Self-hosted alternatives to 1Password and Bitwarden: Vaultwarden and Passbolt compared

1Password and Bitwarden keep a company's shared passwords as a service, at a price per user. Vaultwarden and Passbolt do the same job on a server of your own, with no price per user: the passwords are encrypted on each person's device, and the server only stores what it cannot read. We gave both the same company vault on the same server. What 1Password and Bitwarden charge, and what you give up by leaving them, is near the end of this page, from their own pages.

The short answer

Pick Vaultwarden if you want the Bitwarden apps your staff may already know, on phones, computers and in every browser, with offline access, file attachments, emergency access and directory sync at no cost, in a single container that used 10 MB of memory. Accept that it is an unofficial server written by volunteers: Bitwarden does not support it, and nobody you can pay stands behind it.

Pick Passbolt if sharing is the point: every password is encrypted separately for each person who may see it, a colleague who leaves loses access the moment you suspend them, and it is made by a company in the EU that publishes its audits and sells support when you want it. Accept a browser extension that everyone must use, no file attachments and no offline passwords, and account recovery, single sign-on and directory sync only in the paid Pro edition.

What we tested

We installed both on the same fresh Melonslab VC-P Alloy (2 vCPU, 8 GB) with Debian 13, by following our guides Vaultwarden with rootless Podman and Passbolt with rootless Podman step by step. Each ran under a user of its own, behind the same Caddy. Every step in both guides worked as written.

Then we built the same company vault in both:

• an organisation, Exempel AB, with an admin, Anna, and two staff, Erik and Olle;
• 30 logins in four shared collections, called folders in Passbolt: Shared (8), Finance (8), IT (8) and Marketing (6), 15 of them with a one-time code (TOTP);
• different access for each: Erik could edit Finance, read Shared and IT, and had no access to Marketing; Olle could edit IT and Marketing, read Shared, and had no access to Finance;
• two attachments, an invoice and a contract, on two logins in Finance;
• Olle leaving the company: Anna took away his access, and we checked what he still had on his own computer, with the network cut.

The 24 logins in Shared, Finance and IT came from a Bitwarden export and the 6 in Marketing from a 1Password export. Both exports were constructed by us, in the formats the two services document, since we did not sign up for either.

We used the official Bitwarden browser extension 2026.9.3, the web vault and the Bitwarden command-line client 2026.9.1 with Vaultwarden, and Passbolt's browser extension 5.16.0 in Chromium and Passbolt's command-line client, go-passbolt-cli 0.5.2, with Passbolt. We switched on two-step login for one user, exported both vaults, rebooted the server, measured memory at rest and while people worked, and ran each guide's backup and restored it into empty volumes. Passbolt's emails went to a test mail server on the same machine.

1Password and Bitwarden's own service were not tested. We did not sign up for either. What this page says about them comes from their own pages, linked where we use them and read on 14 October 2026.

The numbers

Memory is the sum of each app's containers, measured with podman stats five minutes after a reboot. The peak is the highest reading while two users fetched their vaults and passwords for three minutes: about 4.5 requests a second to Vaultwarden through its API, and about two runs a second of Passbolt's command-line client, each of which signs in with the user's key. Times are how long the guide's commands took to run, mostly downloading images, not the time you need to read and type them. Passbolt's database files are mostly MariaDB's own; our passwords take up little of them.

Setup

Both guides worked as written. The differences are in how people get in.

Vaultwarden's guide opens sign-ups for your own account and closes them right after. For a company, you then create an organisation in the web vault and invite people by email address. In our test, invited people could create their account even with sign-ups closed, and since the guide sets up no email, Vaultwarden accepted the invitations by itself; Anna then had to Confirm each member, which is the moment their copy of the organisation's key is made. Without email, nobody gets a message about the invite: you tell them yourself to create an account at the address. Email is also needed for emergency access and for the codes some two-step methods send.

Passbolt cannot work without email: every user starts from an invite link. The first admin is made with a command that prints the link, as the guide shows. Each person then installs the extension, picks a passphrase, saves a recovery kit with their private key and picks a security token. When Anna set up her account, her extension also created the organisation's key for the names and addresses of passwords, as the guide describes. Erik's and Olle's invites arrived by email, and both set up their accounts from the links.

Apps and daily use

Vaultwarden works with Bitwarden's own apps, which is its main strength. We logged in to the official Bitwarden extension for Chromium as Erik, by choosing self-hosted and entering the server's address, and saw his 24 items. The command-line client read, edited and exported items, and showed the right one-time codes. Bitwarden's desktop apps and its iOS and Android apps work the same way; we did not test them here. Vaultwarden's releases say which app versions need which server version, and old servers lock out new apps: Vaultwarden 1.37.0 was required for apps from 2026.7.0, so keep it updated, as the guide does daily.

