How to Install and Use Vaultwarden on Ubuntu (Complete Self-Hosted Password Manager Guide)

Last Updated: July 11th, 2026

This comprehensive tutorial shows you how to install, configure, secure, and use Vaultwarden on an Ubuntu server. Vaultwarden is a lightweight, fully compatible unofficial server implementation of the Bitwarden client ecosystem, written in Rust. It provides the exact same rich client feature set as Bitwarden while consuming a fraction of the system resources, making it the ideal solution for private password management.

What Is Vaultwarden?

Vaultwarden is an open-source, self-hosted password manager backend compatible with official Bitwarden browser extensions, desktop apps, and mobile clients. Storing your sensitive credentials with a third-party cloud provider means trusting them with your entire digital identity. By self-hosting Vaultwarden on your own private infrastructure or VPS, you gain total autonomy over your encrypted vault, ensuring your master passwords, secure notes, and credit card records never leave hardware you control.

Vaultwarden Features

• 100% Client Compatibility: Works seamlessly with official Bitwarden apps across iOS, Android, Windows, macOS, Linux, and all major web browsers.
• Extremely Lightweight: Written in Rust, it uses minimal CPU and RAM (often less than 30MB), making it ideal even for low-powered single-board computers like a Raspberry Pi.
• Organization & Sharing: Allows secure sharing of logins, notes, and attachments between multiple users or family members.
• Two-Factor Authentication (2FA): Supports robust 2FA methods including WebAuthn/FIDO2, YubiKey, Authenticator apps, and Duo.
• Built-in Web Vault: Includes a fully featured web interface for managing your items on the go.

Requirements & Prerequisites

You will need an Ubuntu server (22.04, 24.04 LTS, or newer) with sudo privileges, Docker and Docker Compose installed, a valid domain name, and an active TLS/SSL certificate (Let's Encrypt). Note that Bitwarden and Vaultwarden clients strictly require an HTTPS connection to communicate with the server and access cryptography APIs.

Step 1: Install Docker and Docker Compose

Vaultwarden runs efficiently inside a container. Log into your Ubuntu server and install Docker if you haven't already:

sudo apt update
sudo apt install -y docker.io docker-compose-v2
sudo systemctl start docker
sudo systemctl enable docker

Step 2: Create a Docker Compose Configuration for Vaultwarden

Create a dedicated directory for your Vaultwarden deployment and set up a docker-compose.yml file:

mkdir -p ~/vaultwarden && cd ~/vaultwarden
sudo nano docker-compose.yml

Paste the following container configuration into the file:

services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: always
environment:
- SIGNUPS_ALLOWED=true # Set to false after creating your initial account
volumes:
- ./vw-data:/data
ports:
- 127.0.0.1:8080:80

Save and close the file, then spin up the container in the background:

sudo docker compose up -d

Step 3: Configure an Nginx Reverse Proxy

Because Vaultwarden listens locally on port 8080 and requires HTTPS, configure Nginx to route traffic securely from your domain (e.g., vault.example.com):

sudo apt install -y nginx
sudo nano /etc/nginx/conf.d/vaultwarden.conf

Add the following server block configuration (be sure to include proper WebSocket support for browser notifications and syncing):

server {
listen 80;
server_name vault.example.com;

client_max_body_size 128M;

location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

location /notifications/hub {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

Test the syntax and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Step 4: Secure with Let’s Encrypt HTTPS

Obtain a free SSL/TLS certificate using Certbot:

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx --agree-tos --redirect --email [email protected] -d vault.example.com

Step 5: Lock Down Public Registrations

Navigate to your domain name https://vault.example.com in a web browser, create your master administrator account, and log in. Once your personal account is successfully established, open your `docker-compose.yml` file and change SIGNUPS_ALLOWED=true to false to prevent unauthorized users from registering on your server:

cd ~/vaultwarden
sudo nano docker-compose.yml
# Change SIGNUPS_ALLOWED to false
sudo docker compose up -d --force-recreate

Step 6: Connecting Clients to Your Vaultwarden Server

Download the official Bitwarden browser extension, desktop app, or mobile client. By default, applications point to the official commercial Bitwarden cloud:

1. Open your Bitwarden app or extension before logging in.
2. Click the **Settings** or **Gear icon** in the top-left corner.
3. Locate the **Server URL** or **Self-hosted environment** field.
4. Enter your custom Vaultwarden domain address (e.g., https://vault.example.com) and save.
5. Log in using your self-hosted account credentials. Your local extension will now synchronize directly and securely with your private Ubuntu instance.