Self-Hosted Password Managers: Vaultwarden, Bitwarden, Passbolt

Choose by who will use the vault and how much you want to run. For a family or home lab that wants Bitwarden's apps with premium features at no cost, start with Vaultwarden, an unofficial Bitwarden-compatible server, and plan to upgrade it promptly when Bitwarden's apps change. For a business that needs SSO, SCIM, and vendor audits, run Bitwarden's official server with an Enterprise license, or Passbolt Pro. Passbolt's free Community Edition suits teams that share passwords through groups and roles and can do without SSO. AliasVault fits individuals who want email aliases built in, and Passman fits people already running Nextcloud. If you would rather run no server at all, look at KeePassXC, bramble, or Kure.

Facts below were checked on October 29, 2026, against each project's repository and, where they exist, its license files, documentation, and pricing page, which are linked where we use them and listed under Sources. About PickOpenSource explains how we write guides.

Server, peer-to-peer sync, or a local file

Self-hosted password managers fall into three groups, and the group decides how much you have to operate: a server you run, peer-to-peer sync with no server, or a local file. This guide covers the password managers in our security category, plus KeePassXC, which is not in our catalog.

• Self-hosted servers: Vaultwarden, Bitwarden, Passbolt, AliasVault, and Passman run on a server you operate, and every device syncs through it. Passman runs inside Nextcloud.
• Sync without a server: bramble keeps the vault on your devices and syncs them peer-to-peer through end-to-end-encrypted relays.
• Local files: KeePassXC keeps an offline KDBX file that you store wherever you like, and Kure is an offline command-line tool with a single portable database file.

If you are replacing 1Password specifically, the 1Password alternatives page lists more options.

The self-hosted password managers compared

What the free self-hosted version includes

Included means the project's own README or documentation lists the feature for the free self-hosted version. Paid license means it exists but needs a paid plan or license file. Not found means we did not find it in the project's own sources. Not implemented means the project says it does not have the feature yet. bramble, Kure, and KeePassXC are left out because they have no server or team features.

Vaultwarden

Vaultwarden's README describes it as an unofficial Bitwarden-compatible server, written in Rust for self-hosters who find the official server too resource-heavy. It works with Bitwarden's official apps and browser extensions. You can run the vaultwarden/server container image from Docker Hub, ghcr.io, or quay.io, use a community package, or build from source. SQLite is the default database, and the wiki covers MariaDB, MySQL, and PostgreSQL.

According to the wiki, these features run without any license: organizations, collections, groups (turned on through an environment variable), event logs (off until you enable them), the TOTP authenticator, attachments, Send, emergency access, and Directory Connector. Account recovery works once mail is set up, and SSO works through OpenID Connect. If you still need an identity provider to connect, our Keycloak vs Authentik guide compares two.

The latest release is 1.37.4, from October 5, 2026. It fixed seven security advisories, the most serious rated High and involving the revocation of organization members.

Bitwarden

Bitwarden's official server is written in C# on .NET and ASP.NET Core. Its license FAQ explains the split: code outside the bitwarden_license directory is AGPL-3.0, while that directory, which holds commercial features including the SSO integration, is source-available under the Bitwarden License and needs a paid subscription in production. An OSS build flag leaves it out.

There are two ways to install it. The standard install needs Docker Engine 26 or later and at least a 1.4 GHz x64 processor, 2 GB of RAM, and 12 GB of storage; Bitwarden recommends a 2 GHz dual core, 4 GB of RAM, and 25 GB. Its default database is MSSQL Express, which is capped at 10 GB, and you need an installation ID and key from bitwarden.com/host. Bitwarden Lite, formerly Bitwarden Unified and out of beta since December 2025, is a single ghcr.io/bitwarden/lite image that needs at least 200 MB of RAM and 1 GB of storage. You bring the database: MySQL, MariaDB, MSSQL, SQLite, or PostgreSQL. Events, SCIM, and SSO are off by default, and Bitwarden says Lite is meant for personal and home-lab use, not business.

Self-hosting is free, but paid features need a license file uploaded to your server, and only Families and Enterprise organizations can be self-hosted. As listed on October 29, 2026, in US dollars billed annually, Premium is $1.65 a month ($19.80 a year) and adds the TOTP authenticator, 5 GB of attachments, emergency access, and vault health reports. Families is $3.99 a month ($47.88 a year) for up to 6 users. On the business pricing page, Teams is $4 per user per month with directory sync, SCIM, and event logs, and Enterprise is $6 per user per month and adds SSO, enterprise policies, and self-hosting. That page lists self-hosting under Enterprise only. The latest server release is 2026.10.1, from October 28, 2026.

