Bitwarden vs Vaultwarden: Which Self-Hosted Password Manager Should You Run?

Both let you keep your vault under your own control, but they are different products. Bitwarden is a company that runs a cloud service and offers an official self-hosting option. Vaultwarden is a community project: an unofficial server written in Rust that implements the Bitwarden client API.

The facts

	Bitwarden	Vaultwarden
Maintained by	Bitwarden, the company	A community project
Self-hosting	Official option, listed on the Enterprise plan	Self-hosted only
Clients	Official Bitwarden clients	Official Bitwarden clients
Cost	Free basic plan. Premium at $19.80 per year, billed annually	The software is free. You pay for hosting and your time
Support	Vendor support, depending on plan	Community. The project asks for bug reports on its own channels, not Bitwarden's
Licence	Not compared here	AGPL-3.0

The Bitwarden figures come from its pricing page. The Vaultwarden figures come from its repository. The Vaultwarden project describes its server as a nearly complete implementation of the client API, not a full copy of the official service.

Which one to choose

Choose Bitwarden if you want vendor support and do not want to run a server. The cloud service is the simplest option. Premium adds features for $19.80 per year.

Choose Vaultwarden if you want to self-host without buying the Enterprise plan, and you accept running the server yourself: updates, backups and TLS. The project requires HTTPS for its web vault, so plan a reverse proxy before you start.

Choose neither if you do not want to operate any server. A hosted zero-knowledge manager removes the operations, and the trust question then moves to the provider. VaultKeepR is hosted and not self-hosted. Check how its recovery works before you decide, as explained in what a zero-knowledge password manager is.

What to test before you move

Whichever you pick, test the account on a dummy vault first. Create an entry, sync it to a second device, export, import, and confirm that the entries match. Delete any unencrypted export as soon as the import is done.