Bitwarden and self-hosted password vaults: 172,580 fingerprints, 84,687 titles

A password manager concentrates the credentials an organisation uses into one system. That is the point, and it is also the reason a self-hosted vault reachable from the public internet deserves a careful review. ZoomEye indexes Bitwarden deployments through two signals, and the counts give a sense of how common the self-hosted pattern has become.

What the query returns

On 2026-10-10, app="Bitwarden" returned 172,580 matching assets and title="Bitwarden" returned 84,687. As with other products, the application fingerprint captures a broader set than the title, because the title is a string the deployment controls and often changes when the login page is customised.
The second number is the more relevant one for a quick inventory, because it is the page that declares the product. The first is the broader population that includes deployments whose title has been replaced.

Why a vault is a high-value target

Every other control in an environment assumes the credentials are secret. A vault holds the credentials for the services the organisation uses, the recovery codes for the accounts that matter, and often the notes and keys that tie them together. Compromise of the vault is not a step in an intrusion; it is access to the credentials for the systems the intrusion wanted.
The defences around a self-hosted vault matter accordingly. Strong authentication on the vault itself, a network restriction so that it is reachable from the corporate range rather than the whole internet, and a patched instance are the baseline. A deployment that answers on the public internet without those controls is a single point of compromise for everything it stores.

What to check

Confirm whether the vault needs to be reachable from the internet at all. Many self-hosted deployments can be placed behind a VPN or an identity-aware proxy, which removes the public exposure without changing how users reach it.
If it is reachable, confirm the application is current. A self-hosted vault is a component the operator updates, and the update cadence of a security product should be short.
Review the administrator accounts on the vault and how the recovery for them works, because the vault's own recovery path is the highest value target inside it.

The measurement in context

The counts describe reachable, indexable deployments. They do not distinguish a hardened instance from a neglected one, and they do not indicate whether the vault is the well-known historical Bitwarden server, a Vaultwarden implementation, or a compatible front end. What they establish is that self-hosted vaults are common enough to appear regularly in an external inventory, which makes the review a recurring task rather than an unusual one.

References

• Bitwarden, self-hosting documentation
• Bitwarden, security whitepaper
• ZoomEye, search syntax and application fingerprint documentation