Passbolt

Passbolt is a team password manager written in PHP on CakePHP and licensed AGPL-3.0. The install docs cover a passbolt/passbolt Docker image, Helm, Ansible, and packages for Debian 13, Ubuntu 26.04, RHEL, Alma, and Rocky 9, and SUSE 16, plus Raspberry Pi and an AWS AMI. The VM appliance is for Pro only. We did not verify RAM or database requirements.

The Community Edition is free for unlimited users and includes password and folder management, users and groups, two-factor login, role-based access control, password expiry, the browser extension, and a CLI. Pro adds SSO with Microsoft, Google, OpenID, and AD FS, plus LDAP provisioning, SCIM, an activity log, syslog action logs, account recovery, and tags. As listed on October 29, 2026, Pro self-hosted is $4.90 (€4.50) per user per month billed annually, with a 10-user minimum. Passbolt Cloud Business is $5.40 per user per month billed monthly or $4.90 billed annually, Cloud Sovereign is $8 per user per month billed annually, cloud plans have a 10-user minimum, and Enterprise is priced on request. The latest release is v5.17.0, from October 20, 2026.

AliasVault

AliasVault pairs a password manager with a built-in email server for creating aliases. Its README lists a .NET, Blazor, and React stack, installed through install.sh or a single Docker container. It needs 1 vCPU, 1 GB of RAM, 5 GB of disk (16 GB recommended), Docker 20.10 or later, and 64-bit Linux. Clients include a web app, browser extensions, iOS, and Android.

There is no team sharing yet. The release notes say 0.31.0 lays groundwork for family vault sharing, with a closed beta planned on AliasVault Cloud; the latest release is 0.31.1, from October 14, 2026. As listed on October 29, 2026, the cloud free tier is €0 with fair-use limits, and Premium and Family plans are marked coming soon without prices. For a direct comparison, see AliasVault vs Vaultwarden.

Passman

Passman is an AGPL-3.0 password manager that runs as a Nextcloud app. It supports internal and link sharing, which an admin can disable, and has a web extension and an Android app. The latest release is v2.6.5, from October 17, 2026, and v2.6.3 added Nextcloud 35 support.

KeePassXC, bramble, and Kure

KeePassXC is licensed GPL-2.0 or GPL-3.0 and runs on Windows, macOS, and Linux. It keeps the vault in an offline KDBX file you can store anywhere, with no server.

bramble is local-first and stores nothing on a server; devices sync peer-to-peer through end-to-end-encrypted relays or TURN. It is GPL-3.0, with a Rust cryptography core, React, and Tauri, and runs as Chrome and Firefox extensions and on macOS, Linux, iOS, and Android, with Windows in testing. It has no team sharing and no independent audit, and its README includes a disclosure about AI assistance in its development. The latest desktop release is 0.13.0, from October 27, 2026.

Kure is an offline Go command-line tool with sessions and a single portable database file, encrypted with AES-256-GCM and Argon2id. It has no sharing, no server mode, and no documented import. It is Apache-2.0 licensed, and the latest release is v1.3.0, from November 2, 2025.

Vaultwarden or the official Bitwarden server

Vaultwarden gives a family or home lab Bitwarden's apps and premium features for free. Bitwarden's own server charges a license for those features but comes from the company that ships the apps, with published audits and compliance reports. For a feature-by-feature view, see the side-by-side comparison.

Compatibility. Vaultwarden's FAQ says it ships Bitwarden's web vault with its own patches, that client compatibility is not guaranteed, and that clients need HTTPS. The wiki's list of missing features includes the full public and organization API (only the part Directory Connector needs exists), login with passkeys, New Device Login Protection, custom roles, and the "Require SSO", "Vault timeout", and "Remove individual vault export" policies. If your business depends on any of those, use the official server.

Resources. Bitwarden's standard install needs at least 2 GB of RAM, and Lite needs at least 200 MB, but Bitwarden positions Lite for personal and home-lab use. Vaultwarden's README says it targets self-hosters who find the official server too resource-heavy; we did not verify a minimum RAM figure for it.

Update cadence. Because Vaultwarden reimplements the server, it has to keep up with Bitwarden's apps. Per its release notes, Bitwarden clients 2026.8.0 and later required Vaultwarden 1.37.2, released August 22, 2026. A discussion collected login and two-factor problems after that client update; the maintainers advised upgrading the server, fully logging out, and clearing the client cache. Version 1.37.4 also removed legacy register and prelogin endpoints, and Bitwarden CLI 2026.4.2 and older can no longer receive Sends with it. We recommend upgrading Vaultwarden soon after Bitwarden ships new apps.

