key.pem

Deploy a Lite 2

Chapter 3

Lock it down on day one

A password vault on the internet should accept nobody it doesn’t know.

Close sign-upsHow to check: Once your accounts exist, set SIGNUPS_ALLOWED to false (the box in the generator) and restart. Invite anyone else from the admin page.
Protect the admin pageHow to check: Leave it off, or set an admin token hashed with vaultwarden hash, never a plain password.
Turn on two-factorHow to check: Every account, in its own settings. An authenticator app is enough.
Keep it updatedHow to check: docker compose pull && docker compose up -d every week or two. Our automatic updates tutorial covers the system.

Chapter 4

Back up your vault, and test the restore

If the server goes, your passwords mustn’t. Vaultwarden’s own wiki names what to keep.

The database, db.sqlite3, copied with SQLite’s .backup command so a write in progress can’t corrupt it.
The attachments folder, if you store files in the vault.
The rsa_key files, which sign your logins.

The generator gives you the commands. Run them daily from cron, and copy the backup folder somewhere else. Add our daily server backups too, at $0.0072 per GB of disk a month: on a Lite 2 that’s under 30 cents.

MythThe apps keep a copy, so I don’t need backups.

Fact

The apps cache your vault, but a new phone or a wiped laptop needs the server. Keep server backups, plus an encrypted export now and then.

MythA backup I’ve never restored is a backup.

Fact

Restore it once onto a test server. With hourly billing that costs a few cents and proves the backup works.

Chapter 5

Why self-host your password manager

Hosted password managers are good. Self-hosting is for people who want the keys themselves.

Your vault on your server, in the country you choose, encrypted with your master password.
No per-user fees: add your family or team for the price of the server.
Paid privately: in crypto, with an email address and no ID.

Now it’s your move

A self-hosted password manager is a small server with a big job. Vaultwarden on a Lite 2, behind HTTPS, with sign-ups closed and daily backups, does it well.

Deploy a Lite 2 with Docker, paste the generated files, and move your passwords in. More ideas for the same server: the best self-hosted apps.