Switching to Vaultwarden from Bitwarden: What Changed for Me

Six months ago I was paying Bitwarden $10 a month for the privilege of storing my passwords on someone else’s server. It wasn’t a bad service. But when you’re running a homelab full of AI models, local databases, and API credentials for things that probably shouldn’t leave your house, the monthly fee starts to feel less like insurance and more like friction. So I set up Vaultwarden, their lightweight self-hosted alternative. What I found surprised me in ways I didn’t expect—not all of them convenient.

Why I Left Bitwarden (and What Stayed True)

Let me be clear: Bitwarden is solid. The clients work everywhere. The browser extension doesn’t lag. Syncing is instant. I never lost a password, never hit a wall with features I needed. But three things gnawed at me.

First, the principle thing. I have a 24TB NAS running at home. I maintain my own DNS. I’ve built enough infrastructure that the idea of paying a SaaS provider to hold credentials felt backwards. Second, the practical thing: I generate API keys constantly—for OpenAI, for Ollama deployments, for self-hosted services I spin up and tear down. I wanted those secrets nowhere near someone else’s infrastructure, full stop. Third, the learning thing. I wanted to understand how password management actually works under the hood, not just use it.

Vaultwarden promised to be compatible with Bitwarden’s clients. That turned out to be mostly true, with caveats I’ll get to.

Setting Up Vaultwarden: The Easy Part

Getting Vaultwarden running took maybe thirty minutes. I run most services via Docker, so I pulled the vaultwarden/server image and started with a basic compose file:

version: '3.8'
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    ports:
      - "80:80"
      - "443:443"
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=false
      - INVITATIONS_ORG_ALLOWED=false
    volumes:
      - ./vw-data:/data
    restart: always

Within a minute the container was up. I pointed my reverse proxy at it (I use Caddy for TLS termination), registered an account, and the web interface loaded. This part genuinely is straightforward. The Bitwarden protocol is clean. Vaultwarden just implements it without the cloud overhead.

The real question was whether the clients would actually work.

Client Compatibility: Where Reality Diverges

Here’s the thing nobody quite emphasizes enough: Vaultwarden works with Bitwarden clients, but not with every feature, and not without some setup.

I installed the Firefox extension first. It connected immediately once I told it the server address. Password autofill works. Saving new credentials works. But then I tried to use Bitwarden’s password generator on the web vault itself—the one that’s supposed to include passphrase mode, and allow you to tune every parameter. That feature doesn’t exist in Vaultwarden’s web interface. It’s a self-hosted limitation, not a bug. You get a basic password generator and that’s it.

On mobile, the official Bitwarden app connects fine to a Vaultwarden server. But some premium features—like the TOTP authenticator built into Bitwarden—only work on the paid tier. When you move to self-hosted Vaultwarden, you technically have access to everything the code contains, but the Bitwarden client apps still check license status. It’s a weird space between open-source and proprietary. I worked around it by using a separate authenticator app (Aegis) alongside Vaultwarden. That’s fine. That’s actually more secure. But it surprised me.

The bigger friction came during migration. Bitwarden’s export is straightforward—download a JSON file. But importing that into Vaultwarden required using the web vault’s import tool, which has a limit on file size. Mine was around 8MB and it choked. I had to split the export, import in chunks. Not a dealbreaker, but not elegant either.

The Day-to-Day Reality

Four months in, I’m genuinely happy with how it feels to use. The web vault is cleaner than Bitwarden’s in some ways. Folder organization is simpler. The browser extension works so similarly I barely notice the difference. Password syncing across devices is instant because everything’s on my own infrastructure.

Resource usage is negligible. The container sits at about 40MB of RAM when idle, maybe 150MB when active. On my Ryzen 5700X, Vaultwarden takes up approximately nothing. Bitwarden’s client apps, by comparison, are genuinely heavier than they need to be. I’m not sure if that’s intentional bloat or just the cost of their feature set, but the self-hosted version doesn’t carry that weight.

The other win: offline access. Bitwarden’s app caches credentials locally, sure, but if the server goes down for any reason, the web vault doesn’t work. My Vaultwarden server is on the same network as my devices. Even if my internet dies, I can still access my vault from my local machine. That’s a minor thing until it matters.

What I Actually Miss

I expected to miss the paid features. Turns out I don’t, because the ones I cared about (secure password sharing, organization support) exist in Vaultwarden too. There’s no license checking. What I actually miss is smaller, which is almost worse because there’s no good solution.

First: Bitwarden’s mobile app is more polished. Not dramatically so, but it handles authentication flow smoother. Vaultwarden works with the app fine, but the interaction sometimes feels stilted. The login screen takes an extra step or two compared to what I’m used to.

