DEV Community

Elder Fernandes
Elder Fernandes

Posted on Originally published at selfhoststack-8z4.pages.dev

Self-Hosted Password Managers in 2026: Vaultwarden vs Passbolt vs KeePassXC vs Psono

#docker #security #devops #selfhosted

Self-Hosted Password Managers in 2026: Vaultwarden vs Passbolt vs KeePassXC vs Psono

Every team eventually hits the same wall: the free tier of Bitwarden Cloud caps you at 2 users, 1Password Teams starts at $19.95/month for 5 seats, and Dashlane's business plan is $8/user/month before you've added a single YubiKey.

Self-hosting a password manager is one of the highest-ROI infrastructure decisions a small team can make. A single €4 Hetzner CX22 box handles 50 users, 50k credentials, and full TOTP/2FA sync. The "but it's risky" objection hasn't been true since Vaultwarden passed its 2023 SOC 2-aligned third-party audit.

The four production-grade open-source options in 2026 are Vaultwarden, Passbolt, KeePassXC (with a server backend), and Psono. Here is the honest comparison.

Quick Comparison

Tool Architecture Browser Extension Mobile App 2FA / TOTP Sharing Model Best For
Vaultwarden Client-server (Rust) Yes (Bitwarden client) Yes (iOS/Android) Yes (Aegis-style) Org + collections Teams replacing 1Password / Bitwarden
Passbolt Client-server (PHP) Yes (Firefox/Chrome) Yes (iOS/Android) Yes (TOTP, YubiKey) Groups + permissions Security-conscious teams, audited access
KeePassXC Local DB (KDBX4) Browser passkeys only KeePassDX / Strongbox Yes (TOTP) Manual file share Single-user purists, offline-first
Psono Client-server (Python) Yes (Chrome/FF) Yes (iOS/Android) Yes (TOTP, WebAuthn) Share folders + links DevOps teams with shared API keys

1. Vaultwarden — The 1:1 Drop-In Replacement

Vaultwarden is a community Rust rewrite of the Bitwarden server. It speaks the same API as the official Bitwarden Cloud, which means you get all 4 official client apps (browser, desktop, mobile, CLI) for free.

Docker Compose (minimum, no SSO):

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
      INVITATIONS_ALLOWED: "true"
      SHOW_PASSWORD_HINT: "false"
      LOG_LEVEL: "warn"
    volumes:
      - ./vw-data:/data
    ports:
      - "8080:80"

  caddy:
    image: caddy:2
    restart: unless-stopped
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    ports:
      - "80:80"
      - "443:443"

volumes:
  caddy_data:
  caddy_config:
Enter fullscreen mode Exit fullscreen mode

Pros:

  • All official Bitwarden clients work (extension auto-syncs every 30s)
  • ~35 MB RAM, runs on a Raspberry Pi 4
  • Built-in TOTP generator, FIDO2 WebAuthn, Send (encrypted file share), emergency access
  • Active: 35k+ GitHub stars, 200+ contributors, weekly releases

Cons:

  • No native SSO/SAML on community edition (paid plans only)
  • No formal SOC 2 — relies on the upstream Bitwarden security model
  • No built-in audit log UI (you parse SQLite directly)

When NOT to migrate: If your auditor requires a FedRAMP or SOC 2 Type II report specifically naming the password vault, Vaultwarden won't satisfy that. Use Bitwarden Enterprise (self-hosted) or Passbolt Pro.

2. Passbolt — The Audited One

Passbolt is a PHP-based password manager originally built for security teams. It has a built-in audit log, granular sharing permissions, and supports hardware keys (YubiKey, OnlyKey) as the primary 2FA method.

Docker Compose (with MariaDB):

services:
  db:
    image: mariadb:10.11
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: change-me
      MYSQL_DATABASE: passbolt
      MYSQL_USER: passbolt
      MYSQL_PASSWORD: change-me
    volumes:
      - db_data:/var/lib/mysql

  passbolt:
    image: passbolt/passbolt:latest-ce
    container_name: passbolt
    restart: unless-stopped
    depends_on:
      - db
    environment:
      APP_FULL_BASE_URL: https://passbolt.example.com
      DATASOURCES_DEFAULT_HOST: db
      DATASOURCES_DEFAULT_USERNAME: passbolt
      DATASOURCES_DEFAULT_PASSWORD: change-me
      DATASOURCES_DEFAULT_DATABASE: passbolt
      EMAIL_DEFAULT_FROM_NAME: "Team Passwords"
      EMAIL_DEFAULT_FROM: noreply@example.com
    volumes:
      - passbolt_data:/etc/passbolt
      - gpg_keys:/etc/passbolt/gpg
    ports:
      - "8080:80"

volumes:
  db_data:
  passbolt_data:
  gpg_keys:
Enter fullscreen mode Exit fullscreen mode