Passbolt is used through its browser extension, for Chrome, Firefox, Edge, Brave and Safari. The web page alone cannot sign in: it only asks you to install the extension. The extension filled in our list, copied usernames, passwords and one-time codes, and offered Edit only where the user had the right to change a password. Passbolt also has apps for iOS, Android and Windows, which we did not test. Its command-line client, go-passbolt-cli, listed, read and exported passwords, but refused to change a shared one in our test, with an error about the organisation's metadata key, so we made changes in the extension.

Sharing and permissions

Both did what we asked: Erik saw 24 items and Olle 22, and neither saw a collection or folder he was not given.

Vaultwarden shares through collections in an organisation. Each member gets Can view, Can view, except passwords, Can edit, Can edit, except passwords or Can manage per collection, and groups work the same way. Erik's attempt to change a read-only item was refused with "You do not have permission to edit this item". Can view, except passwords, which we gave Erik on IT, hid the passwords in the apps, but the server still sent them to his app, encrypted with the organisation's key that he holds: it stops mistakes, not a determined colleague.

Passbolt shares each password, or a folder and everything in it, with people or groups: Can read, Can update or Is owner. Sharing the four folders in the extension took 4 to 10 seconds each, while it encrypted every password in them once more for each new person. Passbolt's command-line client shared only the folder, not the passwords in it. There is no read access that hides the password: someone who can read a login can see it.

Encryption, in plain words

Both encrypt on your devices, and the server only stores what it cannot read. They share passwords differently.

Vaultwarden, like Bitwarden, derives a key from each user's master password on their device. Every organisation has one key of its own, and every member holds a copy, encrypted so only they can open it. All the organisation's items are encrypted with that key. Sharing is giving someone access to the collection; their app can already decrypt it. In the database, item names, usernames, passwords and collection names were all encrypted; the organisation's name and users' email addresses were not.

Passbolt gives every user an OpenPGP key pair, made in their browser. The private key stays in the extension and in the user's recovery kit, protected by their passphrase; the server never has it. Each password is encrypted separately for every person who may read it, so sharing with Erik means encrypting it once more, for him, and removing Erik deletes his copy. Since version 5, the names, usernames and addresses are encrypted too, with a key the organisation shares. Folder names were not encrypted in our database.

The practical difference: in Vaultwarden, a member who has left still knows the organisation's key, and could read the organisation's data if they ever got hold of a copy of the database. In Passbolt, a person who leaves has no copy of any password made for anyone else.

When someone leaves

We took away Olle's access in both, after he had used the vault, and then looked at what was left on his own computer, with the network cut.

Vaultwarden: Anna revoked Olle's membership. Olle's Bitwarden command-line client, offline, still listed all 22 items with their passwords, and still did after locking and unlocking with his master password. Only when his client next reached the server did they disappear. Bitwarden's apps keep an encrypted copy of the vault for offline use, so the same holds for a laptop or phone that is off the network: what he had synced, he keeps until it syncs again.

Passbolt: Anna ticked Suspend this user, which the Community Edition has. Olle could no longer sign in; the extension asked for his email as if it did not know him. His browser, offline, still had the list of his 22 passwords, with names, usernames and addresses, but not one password: the extension fetches and decrypts each password from the server when it is used.

In both, assume that a person who leaves may have copied what they could see. Change the passwords they had access to; Passbolt's list of who can see each password makes that list easy to find.

Two-step login, passkeys and single sign-on

Vaultwarden has two-step login with an authenticator app, email, FIDO2 security keys, YubiKey OTP and Duo, all free. We switched on an authenticator app for Erik: logins then needed a code, and a wrong code was refused. Vaultwarden's wiki lists Log in with passkey as not supported, though passkeys for other sites can be saved in the vault. Since version 1.35.0, Vaultwarden can sign in through OpenID Connect, but a master password is still required. It also works with Bitwarden's Directory Connector, to sync users from LDAP, Active Directory or Entra ID.

Passbolt Community Edition has two-step login with TOTP, YubiKey and Duo, according to its documentation; we did not test it. Single sign-on with Microsoft, Google or OpenID Connect, and user sync from Active Directory or OpenLDAP, are in Pro only, according to the pricing page, read on 14 October 2026. Passkeys are on Passbolt's roadmap, not in the product.

Account recovery and emergency access

Vaultwarden has emergency access, where a user names someone who may take over their vault after a waiting time, and an organisation policy that lets admins reset a member's master password, according to its README. Both depend on email for invites and notices, and we did not test them.

