Vaultwarden vs Bitwarden
Vaultwarden vs Bitwarden compared for self-hosting: licences, resource needs, databases, Bitwarden Lite, which features need a paid licence, SSO, support and update risk, using Vaultwarden 1.37.4 and Bitwarden server v2026.10.0.
Quick Answer
Pick Vaultwarden if you self-host for yourself, your family or a small team and want every server feature free: it is an AGPLv3 Rust re-implementation of the Bitwarden server API that works with the official Bitwarden apps, runs as one container on SQLite, and includes organizations, groups, event logs, emergency access, attachments, Send and OIDC SSO without a licence. Pick official Bitwarden if you need vendor support, the first-party server or business features like SCIM: self-hosting is free, Bitwarden Lite runs in one container on 200 MB of RAM, but paid features need a licence file and business self-hosting requires Enterprise at $6 per user per month (billed annually).
Last updated October 27, 2026. Covers Vaultwarden 1.37.4 (5 Oct 2026) and Bitwarden server v2026.10.0 (14 Oct 2026), with Bitwarden's personal and business pricing, self-hosting, Lite and licensing docs as of 27 Oct 2026.
| Feature | Vaultwarden | Bitwarden |
|---|---|---|
| Licence | AGPL-3.0 | AGPL-3.0 core + source-available Bitwarden License for enterprise modules |
| Maintainer | Community (not affiliated with Bitwarden, Inc.) | Bitwarden, Inc. |
| Latest Release (Oct 2026) | 1.37.4 (5 Oct 2026) | Server v2026.10.0 (14 Oct 2026) |
| Deployment | Single container (ghcr.io, docker.io, quay.io) or binary | Standard (multi-container, Docker Compose) or Lite (single container) |
| Minimum Resources | Not specified; one Rust process with SQLite | Standard 2 GB RAM, 12 GB disk min; Lite 200 MB RAM, 1 GB disk |
| Databases | SQLite (default), MySQL/MariaDB, PostgreSQL | Standard: MSSQL; Lite: SQLite, MySQL/MariaDB, PostgreSQL, MSSQL |
| Clients | Official Bitwarden clients + bundled patched web vault | Official Bitwarden clients |
| Premium / Org Features When Self-Hosted | All implemented features free, no licence file | Licence file from a paid cloud subscription |
| Business Self-Hosting | Free (community software, no SLA) | Enterprise only ($6/user/month, annual) |
| SSO | OIDC (master password still required) | SAML 2.0 / OIDC on Enterprise |
| Directory Sync / SCIM | Directory Connector; SCIM not listed | Directory Connector and SCIM (Teams and Enterprise) |
| Server Admin | /admin panel with ADMIN_TOKEN | Installer script + web vault organization settings |
| Support | Community: GitHub, Matrix, Discourse | 24/7 email; priority on paid plans |
| Price | $0 | Free self-host; Premium $19.80/yr; Families $47.88/yr; Enterprise $6/user/mo |
Vaultwarden
Community-built alternative server for the Bitwarden client API, written in Rust and licensed AGPLv3. Formerly bitwarden_rs, it is not associated with Bitwarden, Inc. and bundles a patched build of the Bitwarden web vault.
Pros
- Every server feature is free: organizations with collections, groups, member roles, event logs, policies and admin password reset, plus emergency access, attachments, Send and the personal API key
- Works with the official Bitwarden browser, desktop, mobile and CLI clients
- One container with SQLite by default; MySQL/MariaDB and PostgreSQL are also supported
- OIDC SSO built in (SSO_ENABLED, SSO_ONLY), with the master password still required for decryption
- Simple backups: the data folder plus a built-in vaultwarden backup command for SQLite
- Admin panel at /admin to manage users, organizations, invites and settings, protected by an Argon2-hashable token
Cons
- No vendor support: the project asks users not to contact Bitwarden support, and there is no release schedule
- Server updates can be required when Bitwarden clients move: 1.37.0 was needed for clients 2026.7.0+ and 1.37.2 for 2026.8.0+
- Security fixes are frequent and you must apply them promptly; 1.37.4 (5 Oct 2026) fixed seven advisories, one rated High (8.1)
- SCIM and Bitwarden Secrets Manager are not listed among its features; directory sync uses Bitwarden's Directory Connector
- HTTPS is mandatory for the web vault, and the project recommends a reverse proxy in front
Best For
Homelabbers, families and small teams who want a free, low-resource self-hosted Bitwarden-compatible server and are comfortable patching it themselves.