Second: Bitwarden’s browser extension syncs more reliably across multiple browsers. I use Firefox on desktop and Safari on Mac. With Bitwarden, both stayed perfectly in sync. With Vaultwarden, there’s occasionally a minute or two of lag, particularly when I save a new password. It’s not consistent enough to be a problem, but it’s persistent enough that I notice. Given that the entire server runs on my local network, I would have expected this to be faster, not slower. I suspect there’s something about how the Bitwarden app handles caching that I’m not accounting for.

Third, and I’m slightly embarrassed to admit this: I miss the peace of mind. Bitwarden has security audits and corporate backing and a public bug bounty program. Vaultwarden is solid open-source software maintained by a single person (dani-garcia on GitHub). It’s well-written. It’s been running for years. But if a critical vulnerability was found tomorrow, the response time might not be the same. This is the trade-off you make with self-hosting anything. You get full control and full responsibility.

The Infrastructure Considerations

Vaultwarden needs storage. By default, it uses SQLite, which is fine for a single household or small team. If you’re planning to scale beyond that, you should probably switch to PostgreSQL. I haven’t needed to yet, but I kept the option open in my docker-compose by documenting how to switch the database backend if I ever expanded.

Backups matter more than they did with Bitwarden. Now that your vault lives on your hardware, you own the backup responsibility entirely. I set up a daily automated backup of the Vaultwarden data directory to my NAS using rsync. Takes maybe 2MB of storage per day. Worth the two minutes of initial setup.

SSL/TLS is non-negotiable. You should never run Vaultwarden without encryption, not even internally. I use Caddy with Let’s Encrypt, which handles certificate renewal automatically. Worth configuring properly from day one.

Things That Surprised Me

The web vault can auto-generate usernames, not just passwords. That’s a feature I didn’t know I wanted until I found it. Useful for service accounts.

Vaultwarden can generate biometric login tokens if you want. I haven’t enabled it, but the option exists in a way it doesn’t with standard Bitwarden.

You can run Vaultwarden on a Raspberry Pi. Not efficiently, but technically it works. I tested it on a Pi 4 and got maybe 500MB of RAM usage. Slower than my main server, but completely viable if you don’t have the luxury of a dedicated machine.

The surprising downside: the web interface doesn’t support keyboard shortcuts in the way Bitwarden does. Bitwarden has this nice shortcut to fill credentials on a webpage. Vaultwarden expects you to use the browser extension directly. This is a self-hosted limitation—the web vault is intentionally lighter-weight.

The Real Cost Analysis

Let me do the math honestly. Bitwarden Premium is $10/month, or $40/year. Running Vaultwarden costs me electricity (negligible), and the domain (I already own it). Zero dollars. But I’ve spent time—maybe 8 hours total on setup, configuration, and backup automation. My time is worth something. At a generous estimate, the self-hosted option breaks even financially around month 3, assuming my labor is free. After that, it saves money. That’s not why I did it, but it’s not irrelevant either.

The more important calculus is control. With Bitwarden, my passwords exist on their infrastructure, protected by their policies and their security. With Vaultwarden, they exist on my hardware, protected by my network security, my backups, and my responsibility. Both approaches have merit. It depends on your threat model and how much you trust your own infrastructure.

I’ve been running Vaultwarden for about six months now. I haven’t had regrets. The system is stable. Backups haven’t failed. Performance has been consistent. If anything, I’m more confident in my password security than I was before, though that might be selection bias—I spent more time thinking about the problem.

FAQ

Can I use the official Bitwarden apps with Vaultwarden?

Yes. All official Bitwarden clients (Firefox, Chrome, Edge, mobile apps) work with a Vaultwarden server if you point them to your server address. Some premium features like the TOTP authenticator won’t unlock, and the web vault is more limited than Bitwarden’s, but core functionality is complete.

Is Vaultwarden safe for storing critical passwords?

Vaultwarden uses the same encryption as Bitwarden (AES-256). The software is well-audited and open-source. Safety depends on your network security, backup strategy, and whether you trust yourself to maintain the infrastructure. It’s not inherently less safe, but you own the responsibility.

How much storage does Vaultwarden use?

The application itself uses 40-60MB of RAM. Storage depends on how many credentials you store, but for a typical personal vault, expect less than 100MB even with thousands of entries. Database backups add maybe 2-5MB per day.

Can I run Vaultwarden on a Raspberry Pi?

Yes, a Pi 4 or newer can run Vaultwarden fine. RAM usage sits around 500MB, and performance is acceptable for a single user or small household. Don’t expect it to handle more than a few concurrent users comfortably.

What happens if my Vaultwarden server goes down?

Bitwarden clients cache credentials locally, so you can still access your passwords on devices you’ve already logged in to. The web vault won’t be accessible until the server is back online. This is why backups and monitoring matter.

Explore Vaultwarden in our AI Homelab Toolkit.