What you need before you touch the terminal
If you want to self host Vaultwarden on a VPS, here is the honest short version: rent an Ubuntu VPS with full root access, install Docker, run the vaultwarden/server image behind a reverse proxy with HTTPS, disable public signups, and back up the data folder on a schedule. Done carefully, the whole thing takes under an hour, not counting DNS propagation. This guide walks through every step on a Hostinger VPS, with commands and config verified (checked 13 Oct 2026).
Three things must be in place before you run anything:
- A VPS with full root access. Vaultwarden is written in Rust and is genuinely light: even an entry-level plan like KVM 1 handles it with room to spare, since you are serving a handful of users, not a busy web app. Pick a data centre near you from the real VPS list: France, Germany, Lithuania, UK, India, Indonesia, Malaysia, USA (Phoenix, Boston), or Brazil. A closer data centre means snappier autofill sync, especially on mobile data.
- A domain or subdomain with an A record pointed at your VPS IP, for example vault.yourdomain.com. Bitwarden clients expect HTTPS, so a real domain is non-negotiable.
- Basic comfort with SSH and a terminal text editor like nano. If you have never used a command line, stop here and use Bitwarden’s official cloud instead; the last section explains why.
Optional but recommended: an SMTP mailbox for invitations and two-factor emails. Any provider you already use will do.
Installing Docker on Ubuntu
Every command in this guide was verified on Ubuntu (checked 13 Oct 2026). Connect over SSH and start with a fresh, updated system:
- Update the system: sudo apt update && sudo apt upgrade -y
- Install Docker with the official install script: curl -fsSL https://get.docker.com | sudo sh
- Verify the install: run sudo docker run hello-world, then confirm the Compose plugin with docker compose version
- Stay as root or add your user to the docker group with sudo usermod -aG docker $USER, then log out and back in. On a single-purpose VPS, running Compose as root is the common setup.
If Docker is already installed through your VPS template, skip straight to the next section. A Hostinger VPS gives you full root, so nothing here needs a control panel.
Deploying Vaultwarden with Docker Compose
Vaultwarden stores everything under a single /data directory inside the container, so persistence is just one volume mount. Create a working folder first:
- sudo mkdir -p /opt/vaultwarden && cd /opt/vaultwarden
- Generate a strong admin token now: openssl rand -base64 48 (save the output somewhere safe; you will paste it into the compose file)
Create docker-compose.yml with these values, replacing the placeholders with your own:
- image: vaultwarden/server:latest
- container_name: vaultwarden
- restart: unless-stopped
- environment DOMAIN=https://vault.yourdomain.com
- environment SIGNUPS_ALLOWED=false (set it to true only for the minutes you create your account, then flip it back)
- environment ADMIN_TOKEN=paste-your-openssl-output-here
- environment WEBSOCKET_ENABLED=true (keeps live sync working across devices)
- volumes: ./vw-data/:/data/
- ports: 127.0.0.1:8080:80 (bound to localhost only, so the reverse proxy is the only public entry point)
Then launch it with docker compose up -d, and watch the startup with docker compose logs -f vaultwarden until you see it listening, then exit with Ctrl+C. At this point Vaultwarden answers on port 8080 locally, which is exactly what you want before adding HTTPS. If you later outgrow the entry plan, KVM 2 gives you more headroom for extra services on the same box.
Securing your self host vaultwarden server
HTTPS is not optional. Put Nginx or Caddy in front of the container, proxy to 127.0.0.1:8080, and get a free certificate with Certbot. Older guides mapped a second port (3012) for websocket notifications; current vaultwarden/server images handle live sync on the main port, so one proxy rule is enough (checked 13 Oct 2026).
Lock down the instance itself:
- ADMIN_TOKEN protects the /admin panel. Without it, anyone who finds your domain can open the admin page.
- SIGNUPS_ALLOWED=false after your account exists, so strangers cannot register on your password server.
- INVITATIONS_ALLOWED=true if you share with family; you invite specific emails instead of opening registration.
- Firewall: sudo ufw allow 22,80,443/tcp, then sudo ufw enable.
- DOMAIN must be the exact https URL, or email links and some client features break.
Create your account at https://vault.yourdomain.com, then flip SIGNUPS_ALLOWED back to false and run docker compose up -d.
Backups: the part most guides gloss over
Self-hosting a password manager means you own the consequences of data loss. The ./vw-data/ folder holds everything: db.sqlite3 (your encrypted vault), attachments/, sends/, config.json, and the rsa_key pair. Lose it without a backup and your passwords are gone.
