Vaultwarden
github.com/dani-garcia/vaultwarden- Category
- Cybersecurity
- Type
- APP
- Builder
- dani-garcia
- GitHub
- 65.6k stars
- Latest release
- 1.37.1
- Added
- May 1, 2026
About
An alternative server implementation of the Bitwarden Client API, written in Rust and compatible with official Bitwarden clients [disclaimer], perfect for self-hosted deployment where running the official resource-heavy service might not be ideal. [ ]
What it does
A single compiled binary that answers the HTTP protocol Bitwarden's phone, desktop and browser apps already speak, so those apps sync against a machine you control. Items live in SQLite, MySQL or PostgreSQL, chosen when the binary is built. On first start it generates a 2048-bit RSA key and signs every session token with it, using a different issuer per token purpose. The published images bundle a modified web front end. Two-factor methods, organizations, attachments, emergency access and an admin console all run inside that one process.
Why it's ranked here
The hardening reads like someone expecting attacks rather than checking a box. Unsafe code is forbidden across the workspace and warnings are denied. Login, admin and unauthenticated traffic each get their own per-IP limiter that answers 429. Outbound fetches refuse non-global addresses both before and after DNS resolution, cap redirects at five and revalidate the host on every hop. Password comparisons run in constant time. Against that: it tracks a protocol it does not own, so client releases set the pace, and one legacy SHA1-based signing helper is still in the tree.
What's good
Operationally it is undramatic, which is what you want from a vault. The recommended path is a published container image with one data volume, one HTTP port and a health check, and the project documentation gives a working compose file. Configuration comes from environment variables or a saved JSON file, with password fields masked when the config is printed back. The binary carries its own admin-token hasher with two Argon2id cost presets and a backup command that also fires on a signal. Integration tests run the whole stack against each supported database, plus a single sign-on scenario.
Tradeoffs
No database backend is enabled by default; the manifest asks you to turn at least one on before building. The bundled web client is a separate fork baked into the images, so trusting the image means trusting that build too. The client crypto requires a secure context, which means certificates and a proxy in front before anything works. The project is not affiliated with the vendor, its maintainers ask that bugs never go to vendor support, and they state plainly that they cannot be held liable for data loss and that you should keep your own backups.
How to use it well
This suits someone already self-hosting for a household or small team, who runs a reverse proxy, holds certificates and has a backup habit. It fits the workflow where you want the vendor's own phone and browser clients but not their hosted plan or their full server stack. Run the published image on a loopback port behind your proxy, generate the admin credential with the built-in hasher rather than pasting a plain token, and pick one database early because the choice is compile-time. It does not give you the client software, TLS termination, or an offsite backup plan.
Technical notes+
Cargo.toml declares AGPL-3.0-only, forbids unsafe_code and denies warnings for the workspace, and puts the mysql, postgresql and sqlite backends behind cargo features with an empty default set, alongside optional s3, OIDC and mimalloc features. src/main.rs is the entry point: it installs the rustls ring provider, handles the hash and backup subcommands with pico-args, initializes keys, builds the diesel pool, runs U2F to WebAuthn and credential to passkey migrations, then launches Rocket. src/auth.rs mints RS256 tokens from a 2048-bit key created on first run, with a separate issuer string per purpose and validity windows of two hours for access, thirty days for refresh and ninety for mobile. src/ratelimit.rs holds three governor limiters keyed by IP address. src/http_client.rs is the SSRF boundary: host validation, a configurable block regex, non-global address rejection in both pre_resolve and post_resolve, a custom hickory resolver, a five redirect cap that rechecks each hop, and a ten second timeout. src/crypto.rs uses ring PBKDF2-HMAC-SHA256 plus subtle for constant-time equality, and keeps an HMAC-SHA1 helper marked for legacy use. src/config.rs generates the whole config surface from a macro over environment variables and a saved config file, masking Pass fields as asterisks. docker/Dockerfile.debian is a generated multi-stage cross-compile landing on a Debian slim runtime with one exposed port, a data volume and a health check. playwright/README.md documents integration runs per database project and an SSO project against Keycloak. src/api/mod.rs merges organization master password policies into one effective policy. README.md carries the affiliation disclaimer and the data-loss warning.
Observed
- License
- AGPL-3.0-only, declared in the workspace manifest
- Language
- Rust, with unsafe code forbidden and warnings denied at workspace level
- Storage backends
- SQLite, MySQL or PostgreSQL, selected as a build feature, with none enabled by default
- Install surface
- Prebuilt container images on ghcr.io, docker.io and quay.io, or a source build
- Runtime image
- Debian slim base with one exposed HTTP port, one data volume and a health check script
- Interfaces
- HTTP API for Bitwarden clients, bundled web vault, admin backend, and a small CLI with hash and backup subcommands
- Rate limiting
- Separate per-IP limiters for login, admin and unauthenticated requests
- Outbound requests
- Non-global address blocking checked before and after DNS resolution, with every redirect revalidated
- Session tokens
- RS256 JWTs from a locally generated RSA key, with a distinct issuer per token purpose
- Testing
- Playwright integration suite with per-database projects and a single sign-on project against Keycloak
- Optional features
- S3-backed file storage, OIDC single sign-on, syslog logging, alternative memory allocator
Read from README.md, Cargo.toml, src/main.rs, src/api/mod.rs, src/ratelimit.rs, src/http_client.rs, src/crypto.rs, docker/Dockerfile.debian, playwright/README.md, src/config.rs, src/auth.rs.
What it can do
Store and manage passwords securely
User passwords and login credentials → Encrypted password vault
Synchronize password data across devices
Encrypted vault data from Bitwarden clients → Synchronized password database
Authenticate users for vault access
User credentials and authentication requests → Authentication tokens and session management
Provide self-hosted password management service
Server deployment configuration and Docker containers → Running Bitwarden-compatible API server
Encrypt and decrypt sensitive data
User vault data and encryption keys → Encrypted/decrypted password entries and secure notes
Serve Bitwarden client API endpoints
HTTP requests from official Bitwarden clients → API responses for vault operations
Tags
Tech Stack
Featured in Intel
Comments (0)
No comments yet
Indexed by a proprietary survey. Corrections welcome.