Pros:

  • Built-in audit log: who accessed which password, when, from which IP
  • OpenPGP key encryption at rest (passphrase never leaves the client)
  • Native SSO via LDAP, SAML, OpenID Connect (Pro only for SAML)
  • Mobile app is fully offline-capable
  • 5k+ GitHub stars, used by the European Commission and several national CERTs

Cons:

  • Heavier stack: 350 MB RAM minimum, 1 GB recommended
  • Browser extension is less polished than Bitwarden's
  • Free Community Edition lacks some enterprise features (SAML, SCIM)
  • PHP + MariaDB is a lot of moving parts for a single-user setup

When NOT to migrate: If you only have 1–3 users and don't need an audit log, Passbolt is overkill. Use Vaultwarden or KeePassXC.

3. KeePassXC — The Offline Purist Choice

KeePassXC is a cross-platform desktop app that stores credentials in an encrypted KDBX4 file. There is no server. The "self-host" part is syncing the .kdbx file via Nextcloud, Syncthing, or a private Git repo.

Pros:

  • Zero server attack surface — the file is encrypted client-side with AES-256 + Argon2 KDF
  • Free, no telemetry, open source (C++ + Qt, audited)
  • Native integration with browser passkeys (WebAuthn)
  • Runs on Windows, macOS, Linux, BSD, plus mobile forks (KeePassDX for Android, Strongbox for iOS)

Cons:

  • No native sharing — you have to manually distribute the master password AND the .kdbx file
  • No TOTP sync (you run a separate app like Aegis)
  • No audit log
  • Multi-device sync requires a sync layer (Nextcloud, Syncthing, Git)

When NOT to migrate: If you have more than 2 users, you'll spend more time managing the file sync than you'll save on subscription costs. Pick Vaultwarden.

4. Psono — The DevOps Favorite

Psono was built for teams that share hundreds of API keys, SSH keys, and database passwords. It has first-class support for folder-based sharing with link expiration and one-time share links.

Pros:

  • Encrypted client-side (JavaScript + libsodium)
  • Native CLI for piping passwords into scripts
  • Self-destructing share links (set TTL)
  • Free Community Edition supports unlimited users
  • REST API for CI/CD integration (Jenkins, GitHub Actions, GitLab)

Cons:

  • Smaller community (~2k GitHub stars) — slower release cadence
  • UI is functional but not as polished as Bitwarden
  • No Linux desktop client (browser only)

When NOT to migrate: If you don't need the CLI or the share-link TTL feature, Vaultwarden is a better daily driver.

Backup Strategy (the part everyone forgets)

Self-hosting a password vault means you are responsible for backups. Three layers:

  1. Database snapshot every 6h (Vaultwarden SQLite is just a file — cp vw-data/db.sqlite3 backup-$(date +%F).sqlite3).
  2. Encrypted offsite copy (rclone to Backblaze B2 with --crypt-remote).
  3. Restore drill quarterly — actually spin up the backup and log in. Restoring from a corrupted backup is not the day you want to discover the backup is corrupted. 
# Example Vaultwarden backup script
#!/bin/bash
BACKUP_DIR=/backups/vaultwarden
DATE=$(date +%F-%H%M)
mkdir -p "$BACKUP_DIR"
sqlite3 /data/vaultwarden/db.sqlite3 ".backup '$BACKUP_DIR/db-$DATE.sqlite3'"
gpg --symmetric --batch --passphrase-file /root/.backup-pass "$BACKUP_DIR/db-$DATE.sqlite3"
rm "$BACKUP_DIR/db-$DATE.sqlite3"
rclone copy "$BACKUP_DIR" b2:my-vault-backups/
find "$BACKUP_DIR" -name "*.gpg" -mtime +30 -delete
Enter fullscreen mode Exit fullscreen mode

Recommendation Matrix

Your situation Pick
Solo developer or family, want zero server KeePassXC + Syncthing
Small team (3–20), want Bitwarden UX without subscription Vaultwarden
Team (20+) with compliance / audit requirements Passbolt CE (or Pro for SAML)
DevOps / SRE team sharing hundreds of API keys Psono

Migration Tips

  • From 1Password: Export as CSV → import in Bitwarden → point clients to your Vaultwarden URL.
  • From LastPass: Do it yesterday. LastPass had 3 breaches since 2022.
  • From KeePass: Vaultwarden accepts the KeePass XML export directly.
  • Cutover: Run Vaultwarden on a subdomain for 2 weeks, dual-write to old + new, then flip the official URL in your password generator.

Self-hosting a password manager is the rare case where the open-source version is genuinely better than the paid SaaS. You own the data, the keys never leave your infrastructure, and your monthly cost drops to roughly the price of a backup storage bucket.

Top comments (0)