Bitwarden
Commercial open-source password manager from Bitwarden, Inc. The server is AGPLv3 except enterprise modules such as SSO under the source-available Bitwarden License. It can be self-hosted as a standard multi-container deployment or as Bitwarden Lite, a single container for personal and home-lab use.
Pros
- First-party server from the same company that builds the clients, so client and server releases are designed together
- Self-hosting is free, and Bitwarden Lite runs in a single container with at least 200 MB RAM on x86 or ARM, using SQLite, MySQL/MariaDB, PostgreSQL or MSSQL
- Low paid tiers: Premium $19.80 a year, Families $47.88 a year for 6 premium accounts, and paid features work self-hosted with a licence file
- Enterprise adds SAML 2.0 or OIDC SSO, SCIM, policies, custom roles, account recovery and a free Families plan for every user
- Vendor support: 24/7 email support for everyone and priority support on paid plans
- Standard deployment supports an external database and is the path Bitwarden recommends for businesses
Cons
- Business self-hosting needs Enterprise at $6 per user per month billed annually; Teams ($4) cannot be self-hosted
- Paid features on a self-hosted server need a licence file from a cloud subscription, and an organization licence must be updated within 60 days of renewal or the organization is disabled
- The standard deployment needs 2 GB RAM minimum (4 GB recommended), 12 GB storage and MSSQL Express, which caps relational data at 10 GB
- Every install, Lite included, needs an installation ID and key from bitwarden.com/host
- Bitwarden Lite is for personal and home-lab use, and SSO, SCIM and event logs are off by default there
Best For
Companies that need a supported, first-party self-hosted password manager with SSO and SCIM, and individuals who want the official server with Bitwarden support.
Same apps, different servers and licences
Both run behind the same official Bitwarden browser extensions, desktop and mobile apps and CLI. What differs is the server. Bitwarden's server repository is AGPLv3 by default, but code under the bitwarden_license directory, which includes Commercial.Core and the SSO integration, is under the source-available Bitwarden License: you may read and test it, but production use requires a paid subscription. Bitwarden's licensing FAQ says this license does not meet the OSI open-source definition. Vaultwarden is a separate, community-written implementation of the Bitwarden client API in Rust, licensed AGPLv3. It was called bitwarden_rs until it was renamed to avoid trademark confusion. Its README says it is not associated with Bitwarden, Inc., though one active maintainer works at Bitwarden and contributes on their own time. It ships a patched build of Bitwarden's web vault, and its FAQ says it will not build custom clients or add features that need client changes. The consequence is simple: Vaultwarden can only offer what the official clients already support, and when Bitwarden changes the clients, Vaultwarden has to catch up.
Resources and databases: one container either way now
Bitwarden's standard Linux deployment is a set of Docker containers managed by Docker Compose. Minimum requirements are an x64 1.4 GHz CPU, 2 GB RAM and 12 GB storage, with a 2 GHz dual core, 4 GB RAM and 25 GB recommended, plus Docker Engine 26 or newer. It bundles MSSQL Express, which supports up to 10 GB of relational data, and standard deployments require MSSQL. Bitwarden Lite, which exited beta in December 2025 (it was called Bitwarden Unified), is one Docker image that needs at least 200 MB RAM and 1 GB of storage, runs on ARM devices such as Raspberry Pi and NAS boxes, and works with SQLite, MySQL/MariaDB, PostgreSQL or MSSQL. Bitwarden says Lite is for personal use and home labs, not businesses, and that some services, including SSO, SCIM and event logs, are off by default. Vaultwarden has always been one container. It defaults to SQLite and also supports MySQL/MariaDB and PostgreSQL, with a documented but unsupported pgloader migration from SQLite. It does not publish minimum specs. The real comparison for a homelab is now Vaultwarden versus Bitwarden Lite, and the deciding factors are licensing and support rather than RAM.
