Best Self-Hosted Password Manager in 2026

Picking the best self hosted password manager in 2026 comes down to one question before anything else: do you actually need a server? If you are a single user or a small family, a server adds attack surface and maintenance overhead that may not pay off. If your answer is still yes, the field has consolidated around four real options — and the correct one depends almost entirely on your team size and tolerance for unofficial software.

Who This Is For (and Who Should Skip It)

Self-hosting a password manager makes sense when you have an existing always-on server already running Docker, a team with a genuine shared-secrets workflow, or a compliance reason to keep credentials off a vendor’s cloud. It does not make sense as a cost-saving measure — both Bitwarden and KeePassXC are free or near-free in their cloud or local forms, and the operational burden of a self-hosted vault is real.

If you are running a single NUC with no prior server experience, start with KeePassXC synced over Syncthing or Nextcloud. You get AES256 encryption, a 2023 third-party security audit, and zero server management. That covers the majority of solo and family use cases.

The Four Contenders

Vaultwarden — recommended for most homelab setups

Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. It runs in a single Docker container on under 50 MB of RAM, uses all official Bitwarden clients (browser extensions, iOS, Android, desktop), and unlocks premium Bitwarden features — organizations, advanced 2FA, Send — at no licensing cost. The release history on GitHub shows active development: 1.37.2 landed in August 2026, 1.37.1 in July 2026, and 1.36.0 in May 2026 addressed multiple security advisories including SSO CSRF, user enumeration, and an SSRF vulnerability in the icon endpoint.

A minimal compose file:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./vw-data:/data
    environment:
      DOMAIN: "https://vault.yourdomain.com"
      SIGNUPS_ALLOWED: "false"
      ADMIN_TOKEN: "${VW_ADMIN_TOKEN}"
    ports:
      - "127.0.0.1:8080:80"

Put Caddy or Nginx Proxy Manager in front for automatic TLS. Set SIGNUPS_ALLOWED: "false" immediately after creating your account — an open registration endpoint is the first thing that gets you burned. Enable fail2ban on the login endpoint. Backup the vw-data/ directory; that single path contains your entire vault.

The honest caveat: Vaultwarden has no formal third-party security audit. The project has had meaningful vulnerabilities patched over the past year, including access control issues that allowed low-privileged organization members to read credentials outside their permitted collections. If you run Vaultwarden for a team, pin to tagged releases and monitor the GitHub security advisories feed. Auto-updating to latest without review is a real risk on a credential store.

Official Bitwarden Self-Hosted — when audit history matters

Bitwarden’s self-hosted option requires a Families or Enterprise plan license, which means you pay even when running your own infrastructure. In return, you get audited server code, full FIDO2/passkey support, SSO integration, SCIM provisioning, and proper audit logging. The server stack runs on Docker and needs more resources than Vaultwarden — expect 4+ containers and an external MSSQL or PostgreSQL instance for anything beyond a demo.

For teams of 20+ where a compliance auditor might eventually ask “show me your audit trail,” official Bitwarden is the defensible choice. For a five-person family, it is almost certainly overkill.

KeePassXC — zero server, full local control

KeePassXC stores your vault as an encrypted local file, supports AES256 and Twofish, integrates with YubiKey and OnlyKey for hardware-factor unlocking, and received an independent security audit in January 2023. Sync is your problem — you handle it via Nextcloud, Syncthing, or a shared NAS mount.

This approach has a legitimate security advantage: there is no server to harden, no exposed HTTPS endpoint, and no CVE that puts your vault at risk while you sleep. The tradeoff is that mobile sync requires you to manage file distribution, and merge conflicts on the vault file are annoying when multiple devices write simultaneously.

Best for: solo users, people who already manage their own file sync, and anyone who considers a server another thing to patch.

Passbolt CE — team-first, browser-extension-driven

Passbolt’s Community Edition is free, AGPL-licensed, and built explicitly for credential sharing across a team. Where Vaultwarden and Bitwarden treat sharing as a feature, Passbolt treats it as the product. Credentials are encrypted per-user using OpenPGP, so the server never holds plaintext keys. The browser extension is the primary interface; there is no native desktop app.

Passbolt CE supports unlimited users at no cost with core features including MFA, role-based access, and folder organization. Pro adds LDAP/AD provisioning, SSO, and audit logging at $4.90 per user per month (minimum 10 users). The CE install is more involved than Vaultwarden — expect PHP, PostgreSQL, and a dedicated virtual machine or LXC container rather than a single Docker image.

For sysadmin teams who spend half their day rotating shared service credentials, Passbolt’s access model makes sense. For everyone else, the setup complexity is not worth it over Vaultwarden organizations.

Security and Keeping It Patched

Any self-hosted credential store is a high-value target. A few non-negotiable controls regardless of which tool you pick:

• Do not expose the admin panel to the internet. Vaultwarden’s /admin endpoint and Bitwarden’s management UI should be accessible only from Tailscale or a local network. A credential database with an exposed admin endpoint is one misconfigured firewall rule away from a bad day.
• Pin to tagged releases. Track the security advisories channel for whichever project you run. Password managers have historically been attractive targets; Vaultwarden’s CVE history over the past 18 months shows that “unofficial” does not mean “safe to ignore.”
• Enable 2FA on every account. Vaultwarden supports TOTP, email codes, and WebAuthn/passkeys. Hardware security keys are the strongest option; at minimum, use an authenticator app.

For broader context on credential-related attack patterns and how AI-assisted tools are changing the threat landscape, aisec.blog covers the offensive side including prompt injection and agent exploitation techniques that have started intersecting with credential harvesting workflows.

Backups and Access

Back up the vault data directory daily, off-site. For Vaultwarden, that is the vw-data/ bind mount. A rclone job to Backblaze B2 or an encrypted rsync to a NAS is sufficient. Test restores quarterly — this is the step everyone skips.

For access, Tailscale is the cleanest answer for personal use: no port forwarding, no exposed HTTPS endpoint, no attack surface on the open internet. Cloudflare Tunnel is reasonable for teams who need access from corporate devices where Tailscale is blocked. Raw port forwarding with fail2ban is acceptable but adds exposure you do not need.