Tooling

Self-hosted password managers: full control of your vault

• VersionDude
• Tooling
• 6 min read

Running your own password manager puts you in charge of where secrets live — here is how the main options compare, and when a managed service makes more sense.

Self-hosting a password manager means the encrypted vault lives on infrastructure you control rather than on a vendor's cloud. For developers and privacy-conscious users that can be deeply appealing: no third party holds your data, you set your own backup and access policy, and you are not dependent on a company's continued existence or pricing decisions. It is the most literal interpretation of owning your own security.

Vaultwarden is the most popular route into self-hosting. It is a lightweight, compatible reimplementation of the Bitwarden server, written to run comfortably in a single container on a small VPS or a home server. Crucially, it works with the official Bitwarden client applications, so you keep a polished, well-maintained user experience on every device while owning the backend that stores the data. That combination is why it has become the default recommendation for self-hosters.

Running Vaultwarden well still means doing the unglamorous parts properly. You should put it behind HTTPS rather than exposing it in plain text, keep the container image updated as new releases land, and restrict access — many people only reach it over a private network or VPN rather than the open internet. None of this is exotic, but each step is a place where a careless setup can quietly weaken the protection you set out to gain.

• Vaultwarden — lightweight self-hosted server, compatible with official Bitwarden apps
• KeePassXC — encrypted file you sync yourself, no server to maintain
• Proton Pass — managed, end-to-end encrypted alternative with no operational burden
• Whatever you run: automated, tested, off-site backups are non-negotiable

KeePassXC represents the simplest possible form of self-hosting, to the point where it barely involves a server at all. The vault is just an encrypted file. You sync it with whatever storage you already trust — your own file server, an encrypted drive, or a private repository — and there is no service to keep patched or online. For a single user who values minimalism, this can be the most robust option precisely because it has so few moving parts.

The trade-off with the file-based approach is synchronisation and conflict handling. If you edit the vault on two devices before they sync, you can end up with divergent copies that must be reconciled. Tools and plug-ins exist to smooth this, but it is a manual discipline rather than the automatic, conflict-resolving sync a hosted service provides. For some that simplicity is a feature; for others it is friction they would rather not manage.

Self-hosting is therefore not free of cost, even when no money changes hands. You become responsible for uptime, updates, and especially backups. If you lose the file or the server without a backup, the data is simply gone — there is no support line to recover it for you. Anyone going down this path should set up automated, tested, off-site backups before they trust the system with anything important.

Security responsibility also shifts onto you in subtler ways. A self-hosted server is only as safe as the host it runs on, the network it sits behind, and the discipline with which you apply updates. A neglected, internet-exposed instance can be more dangerous than a reputable managed service, because the protections a professional team would maintain are now yours to remember. Self-hosting rewards the diligent and punishes the distracted.

If that responsibility sounds heavier than you want, a managed end-to-end encrypted service such as Proton Pass gives you most of the privacy benefits without the operational burden. Your secrets are encrypted on your device before they ever leave it, so the provider cannot read them, yet sync, backups and updates are handled for you. It is a pragmatic middle ground for people who want privacy but not a second job as a sysadmin.

The honest conclusion is that self-hosting is excellent for those who genuinely enjoy and maintain the infrastructure, and a liability for those who set it up once and forget it. Be honest with yourself about which group you are in. Whether you run Vaultwarden, sync a KeePassXC file, or let Proton Pass handle the plumbing, the goal is the same: encrypted credentials that you can rely on being there when you need them.