Self-Hosting Vaultwarden on a Raspberry Pi: A Secure Password Manager for Your Home Network

Password manager subscriptions add up, and handing every credential you own to a third-party cloud service is a trust decision a lot of makers would rather not make when the alternative is a $10 Raspberry Pi sitting in a closet. Vaultwarden is a lightweight, unofficial server implementation of the Bitwarden API written in Rust — it's a fraction of the resource footprint of running Bitwarden's official server stack, runs comfortably on a Raspberry Pi Zero 2 W or any Pi 3/4/5, and is fully compatible with the official Bitwarden apps and browser extensions on every platform. This project walks through building a dedicated, always-on Vaultwarden appliance: a small headless Pi with persistent storage, HTTPS access from outside your home network, and automated backups, so your vault is both private and actually reliable.

Why a Dedicated Pi Instead of a Docker Container on an Existing Server

You can absolutely run Vaultwarden alongside other self-hosted services on a home server, and many people do. Building it as its own small appliance has real advantages for something as sensitive as a password vault: it isolates your credential store from whatever else you're experimenting with (media servers, home automation, network monitoring), it can run on the cheapest hardware in your fleet since Vaultwarden's resource needs are minimal, and if you ever need to take a more experimental service down for maintenance or a rebuild, your passwords stay available. Treat this Pi as boring, stable, and rarely touched once it's running.

Setting Up the Pi

1. Flash Raspberry Pi OS Lite (64-bit) to the microSD card or SSD using Raspberry Pi Imager, enabling SSH and configuring WiFi/hostname in the imager's advanced options so the Pi boots headless.
2. Boot the Pi, SSH in, and run sudo apt update && sudo apt full-upgrade -y to get current patches before exposing anything to the internet.
3. Give the Pi a static IP or a DHCP reservation on your router so its address never changes — you'll be pointing a reverse proxy and possibly port forwarding at it.
4. Install Docker and Docker Compose: curl -fsSL https://get.docker.com | sh, then add your user to the docker group with sudo usermod -aG docker $USER and log back in.

Deploying Vaultwarden with Docker Compose

Create a project directory and a docker-compose.yml:

mkdir -p ~/vaultwarden/data && cd ~/vaultwarden services: vaultwarden: image: vaultwarden/server:latest container_name: vaultwarden restart: unless-stopped environment: - WEBSOCKET_ENABLED=true - SIGNUPS_ALLOWED=false - ADMIN_TOKEN=your-long-random-admin-token-here - DOMAIN=https://vault.yourdomain.com volumes: - ./data:/data ports: - "8080:80"

Two settings deserve special attention. Set SIGNUPS_ALLOWED=false after you've created your own account — leaving signups open on an internet-reachable instance means anyone who finds it can register a vault. Generate a genuinely random ADMIN_TOKEN (a 48+ character random string) since it protects the /admin panel where invitations and server settings are managed; a weak or default token here is the single biggest self-inflicted vulnerability in a Vaultwarden setup. Bring it up with docker compose up -d and confirm it's running with docker compose logs -f.

Putting HTTPS in Front of It

Bitwarden clients refuse to connect to a vault server without valid HTTPS — this isn't optional. The simplest reliable approach for a home setup is Caddy as a reverse proxy, since it handles Let's Encrypt certificate issuance and renewal automatically:

vault.yourdomain.com { reverse_proxy localhost:8080 }

This requires a domain name (or subdomain) pointed at your home IP and port 443 forwarded to the Pi, or alternatively running everything behind a Tailscale or WireGuard VPN so the vault is never exposed to the open internet at all — the safer option if you don't need to hand out access to anyone outside your own devices. If you're already running a reverse proxy on another machine in your network (see this site's guide on setting up Nginx as a reverse proxy on Raspberry Pi), you can point it at the Vaultwarden Pi's internal IP instead of running Caddy locally.

Backups

A password vault with no backup is a single SD card failure away from locking you out of everything. The entire vault lives in the ./data directory as a SQLite database plus attachment files, which makes backup simple:

#!/bin/bash tar -czf /backup/vaultwarden-$(date +%F).tar.gz -C /home/pi/vaultwarden data # prune backups older than 30 days find /backup -name "vaultwarden-*.tar.gz" -mtime +30 -delete

Run this nightly via cron, and copy the resulting archive off the Pi itself — to a NAS, another Pi, or cloud storage — since a backup stored only on the same SD card doesn't protect you from the card failing. Encrypt the backup archive (e.g. with gpg) before it leaves the Pi, since it contains your entire encrypted vault database.

Client Setup

In the official Bitwarden apps and browser extensions, go to Settings and change the server URL from the default bitwarden.com to your self-hosted domain before logging in or creating an account. From there, Vaultwarden behaves identically to the official service — autofill, TOTP codes, secure notes, and organization/family sharing (with some enterprise-only features disabled) all work the same way.

Safety and Reliability Notes

• Enable two-factor authentication on your Vaultwarden account itself (TOTP is supported natively) — a password vault protected only by a master password is a single point of failure.
• Keep the Pi's OS and the Vaultwarden image patched; docker compose pull && docker compose up -d updates the container image, and periodic apt upgrade handles the host OS.
• If you expose this to the internet at all, put it behind a VPN (Tailscale is the easiest option for a home lab) rather than a bare port forward whenever you can, since it removes an entire class of exposure even with strong tokens in place.
• Don't skip the offsite backup step — a self-hosted vault trades cloud convenience for personal responsibility, and losing the only copy of your password database is a much worse outcome than a subscription fee.

Total hands-on time for this build is under an hour once the Pi is imaged, and the resulting appliance draws a few watts and needs essentially no maintenance beyond periodic updates. It's one of the highest-value small self-hosting projects for a maker shop that already has a Pi and a home network worth securing.