Passbolt Community Edition has no account recovery. A user who loses both the passphrase and the recovery kit loses their account, and passwords that only they could read are lost with it. Pro adds account recovery, where an organisation key held by admins can restore a user's private key.

Audit and event logs

Vaultwarden keeps the organisation's events only with ORG_EVENTS_ENABLED=true, which our guide does not set. With it switched on for a test, the organisation's event log listed logins and which items were viewed, with the user and IP address. Item views are reported by the apps themselves.

Passbolt Community Edition records every action and every read of a password in its database: our test left 1,346 action entries and 62 password reads. But reading them in the interface, or through the API, takes Pro, according to its documentation. In the free edition, you read them in the database yourself.

Import from 1Password and Bitwarden

Both exports below were made by us, in the formats documented by 1Password and Bitwarden, not exported from the services themselves.

Vaultwarden uses Bitwarden's importer, in the web vault or the command-line client. A Bitwarden organisation export (JSON) brought all 24 logins into the right collections, with their one-time codes. A 1Password export in its own 1PUX format brought all 6, with codes, and the 1Password vault Marketing became a collection. Bitwarden's importer does not bring 1Password attachments across.

Passbolt imports CSV and KeePass files in its extension, not Bitwarden's JSON or 1Password's 1PUX. A Bitwarden CSV in the personal format, with a folder column, brought all 24 logins, with one-time codes, into folders, inside a new folder named after the import. A 1Password CSV, with the columns Title, Url, Username, Password, OTPAuth, Favorite, Archived, Tags and Notes, brought the 6 logins with their addresses, but without their one-time codes. 1Password's export page lists these fields but not the exact column names, so check the codes after an import from 1Password.

Export

Vaultwarden exported the organisation as Bitwarden JSON with the command-line client: 30 items and the collections, but not the attachments, which Bitwarden's organisation exports never include.

Passbolt exported to an encrypted KeePass file with go-passbolt-cli; the extension can export a folder too. Since version 5.10, export to plain CSV is off by default.

Swedish

Vaultwarden's web vault is Bitwarden's, translated into Swedish: with a Swedish browser, the login page said "Logga in" and "E-postadress". Bitwarden's extensions, desktop and phone apps come in Swedish as well.

Passbolt is translated into Swedish: the admin chooses Svenska for the organisation under Administration > Internationalisation, and each user can pick their own language. Invites and notifications are then in Swedish too, as the Passbolt guide describes.

Resources

Vaultwarden is a small program written in Rust, with its data in a SQLite file: 10 MB at rest and 20 MB at its peak in our test. Passbolt is a PHP application with MariaDB, and used about 200 MB at rest and 240 MB at its peak. Both are tiny next to the 8 GB of a VC-P Alloy, and together used about a quarter of a gigabyte.

Updates and backups

Both guides follow the latest tag and update daily with podman auto-update. Vaultwarden needs this more than most: new Bitwarden apps can stop working with an older server, and Vaultwarden 1.37.4 fixed seven security issues, one of them in how a member's access is revoked, according to its release notes.

Vaultwarden's backup is one archive of its volume, taken while it is stopped for a few seconds: 674 KB, with the database, both attachments and its signing key. The guide has no restore steps; we stopped Vaultwarden, replaced the volume with podman volume import, and started it again, and Erik's 24 items and the invoice came back.

Passbolt's backup is a database dump and the server's two keys: 1.2 MB in all. We restored it into empty volumes with the guide's steps, and Erik read the Fortnox password again with his own key. The users' own keys are not in the backup: each user's recovery kit and passphrase are their part.

Both came back by themselves after a reboot.

Licence and cost

We read the licences and pricing pages on 14 October 2026.

• Vaultwarden is open source under the AGPL 3.0, written by volunteers. Its README says it is "not associated with Bitwarden or Bitwarden, Inc." and asks you to report problems to Vaultwarden, not to Bitwarden, and adds that one of its maintainers is employed by Bitwarden. Everything it has is free; there is no paid edition and no support to buy. It has had two audits that its wiki lists: by Germany's BSI of version 1.30.3, and a partial code review by ERNW in October 2024 that found three vulnerabilities, including an authentication bypass, since fixed. The Bitwarden apps it uses are Bitwarden's, under the GPL 3.0, and are audited as Bitwarden's.
• Passbolt is made by Passbolt SA in Luxembourg. The Community Edition is open source under the AGPL 3.0, with no user limit. Pro is 4.90 US dollars per user a month, billed yearly, for at least 10 users, with support on the next business day, and adds account recovery, single sign-on, LDAP and SCIM sync, the activity log in the interface and password policies, according to the pricing page. Passbolt Cloud starts at 5.40 dollars per user a month, hosted in Belgium or Germany (pricing). Its security page lists audits by Cure53, most recently in February 2026, and by Quarkslab in November 2025.

