In January, Bitwarden did something its users had long assumed it never would: it doubled the price of Premium. The plan that cost $10 a year, the price that made Bitwarden the default recommendation in every privacy community on the internet, is now $19.80.[1] A few weeks later, 1Password announced its own increase, a 33 percent jump that takes an individual plan to $47.88 a year.[2]
Neither price is going to bankrupt anyone. But the direction of travel matters more than the numbers. Password managers hold the keys to every account you own, and the companies running them have discovered what every subscription business eventually discovers: once the vault is full, leaving is painful, so prices can drift up forever.
There is a way off that treadmill, and if you’ve been following this site’s self-hosting series, you already have most of what you need. It’s called Vaultwarden, and it lets you run the entire Bitwarden ecosystem, clients included, on a server you control. Every premium feature, no subscription, no company between you and your passwords.
The Problem: Your Crown Jewels Live in Someone Else’s Building
A password manager is not like other software. Your email can be down for an hour and life goes on. Your password vault is the single point of entry to your bank, your email, your medical records, your domain registrar, everything. Whoever runs the server that stores it is, in a very real sense, a custodian of your digital identity.
The industry standard answer is “zero-knowledge encryption,” and it’s a genuinely good answer as far as it goes. Bitwarden, 1Password, and the rest encrypt your vault on your device before it ever leaves; the server only ever holds ciphertext. But the LastPass breach showed where that model’s edges are. In 2022, attackers got into LastPass’s development environment, used what they found to target an employee, and walked out with backups of customer vaults.[3] The encryption held, mostly. But attackers have spent the years since quietly cracking vaults protected by weak master passwords, and by the end of 2024 an estimated $45 million in cryptocurrency had been drained from them, $12.38 million of it in a single December weekend.[4]
Stolen vaults are a prize worth cracking because the incentive is enormous. According to Verizon’s 2025 Data Breach Investigations Report, stolen credentials were involved in 88 percent of attacks against basic web applications.[5] A vault is thousands of credentials in one file.
None of this means cloud password managers are reckless. It means concentration is risk. When thirty million people’s vaults sit in one company’s storage, that storage is a target. When your vault sits on a mini PC under your desk, it is not.
How Vaultwarden Works
Vaultwarden is an unofficial reimplementation of the Bitwarden server, written in Rust, and it’s compatible with every official Bitwarden client: the browser extensions, the desktop apps, the mobile apps.[6] Your devices run Bitwarden’s own polished, audited software. The only thing that changes is where the encrypted data goes. Instead of Bitwarden’s cloud, it syncs to your server.
The key point, and the reason this is safe rather than heroic, is that the cryptography never moves. Encryption and decryption still happen inside the official clients on your devices. Vaultwarden never sees your master password or a single plaintext credential. It stores and serves ciphertext. What you’re repatriating is custody of the encrypted blob, the sync infrastructure, and the bill.
It’s also absurdly light. The official Bitwarden server is a multi-container production stack that wants at least 2GB of RAM and 12GB of disk. Vaultwarden collapses all of that into a single container that idles in the tens of megabytes and uses a plain SQLite database.[7] This is a Raspberry Pi workload. It runs happily on the same machine as your Pi-hole and your Nextcloud, which is exactly where mine lives.
And because the subscription is gone, everything Bitwarden gates behind Premium is simply on: integrated TOTP codes, file attachments, emergency access, vault health reports, and organization sharing for the household. Features that cost $19.80 a year per person, or $47.88 for a family, are configuration options.
What You Need
The shopping list is short:
A Docker-capable machine that stays on. A Raspberry Pi, an old laptop, a NAS, a mini PC, or a cheap VPS. If you already run anything from this site’s previous guides, you’re done with this step.
A way to reach it over HTTPS. This is the one hard requirement, and it’s non-negotiable: Bitwarden’s clients use browser cryptography APIs that only work in a secure context, so your vault must be served over HTTPS.[7] There are two sane ways to do it. The classic route is a domain name you own plus a reverse proxy like Caddy, which handles Let’s Encrypt certificates automatically. The quieter route, and the one I’d recommend to most households, is to skip public exposure entirely: put the server on your Tailscale network, and it’s reachable from your phone and laptop anywhere in the world without ever appearing on the open internet. Fewer doors, fewer knocks.
A static address for the server. Same lesson as the Pi-hole build: a DHCP reservation in your router, so the machine doesn’t wander.
The Build, in Outline
If you’ve installed anything with Docker Compose, this will feel familiar. You create a directory, write a short compose file that pulls the `vaultwarden/server` image, mount a data volume, and bring it up. The first account you register becomes yours, and then you immediately flip the switch that disables open registration, so nobody else can create an account on your server. Point Caddy at it, or join it to Tailscale, and you have a working vault in under an hour.
