Vaultwarden lets you run your own password manager server while keeping the polished Bitwarden apps you may already know. It reimplements the Bitwarden server API in Rust as a lighter alternative to the official, resource-heavy server, and the official Bitwarden mobile apps, desktop apps and browser extensions connect to it as if it were Bitwarden's own service. A modified Bitwarden web vault comes bundled in the container.
Almost everything is there: personal vaults, Send, attachments, website icons, organisations with collections, sharing, member roles, groups, event logs and policies, plus two-factor login with authenticator apps, email, FIDO2 WebAuthn, YubiKey or Duo, and emergency access. There is an admin page for running the server.
It was called bitwarden_rs until 2021 and is AGPL-3.0 licensed, with about 70,000 stars and 221 contributors. Version 1.37.5 came out on 1 November 2026. It is not associated with Bitwarden, Inc., though the README notes one active maintainer works there and contributes on their own time.
- Repository: github.com/dani-garcia/vaultwarden
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: Rust. Stars: 70.5K. Forks: 3,437. Last push: Nov 4, 2026.
- Scan: safe, Nov 10, 2026, commit 17b159b
Who it is for
Self-hosters who want one password vault for the family or a small team without per-user fees, and Bitwarden users who would rather keep the server under their own roof.
Getting started
1. Pull the container image
docker pull vaultwarden/server:latest2. Run it, keeping data in /vw-data and listening only on this machine
docker run --detach --name vaultwarden --env DOMAIN="https://vw.domain.tld" --volume /vw-data/:/data/ --restart unless-stopped --publish 127.0.0.1:8000:80 vaultwarden/server:latest3. Put it behind a reverse proxy with HTTPS, then point the Bitwarden apps at your domain
https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examplesThe web vault only works over HTTPS, so plan for a domain and a certificate. This is your password vault: keep the server updated and back up /vw-data regularly. The README says the project cannot be held liable for data loss.
Safety scan
We cloned dani-garcia/vaultwarden at commit 17b159b on Nov 10, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits, no pattern hits and no committed binaries across 580 files and about 79,000 lines, mostly Rust.
- 105 advisories, but most are not in the server. The 1 critical (proxy-addr) and 27 of the 30 high are in playwright/package-lock.json, the end-to-end browser tests, which are not part of what you run.
- The server's Cargo.lock has 3 high, 3 moderate, 2 low and 4 unrated. All 3 high are Vaultwarden's own past advisories, listed only because the code's internal version number is a fixed 1.0.0. GitHub's advisory records show them fixed in 1.32.5 and 1.35.4, and the current release is 1.37.5. Update when new releases come out; a password server is worth keeping current.
- build.rs only sets which databases to build for and reads the version from git. docker/start.sh is a 30-line container start script. Neither downloads anything.
- The hosts fit the features: bitwarden.com, Have I Been Pwned, Duo, the 2fa.directory icon list and email alias services such as SimpleLogin and addy.io. We found no analytics service.
- 8 workflows, none using pull_request_target, and all 16 third-party actions are pinned to commits. A security policy and CodeQL are present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 Cargo build script. 2 installer scripts |
| Committed binaries | None. |
| CI workflows | 8 workflows. None use pull_request_target. 0 of 16 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, bitwarden.com, datatables.net, haveibeenpwned.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 105 advisories across 856 pinned packages: 1 critical, 30 high, 55 moderate, 15 low, 4 unrated. Cargo.lock: 656 packages, 12 advisories; playwright/package-lock.json: 225 packages, 93 advisories. |
| Project hygiene | Has security policy, CodeQL, licence file. Missing automated dependency updates, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (2)
- docker/start.sh, 30 lines
- playwright/compose/keycloak/setup.sh, 45 lines; talks to wjw465150.gitbooks.io
Worst known vulnerabilities (24 of 105)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-jqcg-44mw-7w3h | critical | proxy-addr@2.0.7 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| GHSA-h4hq-rgvh-wh27 | high | vaultwarden@1.0.0 | Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role |
| GHSA-r32r-j5jq-3w4m | high | vaultwarden@1.0.0 | Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager |
| GHSA-x7m9-mv49-fv73 | high | vaultwarden@1.0.0 | Vaultwarden vulnerable to user impersonation |
| GHSA-27r3-jxmh-p828 | high | body-parser@2.2.2 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body |
| GHSA-vc2v-76pw-4v95 | high | compression@1.8.1 | compression vulnerable to Denial of Service via memory leak on premature response close |
| GHSA-mrv2-3pqr-j5jr | high | dompurify@3.4.1 | DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete… |
| GHSA-2gc4-cqfq-p2gv | high | engine.io@6.6.8 | Socket.IO: Engine.IO Protocol Revision Mismatch DoS |
| GHSA-22p9-wv53-3rq4 | high | linkify-it@5.0.0 | LinkifyIt#match scan loop has quadratic algorithmic complexity |
| GHSA-v245-v573-v5vm | high | linkify-it@5.0.0 | linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text |
| GHSA-2x7j-588g-ccc2 | high | nodemailer@8.0.5 | Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address lis… |
| GHSA-p6gq-j5cr-w38f | high | nodemailer@8.0.5 | Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-… |
| GHSA-r7g4-qg5f-qqm2 | high | nodemailer@8.0.5 | Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception |
| GHSA-v53p-9fqp-m79j | high | nodemailer@8.0.5 | Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service |
| GHSA-2x7j-588g-ccc2 | high | nodemailer@8.0.7 | Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address lis… |
| GHSA-p6gq-j5cr-w38f | high | nodemailer@8.0.7 | Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-… |
| GHSA-r7g4-qg5f-qqm2 | high | nodemailer@8.0.7 | Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception |
| GHSA-v53p-9fqp-m79j | high | nodemailer@8.0.7 | Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service |
| GHSA-2m8v-j782-fhvr | high | socket.io-parser@4.2.6 | Socket.IO: Zero-attachment Memory Exhaustion |
| GHSA-68fv-2mgg-jv7q | high | source-map-js@1.2.1 | source-map-js allows event-loop denial of service through indexed source-map section offsets |
| GHSA-2m5v-pch6-74hx | high | undici@7.25.0 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
| GHSA-4cwx-7wf7-3272 | high | undici@7.25.0 | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
| GHSA-4w7w-5xrc-9h26 | high | undici@7.25.0 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
| GHSA-hm92-r4w5-c3mj | high | undici@7.25.0 | undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
By the numbers
| Stars | 70.5K |
|---|---|
| Forks | 3,437 |
| Contributors | 221 |
| Commits | 3,148 |
| Open issues | 15 |
| Open pull requests | 77 |
| Releases | 89 |
| Latest release | 1.37.5 |
| Licence | AGPL-3.0 |
| Main language | Rust |
| Project age | 8 years |
| Last push | Nov 4, 2026 |
| Tracked files | 580 |
| Lines of code | 79.1K |
| Checkout size | 3 MB |
Lines by language: Rust 36.2K, JavaScript 22.1K, CSS 12.8K, SQL 2,134, TypeScript 2,093, YAML 1,286.
Questions
Is Vaultwarden free?
Yes. Vaultwarden is free and open source under AGPL-3.0. You pay only for your own server.
Is Vaultwarden the same as Bitwarden?
No. It is an unofficial, independent server that speaks the same API, so the official Bitwarden apps work with it. For help, use Vaultwarden's own channels, not Bitwarden support. We list Bitwarden's hosted service in our directory at /bitwarden/.
Is it safe to host my own passwords?
It can be, if you look after it: HTTPS, regular updates, backups and a strong admin token. If you do not want that job, a hosted manager is the safer choice.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.