How to Deploy Vaultwarden on a VPS: Your Own Password Manager on a Server

Every day we have to remember dozens of passwords — for email, social media, online banking, work services. It's impossible to keep them all in your head, and writing them down in a notebook or a text file is risky. The solution is a password manager. But cloud services (like LastPass or 1Password) store your data on someone else's servers, which always carries the risk of a leak. The alternative is to host your own password manager on a VPS. For example, Vaultwarden — a lightweight but feature‑rich alternative to the popular Bitwarden. In this article, we'll walk you through, step by step, how to deploy Vaultwarden on a virtual server, set up HTTPS, and start using it.

What Is Vaultwarden and Why Do You Need It?

Vaultwarden is a server implementation of the Bitwarden password manager, written in Rust. It is fully compatible with all official Bitwarden clients: browser extensions, Android, iOS, Windows, macOS, and Linux apps. The main advantage is its minimal resource consumption — a VPS with 512 MB of RAM is enough. At the same time, you get all the "premium" features of Bitwarden for free, including two‑factor authentication, inviting other users, and password vulnerability checking.

Why run your own server? Complete control over your data. No one except you can access your encrypted vault. You decide where and how to make backups, and you can disable external access or configure it however you like. This is especially important for companies that are prohibited from using cloud services due to security policies, and for advanced users who want to learn system administration.

How a Self‑Hosted Password Manager Works

The principle is simple: you install the Vaultwarden application on a VPS (Virtual Private Server). The application listens on a specific port (usually 80 or 443) and handles requests from clients. All passwords are stored encrypted — even the server administrator cannot read them because decryption happens only on the user's device using the master password.

When you save a new password in the browser extension, the client sends it to the server already encrypted. The server simply stores a "meaningless" blob of bytes. When you request your password list, the server returns the encrypted data, and the client decrypts it locally. This is called end‑to‑end encryption — your secrets never leave your device in plain text.

To access the server from anywhere, you need a domain name and an SSL certificate (HTTPS). Without traffic encryption, attackers can intercept your passwords on public Wi‑Fi networks. We'll show you how to automatically get a free SSL certificate from Let's Encrypt using the Caddy reverse proxy — it's easier than manually configuring Nginx.

Windows Cloud Servers from $5 / moLicense includedTry

Pros and Cons of Self‑Hosting Vaultwarden

Before you start, weigh the advantages and disadvantages. This will help you decide if this approach is right for you.

If the cons don't scare you and the pros outweigh them, let's move to practice.

What You'll Need for Deployment

You will need:

• A VPS server running Ubuntu 20.04 or newer. We recommend using Serverspace VPS hosting — you get a clean system with no unnecessary pre‑installed software, easy scaling, and a user‑friendly control panel. In the following steps, we'll assume you already have a server with Ubuntu and SSH access.
• A domain name pointed to your VPS's IP address (e.g., vault.your-domain.com). If you don't have a domain, you can register one with any registrar (usually around $10–15 per year).
• Basic familiarity with the command line — the ability to connect via SSH and run simple commands. We'll detail every step.

We'll use Docker and Docker Compose for the installation. They isolate Vaultwarden from the host system, making updates and backups easier. We'll also install Caddy — a web server that automatically issues an SSL certificate and sets up proxying.

Step‑by‑Step Guide to Installing Vaultwarden on a VPS

All commands should be run as a user with sudo privileges (usually the user you logged in with). If you're using a Serverspace Ubuntu VPS, the default user has full access.

Step 1: Prepare the Server

Connect to your VPS via SSH:

ssh user@your-server-ip

Update the package list and install required utilities:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl git ufw

Set up a basic firewall — open ports for SSH, HTTP, and HTTPS:

sudo ufw allow 22
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable

When you run sudo ufw enable, confirm the action (y). Be careful: if port 22 is closed, you'll lose access. In our case it's open, so it's safe.

Step 2: Install Docker and Docker Compose

We'll install the official Docker version from the developers' repository — it's the most up‑to‑date.

# Add Docker's GPG key and repository
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update

# Install Docker Engine and Docker Compose Plugin
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Verify that everything installed correctly:

docker --version
docker compose version

You should see version numbers with no errors.

