Reusing passwords across multiple online accounts is the number one cause of digital account compromise. While cloud-hosted commercial password managers exist, trusting third-party proprietary corporations with your digital master keys creates a central point of vulnerability. Bitwarden is the gold standard for open-source, zero-knowledge encrypted password management.

Vaultwarden is an alternative implementation of the Bitwarden server written in Rust. While the official Bitwarden server is an enterprise suite requiring multiple gigabytes of RAM and heavy Microsoft SQL Server instances, Vaultwarden is lightweight, blazing fast, and requires only 30 to 50 MB of RAM—making it the ideal self-hosted password manager for Raspberry Pi!

This guide covers deploying Vaultwarden via Docker Compose, fulfilling the mandatory HTTPS security requirement, generating an Argon2-hashed admin token, automating encrypted SQLite database backups, configuring browser extensions and mobile clients, and monitoring the service with Open Pi.

Why Vaultwarden on Raspberry Pi?

  • Zero-Knowledge Encryption: All vault items (logins, credit cards, secure notes, 2FA TOTP seeds) are encrypted client-side with AES-256 and PBKDF2/Argon2id before leaving your device. Even if an attacker gained physical access to the Raspberry Pi, they cannot read your credentials without your master password.
  • 100% Bitwarden Client Compatibility: Vaultwarden works out of the box with the official Bitwarden browser extensions (Chrome, Firefox, Safari, Edge), desktop applications (macOS, Windows, Linux), and mobile apps (iOS, Android).
  • Free Premium Features: Includes self-hosted TOTP authenticator generation, emergency access, and encrypted file attachments without paid subscriptions.

Prerequisites and the Mandatory HTTPS Requirement

Modern web browsers implement strict security policies: the Web Crypto API (used to encrypt and decrypt your passwords) is disabled on unencrypted HTTP connections.

To use Vaultwarden: 1. You must access Vaultwarden over HTTPS with a valid SSL/TLS certificate. 2. The simplest and most secure way to provide HTTPS on a Raspberry Pi is placing Vaultwarden behind Nginx Proxy Manager with a free Let's Encrypt certificate, or accessing it over a private Tailscale network with MagicDNS SSL enabled.

Deploy Vaultwarden with Docker Compose

Create a dedicated project directory:

BASH
mkdir -p "$HOME/vaultwarden/vw-data"
cd "$HOME/vaultwarden"

Generate a secure admin token

Vaultwarden provides a web-based /admin dashboard to manage users and system settings. Protect this dashboard by generating an Argon2-hashed token:

BASH
ADMIN_RAW_PASS=$(openssl rand -base64 32)
echo "Your unhashed password is: $ADMIN_RAW_PASS"

Create a compose.yaml file:

YAML
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      - WEBSOCKET_ENABLED=true # Enables real-time sync across devices
      - SIGNUPS_ALLOWED=true    # Set to false after creating your account
      - INVITATIONS_ALLOWED=false
      - ADMIN_TOKEN=your_secure_admin_passphrase
    volumes:
      - ./vw-data:/data
    ports:
      - "8080:80"

Launch the container in the background:

BASH
docker compose up -d
docker compose logs -f

Configure HTTPS Reverse Proxy with Nginx Proxy Manager

Route your domain (for example, vault.yourdomain.com) to Vaultwarden: 1. In Nginx Proxy Manager, click Add Proxy Host. 2. Set Domain Name to vault.yourdomain.com. 3. Set Forward Hostname to your Raspberry Pi IP, and Forward Port to 8080. 4. Enable Websockets Support (vital for instant password synchronization across open browser tabs). 5. In the SSL tab, request a new Let's Encrypt certificate and enable Force SSL and HTTP/2 Support. 6. Click Save.

Open https://vault.yourdomain.com in your browser. You will see the clean Bitwarden web vault interface with a valid SSL padlock.

Account Creation and Security Hardening

  1. Click Create Account. Enter your email, your name, and choose a strong, unique master password.
  2. Immediately enable Two-Step Login in Account Settings -> Security -> Two-Step Login using a hardware security key (YubiKey) or an authenticator app.
  3. Once your account is created, edit compose.yaml and set SIGNUPS_ALLOWED=false:
BASH
nano compose.yaml
docker compose up -d

Disabling signups prevents unauthorized internet users from creating accounts on your private instance.

Connecting Bitwarden Clients

Browser Extensions & Desktop Apps:

  1. Install the official Bitwarden extension from the Chrome Web Store or Firefox Add-ons.
  2. Before logging in, click the Settings gear icon (⚙) in the top-left corner.
  3. In the Server URL field, enter your self-hosted address: https://vault.yourdomain.com.
  4. Log in with your master credentials.

Mobile Apps (iOS & Android):

  1. Install Bitwarden from the App Store or Google Play Store.
  2. Tap the settings gear icon on the login screen.
  3. Set the Server URL to https://vault.yourdomain.com.
  4. Enable Face ID / Biometric unlock and Auto-fill credentials in system settings.

Automated Encrypted Database Backups

Vaultwarden stores encrypted credentials inside an SQLite database at ./vw-data/db.sqlite3. Never back up a live SQLite database by copying the file directly, as writes in progress can corrupt the copy.

Use SQLite's native .backup command to produce atomic, clean backup snapshots:

BASH
mkdir -p "$HOME/vaultwarden/backups"
sqlite3 "$HOME/vaultwarden/vw-data/db.sqlite3" ".backup '$HOME/vaultwarden/backups/backup-$(date +%F).sqlite3'"

Schedule this script to run daily via cron, and sync the resulting snapshots to an offsite encrypted cloud storage location.

Monitor Vaultwarden with Open Pi

Ensuring your password vault remains accessible and responsive across all devices is critical.

With Open Pi on your phone: - System Memory: Confirm that Vaultwarden operates within its lean 30–50 MB RAM footprint. - Service Uptime: Check container uptime and verify that ports 8080 and 443 remain responsive. - Host Security: Keep track of operating system security updates to protect your self-hosted infrastructure.

Troubleshooting Vaultwarden

  • Web Crypto API Not Supported Error: You are attempting to access Vaultwarden over unencrypted http://. You must use https:// with a valid SSL certificate.
  • Passwords Not Syncing Instantly: Ensure WebSocket support is enabled in both compose.yaml (WEBSOCKET_ENABLED=true) and your reverse proxy host configuration.
  • Forgot Master Password: Because Bitwarden uses zero-knowledge encryption, there is no password reset mechanism. If you forget your master password, your encrypted data cannot be recovered. Always store an emergency recovery sheet in a physical, fireproof safe.

Sources and further reading

Open Pi logo
Monitor your Raspberry Pi from your phone

Check real-time CPU, RAM, temperature, and service health for your home server projects with Open Pi for iOS and Android. Local-first, private, and no cloud account required.

Explore Open Pi App StoreGoogle Play
About this guide

Researched and validated against official project documentation and community standards on September 11, 2026. Review your board model, storage, and current release notes before deploying.