Two setup details deserve more care than most guides give them:
Set an admin token, and hash it. Vaultwarden has an admin panel for managing users and settings. Protect it with a long, randomly generated token, stored as an Argon2 hash rather than plaintext, exactly as the project’s hardening guide prescribes.[8]
Turn on two-factor authentication for every vault account. Your master password plus TOTP. Vaultwarden supports the standard Bitwarden 2FA options, and there is no reason on earth to skip this on the one system that guards all the others.
The Part That Actually Matters: Backups
Here is the honest trade at the center of self-hosting, and I’d rather state it plainly than sell you a fantasy. When Bitwarden holds your vault, its uptime and its backups are Bitwarden’s problem. When you hold it, they’re yours. If the disk dies and you have no backup, the vault is gone, and no support ticket will save you.
The good news is that backing up Vaultwarden is genuinely easy, because everything lives in one directory: the SQLite database, your attachments, the cryptographic keys. The discipline that works:
Automate it. A nightly job that copies the data directory, encrypted, to at least one other machine. An external drive on the same network is fine. An encrypted sync to a second location is better.
Test the restore. A backup you’ve never restored is a rumor. Once a quarter, unpack it on a spare machine and confirm the vault opens.
Keep the clients’ offline cache in mind. Bitwarden’s apps keep a local encrypted copy of the vault on each device, so a server outage is an inconvenience, not a lockout. Your phone still autofills while you fix the box. That cache is a comfort, but it is not a backup.
Moving Over
Migration is the step people dread, and it’s an evening, not a weekend. Every major password manager can export your vault, and Bitwarden’s clients can import from all of them: LastPass, 1Password, Dashlane, KeePass, your browser, even Bitwarden’s own cloud. Export from the old service, import into your Vaultwarden web vault, and spot-check a dozen entries.
One warning that deserves bold print: the export file is your entire digital life in plaintext. Treat it like radioactive material. Do the export and import in one sitting, on one machine, then securely delete the file and empty the trash. Don’t email it, don’t park it in cloud storage “temporarily,” don’t leave it in Downloads.
Once everything checks out, install the Bitwarden apps on your devices, point each one at your server’s address in its settings, and log in. Then, and only then, cancel the subscription.
The Honest Limits
You are the operations team now. Updates are a `docker compose pull` away and the project ships them regularly, but applying them is on you. If the server dies at 2 AM, it gets fixed when you wake up. The offline caches make this far less scary than it sounds, but if you want a vendor to call when something breaks, that vendor is you.
Vaultwarden is also, by design, unofficial. It’s a clean-room compatible implementation with a strong security track record and 65,000 GitHub stars, but it has no support contract with Bitwarden, and Bitwarden could theoretically change its client behavior in ways the project must catch up with. In practice the community has tracked every change for years, and the clients are open source. It’s a risk to know about, not a reason to stay away.
And if your threat model includes nation-state adversaries, the calculus shifts. A professionally operated service with a security team may genuinely be the safer home for your vault. For the rest of us, the realistic threats are credential stuffing, phishing, and mass breaches of centralized providers, and self-hosting addresses that last one directly.
Wrap-Up: Why This Matters
Every article in this series comes back to the same idea: the most important parts of your digital life shouldn’t depend on a company’s continued goodwill or pricing strategy. Your email, your files, and now your passwords can all live on hardware you own, running software you can inspect, for the cost of electricity.
A password manager is the deepest root of digital identity. When it lives in someone else’s building, you’re a tenant. When it lives in yours, you’re the landlord. Vaultwarden makes that move an evening’s work, and once it’s done, the next price-hike email is someone else’s problem.
Sources
- Bitwarden, “Bitwarden launches enhanced premium plan,” bitwarden.com blog, January 2026. https://bitwarden.com/blog/bitwarden-launches-enhanced-premium-plan
- TidBITS, “Should 1Password’s Price Hike Push You to Apple’s Passwords?” February 25, 2026. https://tidbits.com/2026/02/25/should-1passwords-price-hike-push-you-to-apples-passwords
- LastPass, “Notice of Security Incident,” blog.lastpass.com, December 22, 2022. https://blog.lastpass.com/posts/notice-of-recent-security-incident
- Halborn, “Explained: The LastPass Hack (December 2024 Update).” https://www.halborn.com/blog/post/explained-the-lastpass-hack-december-2024-update
- Verizon, “Credential Theft Prevention and Protection: FAQs” (2025 DBIR). https://www.verizon.com/business/resources/articles/s/frequently-asked-questions-on-credential-theft-prevention-and-protection
- dani-garcia, “Vaultwarden: Unofficial Bitwarden compatible server written in Rust,” GitHub. https://github.com/dani-garcia/vaultwarden
- Contabo, “How to Self-host Bitwarden on a VPS.” https://contabo.com/blog/bitwarden-self-hosting-vps
- Vaultwarden Wiki, “Hardening Guide,” GitHub. https://github.com/dani-garcia/vaultwarden/wiki/Hardening-Guide