Vaultwarden keeps your passwords on your own server and works with every official Bitwarden app and browser extension. It needs HTTPS, so set that up first.
On this page
Good to know before you install
Signing in with Authelia only opens your account: you still type your master password to unlock the vault, because it never leaves your devices.
At a glance#
- What it is
- Password Manager Security
- Where it opens
- Password Manager
On its own port at
http://your-server:port, orvault.your-domainonce you have a domain - Updates
- Automatic A backup is taken first, and it rolls back if the update fails
- Backups
- Included Part of the daily backup when that's switched on
- Copies
- As many as you like Run several copies, each with its own data
- Needs
- HTTPS
What it's good for#
A password manager remembers a different strong password for every site so you don't have to, and fills them in for you on your laptop and your phone. Vaultwarden is a small, independent server for the Bitwarden apps: you get the same browser extensions and phone apps millions of people use, but your vault lives on your server rather than someone else's.
Your vault is encrypted on your own device before it's sent, with a key made from your master password. The server only ever stores the scrambled result. That's also why there's no way to recover a forgotten master password, on your server or anyone's.
Before you install: HTTPS#
Vaultwarden's web page makes your encryption key in the browser, and browsers only allow that on a secure page. On a plain http://192.168.1.50:port address the page loads and then refuses to let you sign in or create an account. LibrePortal warns you about this before you install, and the Open button says so too.
Either of LibrePortal's HTTPS choices fixes it; see Domains and HTTPS:
- HTTPS without a domain gives you
https://192.168.1.50:port. Fine in a browser once you've accepted the certificate warning. - Your own domain gives you
https://vault.example.comwith a certificate every device already trusts. This is the one that makes the phone apps painless.
Phones are fussier than browsers
The Bitwarden phone apps don't offer a "continue anyway" button for a certificate they don't recognise. With a domain there's nothing to do. With LibrePortal's own certificate, the phone has to be told to trust it first. To check: document how to trust LibrePortal's self-signed certificate on Android and iOS so the Bitwarden apps accept it, or confirm that a domain is the only supported route for phones
Your first account#
Vaultwarden doesn't have an admin account in the usual sense. Everyone, including you, has an ordinary account they create themselves on the web page, and LibrePortal doesn't make one for you, because only you should ever know your master password.
- Open Vaultwarden with its Password Manager button, on its HTTPS address.
- Create an account with your email address and a master password. Make it long, a sentence you'll remember, and write it down somewhere safe at home. Nobody can reset it for you.
- Create accounts for your household the same way, while sign-ups are open.
- Switch sign-ups off. Untick Vaultwarden Allow Signups on the Config tab and press Update Configuration.
Why switch sign-ups off
Sign-ups start switched on, because otherwise nobody could make the first account. But while they're on, anyone who can reach the page can make an account on your server. Once your people are in, there's no reason to leave the door open. If Vaultwarden is private (see Who can reach what) that's only people on your own network, but it's still tidier to close it.
The admin page#
Vaultwarden also has a separate admin page at /admin on the same address, for things like inviting people, seeing who has an account, and deleting one. It's protected by an admin token rather than an account. LibrePortal generates the token when it installs Vaultwarden and shows it in the Login Details, as Admin Token; press Welcome on the app's page to see it again. Paste it into the admin page when it asks.
With sign-ups off, the admin page is how you add someone new later. Invite them by email address there, then send them your Vaultwarden address. Vaultwarden has no mail server to send the invitation through, so it won't arrive by email; that's fine, because Vaultwarden's own documentation says an invited person can still register by going to /#/signup on your address and using the invited email.
Connecting the apps#
Every official Bitwarden app works: the browser extensions for Firefox, Chrome and the rest, the desktop app, and the phone apps for Android and iPhone. They all connect the same way.
- Open the app's sign-in screen and look for the server or region setting, usually a choice between Bitwarden's own regions and self-hosted.
- Choose self-hosted and enter your Vaultwarden address, exactly as you open it in the browser, for example
https://vault.example.com. - Sign in with your email and master password.
Once the browser extension is signed in, it offers to save passwords as you log in to sites and fills them in next time. Bitwarden's apps also have their own tools for importing from another password manager or from your browser's saved passwords, in the web page's Tools section.
Good to know#
- Keep it private if only your household uses it. A public Vaultwarden is only as safe as its weakest master password. If you're away from home, the LibrePortal VPN gets your devices in without opening it to the internet. The apps keep an offline copy of your vault, so you can still read your passwords with the VPN off; you just can't sync changes.
- Sign-in attempts are limited. LibrePortal sets Vaultwarden to allow a burst of 10 sign-in attempts and then one a minute, so nobody can guess passwords quickly.
- Backups include your vault. Vaultwarden's data folder, with its database and attachments, is in the nightly backup. The vault inside is still encrypted with each person's master password, so a restore brings it back exactly as it was, and a stolen backup is no use without the master password.
