Install Vaultwarden on Raspberry Pi: Self-Hosted Password Management

Keeping dozens of passwords in your memory is an invitation to reuse weak credentials. Storing them in a cloud provider means trusting a third party with the keys to your digital life. Vaultwarden is a lightweight, self-hosted implementation of the Bitwarden server API written in Rust. On a Raspberry Pi, it uses almost no resources and provides a fully private password manager for your phone, browser, and laptop.

The safest way to start is on your local network behind a secure reverse proxy. Bitwarden mobile apps and browser extensions require a secure HTTPS connection by design to handle cryptography and master passwords safely.

Understand the hardware and security requirements

Vaultwarden is exceptionally light. It runs smoothly on a Raspberry Pi 3, 4, 5, or even a Zero 2 W with a 64-bit OS. You need Docker Engine and the Docker Compose plugin installed.

Because this container stores encrypted vault secrets, storage reliability and automated backups are non-negotiable. Use a dependable microSD card or USB SSD. Never expose an unprotected Vaultwarden instance directly to the public internet without HTTPS encryption and disable new signups after creating your primary account.

Deploy Vaultwarden with Docker Compose

Create a dedicated directory for the project and a compose.yaml file to define the service and its persistent storage volume:

mkdir -p "$HOME/vaultwarden"
cd "$HOME/vaultwarden"
nano compose.yaml

Paste the following Docker Compose configuration. It maps port 8080 on your Raspberry Pi to the container and stores the SQLite database in a persistent named volume:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      - SIGNUPS_ALLOWED=true
      - WEBSOCKET_ENABLED=true
    volumes:
      - vaultwarden-data:/data
    ports:
      - "8080:80"

volumes:
  vaultwarden-data:

Validate and launch the container in the background:

sudo docker compose config
sudo docker compose up -d
sudo docker compose ps
sudo docker compose logs --tail=50

Verify that the container status shows healthy and running.

Set up secure HTTPS access

Modern web browsers and Bitwarden client extensions enforce Web Crypto APIs that will only execute over a secure context (https:// or localhost). If you attempt to connect over plain http://PI_ADDRESS:8080, account registration and login will fail in your browser.

To resolve this securely on your home network: 1. Combine Vaultwarden with Tailscale to access your Pi over encrypted WireGuard tunnels and use Tailscale Serve for automated HTTPS certificates. 2. Alternatively, place Vaultwarden behind a local reverse proxy like Nginx Proxy Manager with a valid domain and Let's Encrypt certificate.

Once your HTTPS connection is configured, open your Vaultwarden URL, create your master account, and set an exceptionally strong, memorable master passphrase.

Lock down registration and generate an admin token

After registering your personal account, disable open user registrations so outside visitors cannot register accounts on your server. Generate a secure random authentication token for the administration dashboard:

openssl rand -base64 32

Edit your compose.yaml file to set SIGNUPS_ALLOWED=false and supply the hashed admin token. Then recreate the container:

sudo docker compose down
nano compose.yaml
sudo docker compose up -d

Your server will now reject public account creations while allowing your registered devices to sync freely.

Connect your browser and mobile devices

Install the official Bitwarden application on iOS, Android, macOS, Windows, or your preferred web browser: 1. Open the Bitwarden app and select the gear icon or Self-hosted environment before entering your credentials. 2. In the Server URL field, enter your Vaultwarden HTTPS address (for example, https://vault.yourdomain.com). 3. Log in with your master email and passphrase. 4. Enable biometric unlock (Face ID, Touch ID, or fingerprint) for fast day-to-day access without retyping your master password.

Test creating a new login item on your mobile phone, and confirm that it immediately syncs and appears in your browser extension on your computer.

Establish automated backups

Vaultwarden stores its encrypted credentials in a SQLite database inside /data/db.sqlite3. A server failure or corrupt drive should never cost you your passwords.

To create a safe backup, copy the database while it is consistent, or run an automated SQLite backup script:

sudo docker compose exec vaultwarden sqlite3 /data/db.sqlite3 ".backup '/data/backup.sqlite3'"
sudo cp /var/lib/docker/volumes/vaultwarden_vaultwarden-data/_data/backup.sqlite3 "$HOME/vault-backup-$(date +%Y%m%d).sqlite3"

Sync that backup file to an external drive or off-site encrypted storage regularly. You can also export an unencrypted or encrypted JSON vault export directly from the web vault interface before running major system updates.

Sources and further reading

• Vaultwarden GitHub Repository
• Vaultwarden Official Documentation Wiki
• Bitwarden Official Client Apps

Monitor your Raspberry Pi from your phone

Check real-time CPU, RAM, temperature, and service health for your home server projects with Open Pi for iOS and Android. Local-first, private, and no cloud account required.

Explore Open Pi ↗App StoreGoogle Play