Licensing. Vaultwarden's server is AGPL-3.0. Bitwarden mixes AGPL-3.0 code with Bitwarden License code, so features such as SSO need a paid subscription in production.

Security audits and what "unofficial" means

Bitwarden's audits and certifications cover Bitwarden's own products, not Vaultwarden's server, which has its own smaller audit record. Bitwarden lists 2025 audits by Cure53 (browser extension and autofill, core app, and desktop), by ETH Zurich's Applied Cryptography Group (cryptography under a malicious server), and by Unit 42 (mobile). Its compliance page lists SOC 2 Type II, SOC 3, ISO 27001, and HIPAA. Those reviews are of Bitwarden's own products. Vaultwarden users run the same apps, but Vaultwarden's server and its patched web vault fall outside them.

Vaultwarden's audits page lists a 2024 test of v1.30.3 by Germany's BSI under its CAOS project, and an October 2024 penetration test by ERNW for a customer. ERNW found three vulnerabilities, including an authentication bypass affecting 1.32.5 and earlier, which were fixed.

In practice, "unofficial" means a few concrete things, per Vaultwarden's README and FAQ. The project is not associated with Bitwarden, Inc.; one maintainer works at Bitwarden but contributes to Vaultwarden independently. Bugs go to Vaultwarden, not to Bitwarden support. Compatibility with new Bitwarden apps is not guaranteed, which is what users saw in August 2026.

Passbolt publishes Cure53 reports, including a February 2026 white-box test of its SCIM, Azure AD, and directory sync features, which found 12 issues (1 High, 4 Medium, 7 Low); the results were published June 17, 2026. Passbolt also says it runs an annual third-party penetration test. AliasVault lists no third-party audit but publishes a whitepaper and a SECURITY.md on its website. We found no audit for Passman, bramble says it has no independent audit, and we did not check audits for KeePassXC or Kure.

Password manager licenses: AGPL, GPL, Apache, and the Bitwarden License

Vaultwarden, Passbolt, AliasVault, Passman, and Bitwarden's server code outside the bitwarden_license directory use the GNU AGPL-3.0. For a self-hosted password manager, the practical condition is this: if you modify the code and let people use the modified version over a network, including your family or staff, you must offer those users the complete corresponding source of your modified version. Running it unmodified does not trigger that condition. This is a summary, not legal advice, so read the license before you ship changes.

Bitwarden's bitwarden_license directory is source-available rather than open source, and using it in production needs a paid subscription; the OSS build leaves it out. bramble is GPL-3.0, KeePassXC is GPL-2.0 or GPL-3.0, and Kure is Apache-2.0. None of those three licenses has the AGPL's network clause.

Moving from 1Password or LastPass

Bitwarden imports from LastPass, 1Password, Firefox, Chrome, Edge, Password Safe, and other Bitwarden vaults. You can import in the web app, browser extension, desktop app, or CLI (bw import), and through the Credential Exchange Protocol on iOS 26 or later and Android 14 or later. From 1Password, it accepts .1pux files (1Password 8.5 or later), .1pif, and .csv. Attachments must be re-uploaded by hand, and the importer does not check for duplicates, so import into an empty vault. Vaultwarden imports through the bundled Bitwarden web vault, with the same formats; it has no import guide of its own.

Passbolt imports CSV files from LastPass, 1Password, Bitwarden, Dashlane, NordPass, browsers, and Safari, and KDBX files from KeePass and Keeper. AliasVault imports from 1Password, Bitwarden, Chrome, Dashlane, Firefox, KeePass and KeePassXC, Proton Pass, and Strongbox, but does not list LastPass. Passman's import is experimental and covers KeePass, LastPass, Dashlane, Zoho, Clipperz, EnPass, and ocPasswords, but not 1Password. bramble imports from 1Password, Bitwarden, Proton Pass, LastPass, Enpass, AliasVault, KeePass KDBX4, Apple Passwords, and Google.

How to choose

1. Decide whether you need a server. If one person uses the vault, KeePassXC, bramble, or Kure avoid running one.
2. Decide who the users are. Families and home labs can weigh Vaultwarden or Bitwarden Lite; Bitwarden says Lite is not for business.
3. List what you need on day one, such as SSO, SCIM, audit logs, and emergency access, then check the free-features table. Bitwarden and Passbolt put SSO and SCIM behind paid licenses; Vaultwarden includes SSO and Directory Connector.
4. Size the server: at least 2 GB of RAM for Bitwarden's standard install, 200 MB for Lite, and 1 GB for AliasVault.
5. If you pick Vaultwarden, follow its releases and plan to upgrade the server when Bitwarden ships new apps.
6. Test an import from 1Password or LastPass on a test install, and check attachments and duplicates before you move everyone.