Host your own password manager with Vaultwarden

A password manager is an encrypted file that holds all your logins behind one master password. The KeePass lesson on this track builds the simplest kind: one database file that lives on one computer and never touches the internet. That is brilliant when all your passwords need to be in one place. It gets awkward the moment you want the same passwords on your laptop, your phone and your work machine, because now you are copying a file around by hand.

A sync server solves that. It is a small program that keeps one copy of your vault and lets each of your devices connect to it, pull down the latest version and push up any changes. Bitwarden is the best known password manager built this way, and it offers a paid cloud where their servers hold that copy. Self-hosted means you run the server yourself instead, on a computer you own, so the copy lives on your hardware and no outside company holds it.

Vaultwarden is what we run here. It is an independent, open-source server that speaks the exact same language as Bitwarden's official server, so the real Bitwarden apps and browser extensions work against it unchanged. The reason to use it rather than Bitwarden's own server software is weight: Bitwarden's official self-hosted stack is several containers and a chunky install, while Vaultwarden is a single small container that happily runs on a spare PC or a cheap server. It is not made by Bitwarden and is not affiliated with them; it is a separate project that is compatible with their clients.

The piece that makes self-hosting safe to even consider is zero-knowledge, end-to-end encryption. Everything in your vault is locked and unlocked by the Bitwarden app on your device, using a key derived from your master password. Your passwords are encrypted before they ever leave your device, so the server only ever receives and stores scrambled data. It cannot read your passwords, and neither can anyone who gets hold of the server. You will prove this to yourself in step 4 by looking in the server's own database and finding only ciphertext. Your master password is never sent to the server either, which is also why nobody, including you, can recover the vault if you forget it.

Now the trade-off, because self-hosting is a real responsibility, not a free lunch:

• What you gain: you own the data. No third-party cloud holds your vault, there is no account with a company that can be breached, change terms, or lock you out, and you decide where the one copy lives.
• What you take on: you are now the operator. If the server's disk dies and you have no backup, your vault is gone, so backups are on you (step 6). You have to keep the server updated yourself. And if you want to reach it from outside your home, you have to expose it safely, which means putting it behind HTTPS and never opening the raw server to the internet (step 6 again).
• When KeePass is the better answer: if your passwords only need to be on one machine, or you are happy moving an encrypted file yourself, a single offline database is simpler and has none of these responsibilities. Hosting a server earns its keep when you genuinely want several devices syncing automatically.

One more thing to be clear about up front, because it matters in step 3: the account you create here is a local account on software you run. It is not signing up to a third-party service. You are creating a login on a server sitting on your own machine, the same way you would set a password on a local database. That is entirely yours to do.