Vaultwarden Advanced Setup 2026

Vaultwarden is an alternative Bitwarden-compatible server implementation, not a drop-in security guarantee. A defensible deployment pins an exact release and image digest, limits exposure, verifies client and feature compatibility, protects administrative access, and proves backup restoration. Use this guide as a review checklist, then confirm every setting against the pinned release documentation before production.

TL;DR verdict

Use Vaultwarden only when the threat model, exact client tests, security review, operator capacity, support plan, and restore drill justify self-hosting a credential system. Pin release 1.37.2 only after a same-day recheck, pin the container by digest, and treat every configuration variable or integration as release-specific until tested.

Key takeaways

The exact dani-garcia/vaultwarden repository reports AGPL-3.0 and was not archived at the access-time check.
Release 1.37.2 was the latest non-draft, non-prerelease GitHub release when checked on 2026-08-25; recheck before deployment.
Compatibility with clients, organizations, two-factor methods, push relay, imports, metrics, APIs, and migration tooling requires exact-release tests.
Self-hosting cost includes infrastructure, backups, labor, support, and incident response; do not infer savings from seat prices alone.

At-a-glance decision table

Stage	Verify	Why it matters
Release identity	Version, release notes, image digest, rollback image	Prevents an unreviewed moving target
Exposure	TLS, reverse proxy, admin path, network controls, rate limits	Reduces public attack surface
Access controls	Invitations, organizations, roles, collections, 2FA	Tests actual authorization behavior
Recovery	Database, attachments, keys, offsite copy, restore drill	Proves the service can be recovered
Operations	Monitoring, alerts, update owner, incident runbook	Makes ongoing ownership explicit

Source-backed evidence

Pricing or plan

Bitwarden and 1Password publish current business pricing with product- and billing-specific terms. Any comparison with Vaultwarden needs same-day named plans and the complete self-hosting cost: infrastructure, backups, labor, support, and incident response.

Use a same-day named plan and a complete self-hosting cost before making any cost comparison.

Plan or rate limits

Vaultwarden login and admin rate limits, event retention, invitation controls, and provider quotas are release-specific configuration. Verify and test each value against the pinned release before production.

A configuration value is safe only after it matches the pinned release documentation and passes a deployment-specific test.

Downloads stars forks

At access time, dani-garcia/vaultwarden reported 66,224 stars and 3,150 forks with archived=false. These repository counters do not measure users, deployments, security maturity, support, or product fit.

The 66,224 stars and 3,150 forks are dated repository counters, not users or security evidence.

Ratings reviews enrollment

The selected first-party sources contain no normalized ratings, review, customer, or satisfaction dataset for Vaultwarden, Bitwarden, and 1Password.

There is no normalized first-party ratings dataset for Vaultwarden, Bitwarden, and 1Password.

Release version status

Vaultwarden's latest official GitHub release when checked on 2026-08-25 was 1.37.2, published 2026-08-22T12:29:13Z with draft=false and prerelease=false. Recheck it, review the notes, and pin an exact image digest before deployment rather than following a mutable tag.

Before deploying 1.37.2, confirm it is still current, review its notes, and resolve the container to an immutable image digest.

License

The exact dani-garcia/vaultwarden repository reports AGPL-3.0. That license applies to the checked artifact and revision; it does not license Bitwarden cloud services, guarantee compatibility, or prove feature coverage.

AGPL-3.0 is bound to the exact repository scope, not cloud services or feature parity.

Compatibility integrations

Vaultwarden describes itself as an alternative Bitwarden-compatible server implementation. Each client, organization role, 2FA method, push relay, import format, PostgreSQL migration, API, metrics path, and Secrets Manager behavior needs exact-release compatibility testing.

Treat Vaultwarden as an alternative implementation; verify the exact release and test compatibility for every required client and integration.

Product capabilities

The current Vaultwarden README and wiki, together with Bitwarden documentation, support a set of release-scoped capabilities. Database migration, organization events, 2FA enforcement, admin APIs, metrics, emergency access, push notifications, and Secrets Manager each need separate verification in current docs.

Treat each operational feature as release-scoped and verify it in current documentation before enabling it.

Performance benchmarks

The selected first-party sources contain no reproducible performance or cost comparison for database speed, capacity, reliability, migration, or savings.

There is no reproducible performance or cost receipt for database, capacity, reliability, or savings claims.

Ranking popularity superlative

Selection is conditional on the threat model, client tests, security review, operator capacity, backup and restore drill, support, and full cost.

Use conditional selection based on the threat model and a completed restore drill.

Labor outcomes

The selected first-party sources contain no career or salary dataset and no hiring, breach-frequency, or labor-outcome data.

There is no first-party career or salary dataset in the selected sources.

Availability or provider status

Selected Vaultwarden, Bitwarden, and 1Password sources were reachable on 2026-08-25. The Vaultwarden repository reported archived=false and release 1.37.2 was current. This point-in-time evidence is not an uptime, security, support, compatibility, or maintenance guarantee.

The 2026-08-25 point-in-time check found the repository unarchived and release 1.37.2 current; it is not an uptime or maintenance guarantee.

Decision framework

Start with the credential threat model and the clients, organization features, recovery methods, and integrations that must work. Choose Vaultwarden only if the team can pin and review releases, limit public exposure, test authorization behavior, operate monitoring and incident response, and prove an offsite restore. Compare that burden and support model with the current named Bitwarden and 1Password plans rather than relying on seat-price arithmetic alone.

Migration risk and checklist

Export from the current password manager using its documented format, inventory attachments and organization data separately, and test import into an isolated Vaultwarden instance. Connect each required client to the pinned build and verify login, unlock, sync, attachments, collections, sharing, two-factor authentication, and recovery. Run a backup and restore drill before inviting production users. Keep the old service read-only until the verification window closes.

Methodology

This checklist uses Vaultwarden's repository, release record, README, and wiki together with Bitwarden's hosting, import, push-relay, and business-pricing pages and 1Password's business-pricing page, all captured on 2026-08-25. It keeps repository identity, release configuration, hosted-service pricing, and operator responsibility separate. The sources do not establish universal performance, reliability, security, or savings outcomes; verify the pinned release and current service terms during deployment review.

Source notes

Bitwarden business pricing — hosted-plan evidence, accessed 2026-08-25
Bitwarden hosting FAQs — self-hosting responsibility evidence, accessed 2026-08-25
Bitwarden import documentation — migration evidence, accessed 2026-08-25
Bitwarden push-relay documentation — integration evidence, accessed 2026-08-25
1Password business pricing — hosted-plan comparison evidence, accessed 2026-08-25
Vaultwarden README — compatibility and capability scope, accessed 2026-08-25
Vaultwarden latest release — release identity, accessed 2026-08-25
Vaultwarden repository metadata — license, status, and counters, accessed 2026-08-25
Vaultwarden wiki — release-scoped configuration evidence, accessed 2026-08-25