Skip to content
My Own Suite

Vaultwarden

Replaces LastPass / 1Password

Passwords & security Light resources

Vaultwarden lets you use the familiar Bitwarden apps with your own private backend for passwords, secure notes, cards, identities, and shared vaults.

Install it from Suite Manager → Apps — once running it lives at vaultwarden.<your-domain> and on your Home dashboard.

What you can do

  • Use Bitwarden clients — Connect browser extensions, mobile apps, desktop apps, and the web vault to your own server.
  • Keep vault data encrypted — Vault data is encrypted by the client before it reaches the server, so the server stores encrypted vault data.
  • Share with family or a team — Use Bitwarden-compatible organization and collection features for shared credentials when you need them.

A self-hosted LastPass alternative

Vaultwarden does the job people use LastPass, 1Password, Bitwarden cloud, Dashlane, Google Password Manager, iCloud Keychain, NordPass, Keeper, and Proton Pass for, on a server you own: the same everyday task, without a subscription and without an account at a company that also keeps your data. If you arrived comparing one of these, this is the app My Own Suite installs in its place — its privacy posture below says exactly what it does and does not send anywhere.

  • LastPass alternative
  • 1Password alternative
  • Bitwarden cloud alternative
  • Dashlane alternative
  • Google Password Manager alternative
  • iCloud Keychain alternative
  • NordPass alternative
  • Keeper alternative
  • Proton Pass alternative

Good to know

  • Resource needs: Light resources — This MOS package runs Vaultwarden as one service using its built-in SQLite storage.
  • Package-provided privacy notes (not independently verified by MOS): Vaultwarden runs entirely on your own server with no telemetry, storing client-encrypted vault data locally, while your master password remains your responsibility.
    • Use a strong, unique master password.
    • Enable two-factor authentication where possible.
    • Keep backups, because losing the app data volume can mean losing the vault.
    • By default the server fetches website icons from the sites you save, which can reveal those domains to third parties; you can turn icon downloading off in Vaultwarden if you prefer.
Try before you commit

Just want to try Vaultwarden?

MOS is the way to grow a suite — apps installed, backed up, and updated together, all in one tailored dashboard. But if you'd rather see Vaultwarden on its own first, we've set up a one-click deploy on Railway so you can kick the tires with nothing to install.

Install in MOS

Recommended
  • Yours to control — runs on your own machine or any VPS you pick — and can move anytime
  • One dashboard — every app you run, in one place at your own domain
  • Backups built in — back up and restore your apps in a couple of clicks
  • Fully private if you want — on your own hardware, apps can stay off the public internet entirely
  • Updates handled — version-pinned, health-checked, applied for you
  • HTTPS and domains — trusted certificates without touching DNS records
  • Apps that connect — file, calendar, and office apps work together
Get started with MOS

Try it on Railway

Good for testing
  • Live in minutes — deploy from a template, fill in a few setup fields
  • The real thing, not a demo — the same app MOS installs, running for you
  • Free trial — limited free trial for new users
  • Railway account required — a third-party cloud with its own sign-up and usage billing
  • Tied to Railway — MOS runs anywhere and can migrate; this deploy lives on their platform

Good for a test drive, not the destination — this runs on Railway's cloud, not hardware you own, and comes without MOS backups, updates, or your own domain.

Deploy on Railway

Referral link — Railway pays MOS a commission on deploys made through this button, at no extra cost to you.

Privacy assessment

This is the assessment behind Vaultwarden's posture grade, exactly as it ships inside the package. It describes package version 0.2.5 and nothing else — install a different version and its own assessment travels with it. Reviewed 23 July 2026, due for reassessment by 23 January 2027.

What was reviewed

  • Package — version 0.2.5, content digest cabf9762597b… at commit a7b99f9bb6df
  • Vaultwarden — version 1.37.0 from docker.io/vaultwarden/server pinned at e6443e3d5ed8…

Deliberately outside this assessment:

  • Bitwarden browser, desktop, mobile, and web vault clients
  • Bitwarden-hosted push relay and identity services
  • HaveIBeenPwned breach service
  • Third-party API clients

Evidence

Configured Read from the configuration MOS actually ships.

