Vaultwarden: Self-Hosting a Password Manager on Your NAS

If you want a self hosted password manager that works with Bitwarden’s official apps (browser extensions, mobile, desktop) without paying $10/year for premium cloud sync, Vaultwarden is your answer. It’s a lightweight, community-maintained server implementation that runs on virtually any NAS with Docker support — TrueNAS SCALE, Unraid, OMV, or a plain Linux box. This guide covers the setup, the security requirements you cannot skip, and the backup strategy that keeps your vault from becoming a catastrophe.

What Is Vaultwarden and Why Run It on Your NAS?

Vaultwarden is an unofficial, open-source reimplementation of the Bitwarden server API, written in Rust. It’s designed to be lightweight — it uses about 512MB of RAM and a few hundred megabytes of storage for the database — compared to the official Bitwarden server, which requires SQL Server, 2GB+ RAM, and significantly more complexity. Vaultwarden is fully compatible with all official Bitwarden clients (browser extensions, mobile apps, desktop apps) and supports nearly all premium features like TOTP (time-based one-time passwords) and file attachments without requiring a paid subscription.

Vaultwarden vs Bitwarden: What’s the Difference for a Self Hosted Password Manager?

The core difference is where the server runs. With Bitwarden’s official cloud service, your encrypted vault lives on Bitwarden’s servers. With Vaultwarden, your vault lives on your NAS. Both use the same client apps and the same zero-knowledge encryption — Bitwarden cannot read your vault data, and Vaultwarden cannot read it either. The encryption happens on your device before anything is sent to the server.

For most homelab users, Vaultwarden makes sense if you already maintain a NAS, want to avoid recurring costs, and are comfortable handling your own backups and security. If you don’t want to manage a server, the $10/year Bitwarden premium is still excellent value.

Is Vaultwarden Safe? Security Considerations Before You Deploy

Vaultwarden uses the same encryption standard as Bitwarden: AES-256-CBC with PBKDF2 SHA-256 (or Argon2id for newer clients). Your master password never leaves your device unhashed. The server only stores encrypted blobs — even if someone gains access to your NAS, they cannot read your passwords without your master password.

Vaultwarden itself is open-source and audited by the community. The project publishes Docker images with signed checksums. However, no self-hosted solution is safer than the person maintaining it — you must update the container regularly, apply NAS security patches, and follow backup best practices.

Prerequisites: What You Need Before Installing Vaultwarden

• A NAS or server running Docker (TrueNAS SCALE, Unraid, OMV, or a Linux host)
• Docker Compose installed (included on most modern NAS OSes)
• A persistent storage volume for the vault database (at least 1GB)
• A reverse proxy (Nginx Proxy Manager, Traefik, or Caddy) for HTTPS
• A domain name or DuckDNS address if accessing outside your LAN
• Port 443 (HTTPS) forwarded to your reverse proxy (if exposing externally)

Step-by-Step Vaultwarden Setup Guide with Docker Compose

This guide is NAS-OS agnostic — it uses generic Docker Compose that works on TrueNAS SCALE, Unraid, OMV, or any Linux host. The steps assume you have Docker and Docker Compose installed.

version: '3'
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./data:/data
    environment:
      - SIGNUPS_ALLOWED=false
      - DOMAIN=https://vault.yourdomain.com
    ports:
      - "8080:80"

Why HTTPS and a Reverse Proxy Are Non-Negotiable

Vaultwarden communicates with client apps over WebSockets for real-time sync. WebSockets require TLS (HTTPS) to work in most browsers and mobile apps. Without HTTPS, browser extensions will refuse to connect, and mobile apps will throw security errors. Even if you only access Vaultwarden on your local network, modern browsers enforce HTTPS for service workers and WebSocket connections.

If you don’t have a domain, use a free DuckDNS subdomain and a Let’s Encrypt certificate via your reverse proxy. For LAN-only access, you can use a self-signed certificate, but you’ll need to install it on every client device — a hassle that makes a DuckDNS setup simpler for most users.

Backup Strategy for Your Vaultwarden Database

This is the one self-hosted app where backup failure is catastrophic. Lose your Vaultwarden database, and you lose every password, every TOTP seed, every secure note — with no recovery option. Bitwarden’s zero-knowledge encryption means there is no “forgot my password” reset. The vault database is in a single file: /data/db.sqlite3 (inside the container, mapped to your host volume).

• Back up the entire /docker/vaultwarden/data/ directory daily
• Use a script that stops the container, copies the database, and restarts it (SQLite can corrupt if backed up while in use)
• Store backups on a separate NAS or cloud location — not the same drives as the Vaultwarden container
• Test a restore at least once: delete the container, copy the backup, and verify you can log in

Vaultwarden also supports an ADMIN_TOKEN environment variable that enables a web-based admin panel. From there, you can export your vault as a JSON file — but this export is unencrypted, so store it securely. Regular database file backups are more reliable than exports.

Setting Up Client Apps: Browser Extensions and Mobile

Once Vaultwarden is running behind HTTPS, client setup is straightforward. All official Bitwarden clients support custom server URLs.

Which Should You Choose: Vaultwarden or Bitwarden Cloud?

Pick Vaultwarden if you already run a NAS with Docker, want premium features for free, and are willing to maintain your own backups and HTTPS setup. It’s ideal for homelab users who value data sovereignty and have the technical comfort to troubleshoot a container occasionally.

Pick Bitwarden Cloud if you want zero maintenance, don’t want to manage a reverse proxy, or need guaranteed uptime. The $10/year premium is a fair trade for not having to think about server updates or database corruption.