Bitwarden vs Vaultwarden: A 2026 Comparison for Self-Hosters

Last verified: September 19, 2026. Prices, versions, and features change, so the primary sources are linked at the end.

Password managers stopped being optional a long time ago. Most of us juggle more accounts than anyone can memorize, and reusing passwords is an open invitation to credential stuffing. The question now is which password manager to trust, and where it should live.

Bitwarden is one of the most popular open-source password managers. It comes as a cloud service and as a server you can host yourself. Vaultwarden is an unofficial, community-built reimplementation of Bitwarden's server API, written in Rust and designed for self-hosters who want a lighter footprint.

Both keep logins, notes, cards, and identities in an encrypted vault, and both work with the same official Bitwarden browser extensions, desktop apps, and mobile apps. The differences are who maintains the server, what it costs to run, which features you pay for, and how much of the security work lands on you.

This post lays out the facts, checked against Bitwarden's documentation and the Vaultwarden wiki, so you can decide which path fits your situation.

The short version

• Homelab, family, or small team, and you're comfortable running your own server: Vaultwarden gives you premium-tier features for free and runs on very little hardware.
• Compliance requirements, enterprise features, or a need for vendor support: Bitwarden, in the cloud or self-hosted.
• No interest in running servers at all: Bitwarden Cloud.

The rest of the post explains why, and where the details get more nuanced than that summary.

What Is Bitwarden?

Bitwarden is an open-source password manager built by Bitwarden, Inc., based in Santa Barbara, California. The company was founded in 2015 and raised a $100 million funding round in 2022. It publishes third-party security audits, holds SOC 2 Type 2, SOC 3, and ISO 27001 credentials, and states compliance with HIPAA, GDPR, and CCPA.

Bitwarden comes in three flavors:

• Bitwarden Cloud at bitwarden.com. The free tier includes unlimited passwords on unlimited devices. Premium is $19.80 per year, and Families (up to six users) is $47.88 per year.
• Bitwarden Standard (self-hosted). The full server stack, installed with the bitwarden.sh script and run as a set of Docker containers, with Microsoft SQL Server Express as the default database.
• Bitwarden Lite (self-hosted). A single-container deployment that supports SQLite, MySQL/MariaDB, PostgreSQL, and MSSQL, and runs on ARM boards like the Raspberry Pi. It started life as "Unified" in beta and was renamed Lite when it left beta in December 2025. Bitwarden documents it for personal use and home labs, not for business use.

Two things about self-hosting Bitwarden surprise people:

1. Self-hosting is free, but paid features still need a license. TOTP codes, file attachments, emergency access, and similar features are unlocked with a license file you download from a paid cloud account (Premium, Families, or Enterprise).
2. You register the server. Both Standard and Lite ask for an installation ID and key, which you generate at bitwarden.com/host.

A note on pricing: Bitwarden raised Premium from $10 to $19.80 per year and Families from $40 to $47.88 per year in early 2026. Teams is $4 per user per month and Enterprise is $6 per user per month, all billed annually.

All Bitwarden deployments share the same client-side encryption model, covered in the security section below.

What Is Vaultwarden?

Vaultwarden (formerly bitwarden_rs) is an alternative implementation of the Bitwarden client API, written in Rust by community developer dani-garcia and a group of contributors. It is released under the AGPL-3.0 license and has roughly 67,000 stars on GitHub.

It is not affiliated with Bitwarden, Inc. The README says so explicitly and asks you to report bugs to Vaultwarden's own issue tracker, not to Bitwarden support. The README also notes that one active maintainer is employed by Bitwarden and contributes on their own time. Those contributions are independent of the company and reviewed by the other maintainers.

The key facts:

• It's a reimplementation, not a fork. The server is its own Rust codebase, paired with builds of Bitwarden's open-source web vault.
• It uses the official Bitwarden clients. Browser extensions, desktop apps, mobile apps, and the CLI all connect to it as they would to a Bitwarden server.
• It stores data in SQLite by default. MySQL/MariaDB and PostgreSQL are also supported.
• It includes features Bitwarden puts behind Premium. TOTP authenticator codes, file attachments, emergency access, Send, and organizations are all available without a license.
• It targets individuals, families, and small organizations. The wiki says features mainly useful to large organizations, such as SSO and directory syncing, are not a priority, though some have been added (details in the feature comparison).
• Support is community-driven. There's a forum, a Matrix room, and the GitHub issue tracker. There is no vendor SLA and no commercial support.

Deployment and Infrastructure

This is where the two diverge most visibly. The numbers below for Bitwarden are the documented requirements for Linux. Vaultwarden doesn't publish official minimums.

Security and Trust

This is the most important section for anyone storing passwords, and the one where a lazy summary does the most damage.

Encryption

Bitwarden and Vaultwarden use the same client-side encryption. Vault items are encrypted with AES-256-CBC and authenticated with HMAC-SHA256. The keys come from your master password through PBKDF2-SHA256 (600,000 iterations by default) or Argon2id, which you can switch to in your account's encryption settings. The server, whether it's Bitwarden's cloud, your own Bitwarden install, or your Vaultwarden instance, only stores and returns encrypted data.

