Self-Hosted Password Manager Alternatives
Leaving LastPass or 1Password doesn't have to mean running a server. Here are the realistic options, from "no server" to "your own vault on a VPS". Last checked: .
The short version
- Vaultwarden: a lightweight server compatible with the Bitwarden apps and browser extensions. Tiny footprint, the usual self-hosting pick.
- KeePassXC: a local encrypted file, no server at all. You sync the file yourself (Syncthing, for example).
- Official Bitwarden server: the vendor's own self-hosted version. Heavier, and aimed at organizations.
Side by side
| Vaultwarden | KeePassXC | Official Bitwarden server | |
|---|---|---|---|
| Needs a server | Yes, a very small one | No | Yes, a bigger one |
| Apps and browser extensions | The official Bitwarden clients | Desktop app, plus compatible mobile and browser apps | The official Bitwarden clients |
| Sync between devices | Built in | You arrange it | Built in |
| Memory use | Tiny | None on a server | Much higher; several services |
| Sharing with family or team | Yes, organizations supported | Awkward | Yes |
| Effort | About ten minutes | Low, but sync is on you | Highest |
Pick Vaultwarden if
You want the Bitwarden experience on your own server for family or yourself. It runs in about 50 MB of RAM, so it fits on any plan. The Vaultwarden setup guide covers HTTPS, turning off signups and the admin token, and the Compose generator includes it. Note that it's an independent project, not the vendor's, so read its docs before relying on it for a team.
Pick KeePassXC if
You'd rather have nothing to host and nothing exposed to the internet. The vault is a file you control. The trade-off is that syncing and mobile access are your problem, and sharing is clumsy.
The thing that matters most
A password manager is only as good as its backups and its access. Before you trust it:
- Make backups and test a restore (restic guide). A lost vault is worse than a leaked password.
- Keep the server up to date and behind HTTPS, with signups off.
- Keep the VPN-only option in mind: put it behind WireGuard so it isn't public at all. Compare your choices in WireGuard vs Tailscale vs Netbird.
If you don't have a server yet, this is a good first project. Start with the first 15 minutes checklist.