For a company keeping its own passwords, both cost nothing but the server. With Passbolt, the features a growing company asks for first, account recovery and single sign-on, are the paid ones.

1Password and Bitwarden today

What follows is from 1Password's and Bitwarden's own pages, read on 14 October 2026, not from our tests.

1Password is a hosted service only. Its business pricing page lists the Teams Starter Pack at 24.95 US dollars a month, billed yearly, for up to 10 people, with seats up to 20, and Business at 8.99 dollars per user a month, billed yearly. Single sign-on is for Business, as are automated user provisioning (provisioning) and the audit log (activity log). Admins can recover a member's account. Its security design mixes each user's password with a Secret Key kept on their devices, so "We're never in the position of learning your account password or cryptographic keys". Accounts can be kept in the EU, on 1Password.eu (regions), and 1Password reports SOC 2 Type 2 and ISO 27001 certification (security assessments). It exports in its 1PUX format or as CSV with logins only (export).

Bitwarden's business pricing page lists Teams at 4 US dollars and Enterprise at 6 dollars per user a month, billed yearly. Teams includes event logs, directory sync and SCIM; single sign-on and account recovery by admins are Enterprise only, according to its plan comparison, and a free organisation has two users. Emergency access comes with paid plans (emergency access). Bitwarden can keep your data in the EU, on bitwarden.eu (server geographies); it lists SOC 2 Type II, SOC 3 and ISO 27001 on its compliance page, and audits by Cure53, ETH Zurich, Unit 42 and Fracture Labs in 2025 on its audit page.

Bitwarden's own self-hosted server is the official way to run Bitwarden yourself. It needs an installation id and key from Bitwarden (install guide), at least 2 GB of memory for its standard set of containers, with 4 GB recommended, and its paid features come from your organisation's licence: only Families and Enterprise organisations can be moved to a self-hosted server (self-host an organisation), and the Teams plan does not list self-hosting. Its smaller single-container edition, Bitwarden lite, is "intended for personal use and home-labs, not for use in business contexts" (Bitwarden lite). The server's code is AGPL 3.0, with some parts under Bitwarden's own licence (licence). We did not run it.

What you give up compared with 1Password and Bitwarden

Moving to your own server keeps your passwords in Sweden, costs a fixed server price instead of a price per user, and nobody can change the plans under you. But be honest about what you leave behind:

• Someone on call. If the server is down, nobody can read a password that isn't cached: in Passbolt, nobody at all. 1Password and Bitwarden run their services with staff on call and status pages; with your own server, the person on call is you. Keep the backups current and know how to restore them.
• Support and audits of your setup. Bitwarden's servers and apps, and 1Password, are audited every year and certified for SOC 2 and ISO 27001. Vaultwarden's server has had two audits we know of, Passbolt's several, and your own server, Caddy and backups have had none. For Vaultwarden there is no company to call, and its README asks you not to take its problems to Bitwarden's support.
• Paid features for free, with a catch. Vaultwarden has organisations, event logs, emergency access and directory sync without a licence, but it follows Bitwarden's apps, and a Bitwarden change can break it until Vaultwarden catches up.
• Polish. 1Password's Travel Mode, Secret Key and admin reports, and Bitwarden's passkey login and recovery through single sign-on, have no equal in the free versions here.
• Email. Both need a working email account: Passbolt for every new user, Vaultwarden for invites, emergency access and some two-step methods.

Which one to pick

Coming from Bitwarden, or wanting the apps people know: Vaultwarden. Your staff keep the Bitwarden extension and apps, the export imports as it is, and organisations, collections, attachments, offline access and event logs cost nothing, in 10 MB of memory. Its weak points are its unofficial status, with no support and few audits, a departed member who keeps both their offline copy and the organisation's key, read-only access that only hides passwords in the apps, events that are off until you switch them on, and our guide's missing email and restore steps. Follow the Vaultwarden guide; it runs on a VC-P Alloy with room for much more.

Coming from 1Password, or sharing between many people with different access: Passbolt. Passwords are encrypted for each person separately, removing a person removes their copies, nothing readable stays on a laptop, and Passbolt SA publishes its audits and sells Pro with support when you need account recovery or single sign-on. Its weak points are an extension that everyone must install, no offline passwords and no attachments, a 1Password import that dropped our one-time codes, no account recovery and no activity log in the interface without Pro, and about 200 MB of memory. Follow the Passbolt guide, on a VC-P Alloy.

Together they used about a quarter of a gigabyte, so one VC-P Alloy runs either one, or both, next to your other apps.