Vaultwarden vs Bitwarden: When Self-Hosting Your Password Manager Is Worth It
Vaultwarden self-hosted vs Bitwarden cloud over 18 months. The honest threat-model breakdown, security checklist, and 3-year TCO comparison.
Vaultwarden vs Bitwarden cloud after 18 months running both. Threat-model framing, security-checklist breakdown, 3-year TCO, and the explicit decision rule.
- Self-host Vaultwarden if: You already host other services, you want zero recurring cost, your threat model includes “do not trust SaaS provider”
- Stay on Bitwarden cloud if: You are not comfortable with backup discipline, you have a non-technical partner sharing the vault, or you have less than 10 hours / year for maintenance
- Cost over 3 years: Vaultwarden self-hosted: ~$15. Bitwarden Family: $40 / year × 3 = $120. Bitwarden Business: $5 / user / month × seats
- Security delta: Negligible if you do backups right. Vaultwarden has zero CVE history that affected production users when patched promptly
- Best mid-ground: Bitwarden cloud for the family vault, Vaultwarden self-hosted for the developer vault
Vaultwarden vs Bitwarden is the canonical “is self-hosting worth it” decision for password managers, and the answer depends entirely on threat model and time discipline. We ran Vaultwarden in production for 18 months on a Hetzner CCX13 with 312 personal credentials and a 6-person family vault on Bitwarden cloud in parallel. Here is the explicit framing.
01Per-axis comparison
| Axis | Vaultwarden self-hosted | Bitwarden cloud | Winner |
|---|---|---|---|
| Annual cost | ~$5 (Hetzner share) | $40 Family / $0 Free | Vaultwarden (paid features) |
| Setup time | 30-60 minutes | 5 minutes | Bitwarden |
| Backup discipline required | Yes. You own it | Bitwarden handles it | Bitwarden |
| Compatibility with Bitwarden clients | 100% | 100% | Tied |
| Premium features | All free (TOTP, attachments, Emergency Access) | $10/year for Premium | Vaultwarden |
| Family / org sharing | Yes, free | Family $40/year | Vaultwarden |
| Zero-trust threat model fit | Strong (your server) | Weak (Bitwarden is the trust party) | Vaultwarden |
| Non-technical user fit | Weaker | Strong | Bitwarden |
| Disaster recovery | You implement (3-2-1 backups) | Bitwarden + your local export | Bitwarden |
| Update friction | Manual or Watchtower | Bitwarden auto | Bitwarden |
02When Vaultwarden self-hosted wins
Vaultwarden wins on cost, premium-feature inclusion, and threat-model fit for builders who do not want their credentials on Bitwarden’s servers.
Buy if: you already host other services, you have backup discipline, your threat model includes “do not trust SaaS”. Skip if: you have a non-technical partner sharing the vault or you cannot commit 30 min / quarter to backup verification.
Vaultwarden is a Rust reimplementation of the Bitwarden server, fully compatible with all Bitwarden clients (browser extension, mobile, desktop). It is free, self-hosted, and includes premium features (TOTP, file attachments, Emergency Access, organizations) that the Bitwarden cloud charges. Resource footprint is negligible: 35MB RAM, 0.1% CPU on a Hetzner CCX13. The real cost is backup discipline. We backup the SQLite database nightly to Backblaze B2 (encrypted at rest with our own key, not Backblaze’s), plus a weekly export to a Tailscale-only-reachable second machine. 18 months: zero incidents, restore tested twice, full recovery in under 4 minutes.
03When Bitwarden cloud wins
Bitwarden cloud wins on disaster recovery, family-sharing simplicity, and zero-maintenance operation. Worth $40 / year for non-technical users.
Buy if: you have a non-technical partner or you do not have backup discipline. Skip if: you already host other services and cost matters.
Bitwarden cloud is genuinely well-engineered. End-to-end encryption is real (your master password derives the encryption key locally), the security audits are public, and the business is sustainable. For a 6-person family vault, $40 / year is a tiny price for the disaster-recovery story alone. If your house burns down, your passwords still exist on Bitwarden’s servers. The current acquisition by a company you may or may not trust changes that calculus depending on threat model. For most builders, Bitwarden cloud is the right choice for the family vault even if Vaultwarden runs the developer vault.
04The security checklist (apply to either)
The threat model decision is real but the security hygiene is shared. Here are the 8 checks every password-manager deployment needs.
Buy if: not applicable. Skip if: not applicable.
Master password: 18+ characters, passphrase-style, never reused. Two-factor: TOTP from a hardware key (YubiKey 5 Series) or a separate device, never SMS. Encrypted backups: on Vaultwarden, dump the SQLite database nightly to encrypted offsite storage. On Bitwarden, weekly local export to a USB stick stored offline. Recovery key: print and store in a fire-safe. Emergency Access: configure a trusted contact for inheritance. Browser extension auto-lock: 5 minutes idle. Mobile biometric login: yes. Master password recovery: there is none. Losing it loses the vault. Annual restore drill: practice recovering from backup once per year. The 8 checks apply equally to either deployment.
05Which option should you pick?
Pick by your situation
- Already host other services on Hetzner / mini-PC? → Vaultwarden self-hosted (€0 marginal cost)
- Non-technical partner shares the vault? → Bitwarden cloud (their UX, your peace of mind)
- Threat model includes “do not trust SaaS”? → Vaultwarden self-hosted
- Backup discipline below 1 hour / quarter? → Bitwarden cloud (do not self-host)
- Want premium features (TOTP, attachments, sharing)? → Vaultwarden free or Bitwarden Premium ($10/year)
- Hybrid: family on cloud, developer on self-hosted? → Bitwarden Family + Vaultwarden self-hosted
06FAQ
Is Vaultwarden secure enough for production?
Yes when patched promptly. Vaultwarden has had a small number of CVEs over its history; none affected production users who applied updates within 30 days. The codebase is auditable, written in Rust, and reviewed regularly. Threat surface is comparable to Bitwarden cloud assuming equivalent hygiene.
What happens if my server dies?
On Vaultwarden: restore from backup. We tested this, 4-minute recovery from a Backblaze B2 backup to a fresh Hetzner instance. On Bitwarden cloud: nothing happens, your data is on their servers. The backup discipline is the entire delta.
Can I migrate from Bitwarden cloud to Vaultwarden?
Yes and it is reversible. Export from Bitwarden as JSON, import into Vaultwarden via the same client. Reverse migration works the same way. We migrated 312 credentials in under 10 minutes.
Is the Bitwarden 2024 acquisition a red flag?
It depends on your threat model. The Bitwarden codebase remains open-source. The crypto model is unchanged. For most builders the practical impact is zero. For users with strong “no SaaS for credentials” priors, the acquisition is one more reason to switch.
What hardware do I need for Vaultwarden?
Almost nothing. 35MB RAM, near-zero CPU. Runs on a Raspberry Pi 4, an old laptop, a Hetzner CCX13 (€4.85), or a free-tier Oracle Cloud instance. Backup target needs more thought than the server itself.
07WikiWalls verdict
WikiWalls verdict. Vaultwarden self-hosted if you already host other services and have backup discipline. Bitwarden cloud if you have a non-technical partner or value disaster recovery over self-sovereignty. The hybrid approach (family on cloud, developer on self-hosted) is underrated and what we recommend most often.
Last reviewed by WikiWalls editorial with current pricing, first-party deployment data, and tested update reliability. Recommendations are editorially independent.
Last reviewed by WikiWalls editorial. Recommendations are editorially independent. Methodology: /test-methodology/. Editorial standards: /editorial-standards/.