- Updates are automatic. Vaultwarden is conservative about its database, and a backup is taken first anyway.
- Metrics. If you run Prometheus and Grafana, there's an Export metrics to Grafana switch in its settings.
- More than one copy is possible, for example a separate vault for a club you run. Each is completely separate.
What the install asks#
When you install Vaultwarden, LibrePortal asks for a little more than usual before it starts:
- Quick settings
Addresses and ports#
Vaultwarden has one port. LibrePortal picks a free port number for each when you install, so yours will differ from anyone else's. The Config tab's Network section shows them, and the app's Open button uses the right one. "Anyone" means it's reachable from wherever your server is reachable; you can make it private later.
| What it is | Who can reach it | With a domain |
|---|---|---|
| Password Manager, Admin Panel | Anyone | vault.your-domain |
Settings#
These are Vaultwarden's own settings on its Config tab. The settings every app shares, like backups, updates and where its data lives, are explained in App pages and settings.
| Setting | What it does | Starts as |
|---|---|---|
| Outgoing Mail Server | Your own mail server, for invitations and email-change codes. Empty uses the mail server on this machine if there is one. | Empty |
| Outgoing Mail Port | 587 for STARTTLS; 465 is TLS from the start. | 587 |
| Outgoing Mail Encryption | How the connection to the mail server is secured. Choices: STARTTLS, TLS from the start, None |
starttls |
| Outgoing Mail Sender | The address Vaultwarden's mail comes from. Empty uses the username when it is an address. | Empty |
| Outgoing Mail Username | The account Vaultwarden logs in to the mail server with. | Empty |
In its config file#
A few more aren't on the Config tab yet. They live in the app's config file, described here so you know they exist. How to change them.
| Setting | What it does | Starts as |
|---|---|---|
NameCFG_VAULTWARDEN_DISPLAY_NAME |
What this app is called on your dashboards. Leave empty to use its usual name | Empty |
Show on the LibrePortal DashboardCFG_VAULTWARDEN_SHOW_ON_DASHBOARD |
Whether this app gets a shortcut on the front page of the LibrePortal WebUI, separate from any Dashy dashboard Choices: true, false |
true |
Allow Sign-upsCFG_VAULTWARDEN_SIGNUPS_ALLOWED |
Whether anyone who can open the vault may make an account Choices: true, false |
false |
Sign in only through single sign-onCFG_VAULTWARDEN_SSO_ONLY |
Turns off email-and-password sign-in Choices: true, false |
false |
Create Vaults by Signing InCFG_VAULTWARDEN_SSO_SIGNUPS_ALLOWED |
Let people Authelia allows create their vault by signing in Choices: true, false |
false |
Website iconsCFG_VAULTWARDEN_SITE_ICONS |
Whether the server may fetch each saved site's icon from that site, which tells the site your server looked it up Choices: true, false |
false |
Detailed logsCFG_VAULTWARDEN_VERBOSE_LOGS |
Whether Vaultwarden writes its normal, chattier logs, including who connected, instead of only warnings and errors. Choices: true, false |
false |
Debug logging for 24 hoursCFG_VAULTWARDEN_DEBUG_LOGS |
Turn on to see everything Vaultwarden is doing while you look for a problem; it turns itself off after 24 hours. Choices: true, false |
false |
Tools#
Vaultwarden's Tools tab has 1 button for jobs you'd otherwise need a terminal for. Each one runs as a task, so you can watch it on the Tasks page and read what it did. More about Tools.
Let one email address make an account while sign-ups are closed. Invite yourself first.
Works with#
These are the other apps Vaultwarden knows how to work with. Once it's installed, its page shows the same list with whether each one is connected. How this works.
- Email: Sends invitations and new-device alerts through your mail server. On by itself once that server can mail the internet, since an invitation then has to be opened from the email. LibrePortal sets this up by itself when both are installed.
- Grafana: Shows dashboards for the apps that have one. works with every app
- Prometheus: Collects metrics from the apps that can export them. works with every app
- Uptime Kuma: Watches your apps and shows when one goes down. works with every app
Privacy and security#
All clear Vaultwarden keeps your passwords encrypted on your server. LibrePortal stops it fetching website icons, so it never tells the sites you save that your server asked.
What leaves this server#
- The admin page can check GitHub for a newer version, only when you open it
What LibrePortal turns off#
- Detailed logs and per-request access logging (switchable in Config)
- Website icon downloads (switchable in Config)
Licence: AGPL-3.0. Audited: 21 October 2026. See the privacy of every app and the Promise.
Sources#
Under the hood#
- It runs this image:
vaultwarden/server:1.37.3@sha256:1587c45feaa479f1f5e8af3b00eded36bff77bcf1880cf8dbf0541706dd470e0. - It can sit behind Authelia's sign-in once Authelia is installed.
- Its own project and documentation: github.com/dani-garcia/vaultwarden
Ports, settings, tools and connections on this page are read from LibrePortal v0.10.97's app catalogue each time the guide is built.