That means the server implementation matters less for data confidentiality than you might expect. It still matters for availability and for trust in the software delivered to you: the server hosts the web vault, so whoever runs it is responsible for serving unmodified code. In a self-hosted setup, that's you.

Where They Diverge

Bitwarden:

• Annual third-party security audits, with results published
• SOC 2 Type 2 and SOC 3 reports, ISO 27001 certification, and stated HIPAA, GDPR, and CCPA compliance
• A dedicated security team and a bug bounty program
• Commercial support on paid plans

Vaultwarden:

• Has been audited, but not on a vendor-style schedule (details below)
• No compliance certifications and no vendor SLA
• A smaller codebase and a single binary, which means fewer moving parts
• You own the entire security posture: TLS, firewall, updates, backups, and monitoring

Vaultwarden Has Been Audited, With Caveats

It's common to read that Vaultwarden has never had a security audit. That's out of date. The wiki lists two independent reviews:

• BSI (German Federal Office for Information Security). Under its open-source code analysis project (CAOS 3.0), BSI and mgm security partners reviewed Vaultwarden 1.30.3 with source review and dynamic testing, and published the results in October 2024. They found two high-severity issues, and the most serious findings were fixed in release 1.32.0. The report also noted that Vaultwarden had no offboarding process for organization members, so a departing member kept the organization's keys.
• ERNW penetration test. ERNW assessed Vaultwarden in October 2024 as part of a customer engagement, with a partial source review. They found three vulnerabilities, including an authentication bypass, and disclosed them responsibly to the project.

The fair reading: outside reviewers have looked at Vaultwarden, found real problems, and the maintainers fixed them. But these are point-in-time reviews of older versions, not an annual audit program, and there's no SOC 2 report to hand to a compliance officer. For some organizations that distinction settles the question. For individuals and small teams, it's a judgment call.

Rust deserves a fair mention. Its memory safety rules out whole classes of bugs. It doesn't prevent logic and authorization mistakes, though, and an authentication bypass is exactly that kind of bug.

Patching Is Part of the Deal

Recent Vaultwarden releases show what "you own the update cycle" means in practice. Release 1.37.0 shipped fixes for security advisories, including a server-side request forgery issue in the icon endpoint. Its release notes, and those of 1.37.2, also say that specific server versions are required to support newer Bitwarden clients.

In other words, updating Vaultwarden isn't only about security fixes. Newer clients can stop working properly against an older server.

When to Choose Which

Choose Vaultwarden When

• You run a homelab or a small VPS and want a password manager that uses minimal resources.
• You're a family or small team that wants shared vaults, TOTP codes, and emergency access without paying for premium plans.
• You want full data control. Your vault never touches Bitwarden's servers.
• You're comfortable with self-hosting. You can manage containers, reverse proxies, TLS certificates, updates, and backups.
• You want premium features without a license.

Choose Bitwarden Standard or Lite When

• You need enterprise features like SCIM provisioning or SAML SSO with your identity provider.
• You need compliance attestations. If your organization requires a SOC 2 Type 2 report from a vendor, Bitwarden provides it.
• You want vendor support. When something breaks at 2 AM, a support contract matters.
• You want an officially supported upgrade path.
• Bitwarden Lite fits your personal use case and you're comfortable with the license-file model for paid features.

Choose Bitwarden Cloud When

• You don't want to manage infrastructure. No servers, no backups, no TLS, no updates.
• You need the vault reachable from anywhere without setting up VPNs or tunnels.
• $19.80 per year for premium features is acceptable and you'd rather not self-host.
• You're setting it up for non-technical family members who won't troubleshoot anything.

Conclusion

Bitwarden and Vaultwarden aren't competing products so much as two answers to the same problem.

Bitwarden is a commercial product with a polished ecosystem, enterprise features, compliance certifications, and vendor support. Premium features cost money, and the standard self-hosted deployment is resource heavy. The Lite option, introduced in late 2025, made personal self-hosting far more practical.

Vaultwarden is a community-built, lightweight server that speaks the same API and runs on a fraction of the resources. It gives you premium features for free and works with the official Bitwarden clients. The trade-offs: you own the security posture entirely, there's no vendor SLA or compliance paperwork, and enterprise features like SCIM aren't there. It has been audited by outside reviewers, but not on a vendor-style schedule.

Neither is universally better. The right choice depends on what you're building, how much you want to manage, and which features matter to you.

• If you want to self-host on minimal hardware with premium features at no license cost, choose Vaultwarden.
• If you need enterprise features, compliance attestations, and vendor support, choose Bitwarden.
• If you want neither servers nor maintenance, choose Bitwarden Cloud.

All three protect your vault with the same client-side encryption. What changes is who keeps the server patched, backed up, and reachable, and how much of that work you're willing to take on.

Sources

• Bitwarden pricing
• Bitwarden Lite deployment docs
• Bitwarden Linux standard deployment docs
• Bitwarden self-host licensing
• Bitwarden compliance, audits, and certifications
• Bitwarden encryption key derivation
• Bitwarden server license FAQ
• Vaultwarden wiki (features)
• Vaultwarden audits
• BSI press release on the KeePass and Vaultwarden code analysis (German)
• Vaultwarden 1.35.0 release notes (OIDC SSO)
• Vaultwarden Docker Compose guide
• Vaultwarden backup guide

Last updated: September 19, 2026