SMF·BITWARDEN
Can a prompt replace Bitwarden?
Security & passwords — password manager
Exhibit tracking slip
Verdict
Because Bitwarden's server is itself open source, this is a real yes: deploy the compatible vaultwarden server on a small VPS behind HTTPS, and the official Bitwarden apps and browser extensions — autofill, passkeys and all — work against your own server instead of theirs. What you take on is the operational side: patching, uptime, and backups.
Exhibit A — The prompt
Received on30.07.2026Do not write a password manager — deploy the existing open-source one. Run vaultwarden (the Bitwarden-compatible server) on a small VPS via Docker Compose, with its data directory on a persistent volume, behind a reverse proxy that handles HTTPS automatically (Caddy is the simplest option). The official Bitwarden apps, browser extensions, and mobile clients need HTTPS to work at all, so this step isn't optional. Once your one account is registered, lock signups down (vaultwarden has an environment variable for exactly this) so the server never accepts a second account. Point the official Bitwarden apps and extensions at your server's URL instead of bitwarden.com — autofill, passkeys, and the rest keep working exactly as before. Set up a nightly backup job that archives the data directory, encrypts the archive, and copies it off the VPS; actually run a restore from that backup once before trusting it. Bitwarden's own export/import flow moves an existing vault in.
Do not attempt to build password-manager software yourself, and do not skip HTTPS to save time — a vault without it is worse than the subscription you're replacing. In the README, be honest that the clients cache the vault locally, so a dead server locks you out of nothing immediately, but you now own every future security update yourself.Opening prefills the prompt — press enter to run it.
Exhibit B — What you lose
- B.1 managed hosting and uptime
- B.2 premium support if something breaks
- B.3 emergency access for someone else to reach your vault
- B.4 someone else owning the security-patching schedule
Prior art
Exhibit C — Why people still pay: security/trust/hosting
A professionally maintained security service is cheap next to the cost of a mistake — most people pay to make patching and uptime someone else's job, not because the software is hard to run.
Questions
Can I import my existing Bitwarden vault?
Yes, directly — Bitwarden's own export/import feature works against your self-hosted server exactly as it does against bitwarden.com, since vaultwarden speaks the same protocol.
Will it work on my phone?
Yes — the official Bitwarden mobile apps and browser extensions work unchanged, you just point them at your own server's URL instead of the default one.
What does it cost to run?
A small VPS, typically a few dollars a month, plus a domain if you don't already have one. Premium itself is priced low enough that self-hosting often costs more in pure dollars — this one is worth doing for control and curiosity, not to save money.
What's the one thing that doesn't survive the rebuild?
Someone else owning the operational risk. If vaultwarden has a security vulnerability, applying the patch is now your job on your own timeline — Bitwarden's hosted service patches itself before most self-hosters even hear about it.
Related tools
Receipt