A backup routine that actually works:
- Daily archive: docker compose down, then tar -czf /root/backups/vaultwarden-$(date +%F).tar.gz vw-data/, then docker compose up -d. A stopped container guarantees a consistent SQLite copy.
- Copy it off the VPS. A backup on the same disk as the server is not a backup; pull it home with scp or sync it to separate storage.
- Automate it with a cron job so it happens even when you forget.
- Test a restore on a spare folder at least once. An untested backup is a hope, not a plan.
This is the single biggest difference from Bitwarden cloud: nobody is snapshotting your data but you.
Updating Vaultwarden without breaking anything
Updates are simple, but never skip the backup step first:
- docker compose pull vaultwarden (fetches the new image)
- docker compose up -d vaultwarden (recreates the container on the new image)
- Check the web vault loads and you can log in before calling it done.
Skim the release notes on the project's GitHub page before major version jumps; breaking changes are rare but they do happen. Resist auto-updating a password server with Watchtower-style automation: a manual update after a fresh backup takes two minutes and keeps you in control.
Who this is for, who should skip it, and the renewal reality
This is for you if you are comfortable in a terminal, you want full control of your password data, and you will actually maintain backups and updates. Families and small teams get organisation features free that cost money on hosted plans.
Skip it if you are not technical, you will not babysit backups, or downtime would lock you out of your life. Bitwarden's official cloud is the honest better option: free for individuals, maintained by a real team, with support when something breaks. A password vault you do not maintain is less safe than the cloud, not more.
Renewal reality: VPS plans are sold with low intro prices that renew higher, so check what renewals actually cost before picking a term length. A coupon can cut the first invoice, but the renewal price is the real price of the project.
| Factor | Vaultwarden on a Hostinger VPS | Bitwarden cloud | KeePassXC (local file) |
|---|---|---|---|
| Cost model | VPS plan plus your time; renewals rise after the intro term | Free tier for individuals; paid plans add features | Free; you sync the file yourself |
| Setup effort | About an hour with Docker and a domain | Minutes; sign up and go | Minutes; no server at all |
| Client apps | Official Bitwarden apps pointed at your server URL | Official apps out of the box | KeePassXC apps and ports |
| Family or team sharing | Organisations free; you manage the invites | Paid family and organisation plans | Manual file sharing; no real multi-user sync |
| Backups and uptime | Entirely your job | Handled by Bitwarden | Your job; the file lives where you put it |
| Data control | Your server, your data, your country choice | Bitwarden's infrastructure | No server; nothing leaves your devices |
VPS KVM 2
24-month plan, paid upfront
Renews at $14.99/mo
- 2 vCPU + 8 GB RAM
- 100 GB NVMe storage
- 8 TB bandwidth
- Full root access
- n8n one-click template available
FAQ
Very little. Vaultwarden is a single lightweight Rust binary that runs comfortably on an entry-level VPS with one vCPU and a few gigabytes of RAM, even with several users syncing. The official Bitwarden server needs far more resources, which is exactly why Vaultwarden exists (checked 13 Oct 2026).
Yes, effectively. Bitwarden's mobile and desktop apps expect HTTPS, and you cannot get a trusted certificate for a bare IP address. Point an A record like vault.yourdomain.com at your VPS, then use a free Let's Encrypt certificate via Certbot or Caddy's automatic HTTPS.
All of the official ones: the web vault built into Vaultwarden, browser extensions, desktop apps, mobile apps, and the CLI. In each client you switch the region setting to self-hosted and enter your https URL, then log in with the account you created.
Visit https://vault.yourdomain.com/admin and enter the ADMIN_TOKEN from your compose file. The panel manages users, invitations, and server settings. If you never set ADMIN_TOKEN, the panel is disabled. Generate the token with openssl rand -base64 48 and store it outside the server.
The whole ./vw-data/ directory: db.sqlite3 holds your encrypted vault, plus attachments/, sends/, config.json, and the rsa_key files. Stop the container first so SQLite is consistent, archive the folder with tar, and copy the archive off the VPS. Automate this daily.
Yes. Export your vault from the Bitwarden web vault as JSON (an unencrypted export, so use a trusted machine and delete the file afterwards), then import it into Vaultwarden from the web vault's Tools menu. Verify everything synced, then close or downgrade the cloud account.