What you pay for features on your own server
Bitwarden says self-hosting is free, but some features must be unlocked with a licence file. You download the file from your cloud account or organization and upload it to your server. Premium costs $19.80 a year ($1.65 a month) and adds the integrated authenticator, file attachments, emergency access and vault health reports. Families costs $47.88 a year for 6 premium accounts with unlimited sharing and collections. Only Families and Enterprise organizations can be self-hosted. Teams, at $4 per user per month billed annually, cannot. Enterprise, at $6 per user per month billed annually, adds SSO, enterprise policies, custom roles, account recovery and a free Families plan per user. Organization licences must be refreshed within 60 days of renewal or the organization is disabled. Vaultwarden needs no licence. Its README lists organizations with collections, sharing, member roles, groups, event logs, admin password reset, Directory Connector and policies, plus emergency access, attachments, Send, website icons and two-factor methods including FIDO2 WebAuthn, YubiKey and Duo. For a 20-person company that wants to self-host with SSO, the difference is $1,440 a year for Bitwarden Enterprise versus $0 for Vaultwarden plus the time to run and patch it.
SSO, directory sync and admin
Bitwarden Enterprise supports passwordless SSO with any identity provider using SAML 2.0 or OpenID Connect, and Bitwarden says SSO keeps zero-knowledge encryption because decryption stays separate from authentication. Teams and Enterprise both include the Directory Connector and SCIM provisioning, event logs retained indefinitely, the Public API and Duo-enforced two-step login. Vaultwarden's SSO is OpenID Connect only. You set SSO_ENABLED, the authority URL, client ID and secret, and optionally SSO_ONLY to turn off email and master-password login. Its docs are explicit that a master password is still required and is not controlled by the SSO provider. Identities are linked by the issuer and subject claims, and there are settings to control email matching and sign-up. SCIM is not among its listed features, so provisioning is through invitations, the admin panel or Bitwarden's Directory Connector. Server administration happens in the /admin panel, unlocked by an ADMIN_TOKEN that can be stored as an Argon2 PHC hash. Admin sessions are JWTs that last 20 minutes by default.
Support, updates and security risk
This is where the choice should be made. Bitwarden is a company with 24/7 email support, priority support on paid plans and dedicated onboarding for qualified Enterprise customers. Its server and clients are released together; server v2026.10.0 shipped on 14 Oct 2026 alongside the October clients. Vaultwarden is run by volunteers. Its FAQ says there is no release schedule, and issues seen with Vaultwarden must not be reported to Bitwarden. Client changes regularly force server upgrades: release notes say 1.37.0 is required for clients 2026.7.0 and later, and 1.37.2 for clients 2026.8.0 and later. Security fixes are also frequent. 1.37.0 fixed advisories including SSRF via the icon endpoint and cross-organization cipher access, and 1.37.4 on 5 Oct 2026 fixed seven, including organization member revocation rated High at 8.1. The project handles these responsibly, but you have to watch releases and update quickly. If nobody on your team will do that, the official server is the safer choice, whatever it costs.
Verdict
Choose Vaultwarden for a personal, family or small-team vault on your own server: it costs nothing, runs as one container on SQLite, uses the official Bitwarden apps, and unlocks organizations, groups, event logs, emergency access and OIDC SSO without buying a licence. The price is that you are the support team, so subscribe to its releases and patch quickly, because new Bitwarden clients and security advisories regularly require server updates. Choose official Bitwarden if a company depends on the vault or needs SCIM, SAML SSO, enterprise policies and vendor support: self-hosting a business organization requires Enterprise at $6 per user per month billed annually, and Teams cannot be self-hosted. For individuals who want the official server without the standard deployment's 2 GB RAM and MSSQL, Bitwarden Lite is now the first-party answer to Vaultwarden, and a $19.80-a-year Premium licence unlocks the premium features on it.