Self-Hosted Password Managers

The candidates

• ★ Vaultwarden — Bitwarden-API-compatible server; Rust; tiny resource footprint; works with all official Bitwarden clients (mobile, desktop, browser, CLI). The default in 2026.
  • https://github.com/dani-garcia/vaultwarden
• Bitwarden Server (official) — heavier; .NET; uses upstream features faster than Vaultwarden.
  • https://github.com/bitwarden/server
• Bitwarden Unified — official lighter Docker single-container deploy.
  • https://bitwarden.com/help/install-and-deploy-unified-beta/
• Passbolt — team-focused; PHP; good for businesses; permissions / sharing UX.
  • https://github.com/passbolt/passbolt_api
• Padloc — newer; modern; less common.
  • https://github.com/padloc/padloc
• Psono — team password manager; OSS Community + paid Enterprise.
  • https://github.com/psono/psono-server
• TeamPass — older PHP-based.

File-based / git-backed

• ★ pass — the standard Unix password manager; GPG-encrypted files; sync via git.
  • https://www.passwordstore.org/
• gopass — Go reimplementation of pass; richer features.
  • https://github.com/gopasspw/gopass
• KeePassXC — desktop; sync the .kdbx file via Syncthing / Nextcloud.
  • https://github.com/keepassxreboot/keepassxc
• KeeWeb — web UI for KeePass .kdbx files.
  • https://github.com/keeweb/keeweb

Family / multi-user setup

• Vaultwarden Organizations — share collections with family members; works in all Bitwarden clients.
• Bitwarden Family plan ($3/mo) — paid hosted; less hassle.
• 1Password Families — closed source; arguably the best UX in this space.

Adjacent: SSH key / cert managers

• See SSH & Bastion — Teleport, smallstep SSH CA.
• pass also handles SSH keys nicely.

Adjacent: secrets for services (not human passwords)

• See Infra Secrets — Vault, OpenBao, Infisical, SOPS.

Patterns to adopt

• ★ Vaultwarden for almost everyone. Mature, lightweight, full Bitwarden client compat.
• Hardware 2FA (YubiKey / SoloKey / Nitrokey) on the master account.
• Off-site encrypted backup of the DB. The vault is encrypted at rest, but you still want copies elsewhere.
• Don't expose publicly without a reverse proxy + auth at the edge. Cloudflare Access or Authelia in front; or Tailscale-only access.
• Family training — set up the recovery process so you're not a single point of failure for your loved ones.

Pick this if…

• Default self-host: Vaultwarden.
• Want official upstream features ASAP: Bitwarden Server.
• Team / business: Passbolt or Bitwarden organizations.
• Terminal native: pass or gopass.
• Don't want to host a server: KeePassXC + Syncthing (file-based).