Vaultwarden

★ 65.3k · AGPL-3.0 · ACTIVE · ALT TO 1PASSWORD

Vaultwarden is an open source alternative to 1Password and LastPass. Bitwarden-compatible self-hosted password server for individuals, families, and small organizations. AGPL-3.0 licensed, 65.3k GitHub stars, self-host with Docker, and last released 2026-07-29.

Alternative toAll alternatives to 1Password All alternatives to LastPass

How to start today

Should you switch?

Use it if

People who want a self-hosted password manager that works with official Bitwarden clients without running the official Bitwarden server.

Skip it if

You need an officially supported Bitwarden deployment or enterprise assurances from the Bitwarden company itself.

Watch out

Vaultwarden is unofficial and not covered by Bitwarden's own security audits. CVE-2025-24364 (RCE, CVSS 7.2) and CVE-2025-24365 (privilege escalation, CVSS 8.1) affected all versions up to 1.32.7 and were patched in 1.33.0 (Jan 2025). Current release 1.37.1 is fully patched. The admin panel remains a high-value target: restrict access, set a strong ADMIN_TOKEN, and run behind a reverse proxy with TLS. Independent audits by BSI (Oct 2024) and ERNW (Oct 2024) found and disclosed vulnerabilities responsibly.

Independent auditBSI (Bundesamt fur Sicherheit in der Informationstechnik) and ERNW Enno Rey Netzwerke GmbH, 2024 report

Support the creator

Support this project directly once our USDC payment option launches.

Coming soon

USDC is a trademark of Circle. Button indicates a payment option.

Community proof

Some quotes here endorse the approach rather than report first-hand use, or report a problem. We label those.

"I'm running Vaultwarden because while on the one hand I'd like to just pay a company to make my password problem go away, I don't know who I can actually trust to not try to take advantage of the fact they have all the keys to all my kingdoms at some point."
jerf · hacker_news · 2026-05-18

"If you're going to the trouble of self-hosting, I'd suggest just running vaultwarden. It's entirely compatible with the clients. It also removes a lot of "rug-pull" potential"
horsawlarway · hacker_news · 2026-05-21Directional, not usage proof

Maintenance health

CadenceActive

Last release1.37.1 · 2026-07-29

Can you do it today?

Get started

1. Run with Docker

docker pull vaultwarden/server:latest && docker run --detach --name vaultwarden --restart unless-stopped -v $(pwd)/vw-data:/data -p 80:80 vaultwarden/server:latest

GitHub