Step 3: Create the Configuration File (docker-compose.yml)

Create a separate folder for the project and move into it:

mkdir ~/vaultwarden
cd ~/vaultwarden

Now create the docker-compose.yml file using the nano editor:

nano docker-compose.yml

Copy and paste the following content (don't forget to replace vault.your-domain.com with your actual domain pointed to the server):

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      WEBSOCKET_ENABLED: "true"
      DOMAIN: "https://vault.your-domain.com"
    volumes:
      - ./vw-data:/data
    expose:
      - 80
    networks:
      - web
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/"]
      interval: 30s
      timeout: 10s
      retries: 5

  caddy:
    image: caddy:2
    container_name: caddy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy-data:/data
      - caddy-config:/config
    networks:
      - web

volumes:
  caddy-data:
  caddy-config:

networks:
  web:
    driver: bridge

This file describes two containers: vaultwarden and caddy. They will communicate with each other through the internal web network. Caddy listens on ports 80 and 443 from the outside and forwards requests to Vaultwarden. Using expose: 80 makes the vaultwarden container accessible only inside Docker, which is more secure.

Now create the Caddy configuration. In the same folder, create a file named Caddyfile:

nano Caddyfile

Insert the following line (again, replace the domain):

vault.your-domain.com {
    reverse_proxy vaultwarden:80
}

Save the file (Ctrl+O, Enter, then Ctrl+X).

Step 4: Start the Containers

While in the ~/vaultwarden folder, run:

docker compose up -d

The -d flag (detach) means "run in the background". Docker will download the images (this may take a minute the first time) and start both services. To see the SSL certificate acquisition process, check the logs:

docker compose logs -f

After a few seconds you should see a message like "successfully obtained certificate" — that means Caddy has automatically requested and installed a free Let's Encrypt certificate. Press Ctrl+C to exit the logs.

If everything went well, your Vaultwarden is now available at https://vault.your-domain.com. Open this URL in your browser — you'll see the registration page.

Step 5: First Login and Admin Setup

The first user who registers on your server automatically gets administrator privileges. Fill in the fields: email, name, master password (make sure it's strong and unique). After registration, you'll enter the web interface — you can start adding logins and passwords.

To access the admin panel, add /admin to the URL. For example, https://vault.your-domain.com/admin. The admin panel password is automatically generated and printed in the container logs. Retrieve it with:

docker logs vaultwarden 2>&1 | grep "Admin panel"

You'll see a line containing the password. Copy it and use it to log in. In the admin panel you can invite other users, configure security policies, and change server settings.

Cloud Servers from $5 / moIntel Xeon Gold 6254 3.1 GHz CPU, SLA 99,9%, 100 Mbps channelTry

Practical Use Cases for Vaultwarden

Here are several typical scenarios where a self‑hosted password manager brings the most value.

• Personal use for the whole family. Create an organization in Vaultwarden, add family members, and share passwords for home Wi‑Fi, Netflix, online banking. Each person sees only the entries you've shared with them.
• A small development team. Instead of keeping passwords for servers, databases, and services in a shared document, the team uses Vaultwarden with two‑factor authentication. You can grant access to specific collections and simply block an employee's account when they leave.
• An IT enthusiast who wants to learn system administration. Installing Vaultwarden on a VPS is a great project to get familiar with Docker, reverse proxies, and SSL certificates. You get both a useful service and valuable experience.
• A company with data localization requirements. If laws or internal policies prohibit storing passwords on servers outside your country, renting a VPS in a local data center (for example, using Serverspace) and hosting Vaultwarden solves the problem.
• Emergency access backup vault. You can deploy Vaultwarden on a cheap VPS and keep only copies of your most critical passwords there — in case your primary password manager (e.g., a cloud one) becomes unavailable.

Common Mistakes and How to Avoid Them

Even when following instructions, issues can arise. Here are typical errors and their solutions in a table.

Conclusion and Next Steps

You've successfully deployed your own password manager on a VPS. From now on, all your passwords are stored on a server you control. Vaultwarden is a reliable tool that doesn't require powerful hardware and handles the load of a single user or a small team.

What you can improve later:

• Set up automatic backups of the vw-data folder to cloud storage or another server. Use rclone or a simple script with tar and scp.
• Enable two‑factor authentication (2FA) for your Vaultwarden account — supported methods include Google Authenticator, Duo, and YubiKey.
• Automate container updates using watchtower or a simple cron script.
• Restrict access by IP via the firewall if you know exactly where you'll be connecting from (e.g., only your office IP).

If you haven't yet chosen a VPS provider, take a look at Serverspace. Their services allow you to rent a virtual server in various data centers in just a few minutes, manage it through a convenient dashboard, and easily scale resources as you grow. Click the link https://serverspace.us/services/vps-server/ to explore plans and launch your own Vaultwarden today.

FAQ