  • The MOS package projects only ADMIN_TOKEN, DOMAIN, SIGNUPS_ALLOWED=true, and WEBSOCKET_ENABLED=true; it sets no analytics or telemetry variables because Vaultwarden defines none.

    Source: apps/vaultwarden/manifest.json

Documented Taken from upstream documentation, policies or source.

  • The Vaultwarden 1.36.0 configuration template defines no telemetry, analytics, usage-reporting, crash-reporting, or phone-home settings.

    Source: Vaultwarden .env.template (v1.36.0) · checked 2026-07-23

  • Vault data is encrypted by the Bitwarden clients before it reaches the server and is stored in the package's local SQLite data volume; the self-hosted server requires no upstream Bitwarden account.

    Source: apps/vaultwarden/README.md and Vaultwarden project documentation · checked 2026-07-23

  • ICON_SERVICE defaults to 'internal' and DISABLE_ICON_DOWNLOAD defaults to false, so the server fetches website favicons directly from third-party sites for saved vault URLs; MOS does not override these defaults.

    Source: Vaultwarden .env.template (v1.36.0) · checked 2026-07-23

  • Mobile push notifications (PUSH_ENABLED) default to false and HaveIBeenPwned breach checking requires an unset HIBP_API_KEY, so both optional Bitwarden and HIBP integrations are inactive in the packaged default.

    Source: Vaultwarden .env.template (v1.36.0) · checked 2026-07-23

What this review does not settle

Published rather than smoothed over. Each of these is a limit of the method, not a finding against the app.

  • No runtime network capture was performed against the pinned 1.36.0 image; conclusions rely on package configuration and upstream documentation.
  • With the default ICON_SERVICE=internal and DISABLE_ICON_DOWNLOAD=false, the server fetches favicons from third-party websites for saved vault URLs, which can reveal saved domains to those sites; the package does not currently set DISABLE_ICON_DOWNLOAD=true, and a future revision could harden this default.
  • Optional Bitwarden push relay and HaveIBeenPwned breach checking are inactive by default but become external dependencies if an operator later enables them.

Policies read

  • license — Vaultwarden (dani-garcia) · retrieved 2026-07-23

How this review was produced

  • Method — AI-assisted review, not yet checked by a human
  • Model — Claude Opus 4.8 (Anthropic)
  • Workflow — assess-app-privacy at 6a741118713a
  • Repository commit — a7b99f9bb6df

Technical reference

Maintained alongside the package at apps/vaultwarden/README.md and rendered here as-is.

Vaultwarden MOS Package

Environment Variables

  • ADMIN_TOKEN: Admin-panel token, projected from the generated adminToken setup secret. Suite Manager state keeps only a secret reference, redacted label, and fingerprint.
  • DOMAIN: Projected from the app public URL.
  • SIGNUPS_ALLOWED=true: The server accepts new account registrations.
  • WEBSOCKET_ENABLED=true: Live sync notifications for connected clients.

Volumes And Persistence

  • data:/data: Stores the SQLite database and all other server state. Vault data is encrypted by the Bitwarden clients before it reaches the server.

The package runs Vaultwarden as a single service on its built-in SQLite storage; there is no separate database container. The self-hosted server requires no upstream Bitwarden account.

Health Check

  • http://vaultwarden:80/alive

Secret Handling

The adminToken setup field is generated at logical install time and stored as a restricted secret file. Suite Manager must not return the raw admin token in package listings, install responses, logs, or projection previews. Runtime apply resolves the secret only from the configured MOS app secret directory; if the secret file is missing, unreadable, or outside that directory, Suite Manager fails closed with a controlled APP_SECRET_UNAVAILABLE lifecycle error without calling the app agent or exposing the secret path.

Current Limits

  • There is no owner-facing admin-token reveal or rotation flow yet.
  • A richer package variant could introduce PostgreSQL; the current package intentionally stays on single-service SQLite.