Best Self-Hosted Password Managers in 2026
Run your own vault server so your passwords never sit on someone else's cloud.
Vaultwarden is the default pick for most people: a lightweight, Rust-based server that speaks the official Bitwarden protocol and unlocks every premium feature for free. Bitwarden itself ships an official self-host image if you want vendor support instead of a community fork. KeePassXC skips servers entirely and keeps your vault as a local file you sync yourself. Passbolt and Psono target teams that need shared credentials with real access control, and Padloc is the simplest option if you want a modern web app without much server tuning.
Cloud password managers are convenient until you stop trusting the cloud part. A vendor breach, a pricing change, or a shutdown notice can put every credential you own at risk, and you have no way to verify what actually happens to your vault on their servers. Self-hosting removes that dependency: the encrypted database lives on hardware you control, whether that is a five-dollar VPS or a Raspberry Pi on your home network. From the 10,000+ tools Toolradar tracks, these are the password managers you can self-host, so your vault never leaves your server.
Every tool below was checked for three things: the server (or sync layer) genuinely runs on infrastructure you own, the project is open source so you can audit what it does with your data, and it is still actively maintained in 2026. We verified licensing and self-host instructions directly against each project's own docs and GitHub repos rather than relying on marketing pages, and we dropped anything where "self-hosted" turned out to mean "your data still sits in the vendor's cloud."
Top Picks
Based on features, user feedback, and value for money.
| Tool | Starting price | Rating | Best for |
|---|---|---|---|
| Vaultwarden | Free | n/a | Anyone who wants Bitwarden's apps and browser extensions without running Bitwarden's ow... |
| Bitwarden | From $1.65/mo | 4.6(1,629) | Teams or individuals who want the vendor-maintained server instead of a community fork,... |
| KeePassXC | Free | 4.6(236) | Users who want zero cloud dependency and are comfortable syncing a single encrypted vau... |
| Passbolt | From $4.86/mo | 4.5(47) | Teams that need shared credentials with folder-level permissions and don't want a paid... |
| Psono | Custom | n/a | Small businesses that want a full-featured team vault without a per-seat license fee on... |
| Padloc | Free plan | n/a | Users who want a clean, simple web app and are fine running an official server plus SMT... |
Anyone who wants Bitwarden's apps and browser extensions without running Bitwarden's own (heavier) server stack.
Vaultwarden's pricing is exceptionally generous, as it is entirely free.
Watch out
Requires technical knowledge for setup and maintenance
Teams or individuals who want the vendor-maintained server instead of a community fork, with official support available.
Bitwarden is the best value in password management, period.
Watch out
Self-hosting requires server infrastructure, expect $5-20/month for a VPS plus maintenance time. Most users are better off with the hosted version.
Users who want zero cloud dependency and are comfortable syncing a single encrypted vault file themselves.
KeePassXC offers an exceptionally fair and generous pricing model, as it is completely free.
Watch out
None, it's genuinely free
Teams that need shared credentials with folder-level permissions and don't want a paid SaaS subscription.
Passbolt offers a very generous free tier with unlimited users and core password management features, making it highly accessible.
Watch out
Business tier requires yearly billing.
Small businesses that want a full-featured team vault without a per-seat license fee on the self-hosted build.
Psono's pricing is opaque, as both 'On Premise' and 'SaaS' tiers require users to 'Contact us' for a quote.
Watch out
Potential high custom quote for SaaS
Users who want a clean, simple web app and are fine running an official server plus SMTP for email verification.
Padloc offers a very generous free tier with unlimited vault items and devices, making it accessible for individual users.
Watch out
Family plan storage capped at 1GB
Other Password Managers worth considering
Beyond the editorial top picks, these are also strong choices we evaluated.
What Is a Self-Hosted Password Manager?
A self-hosted password manager runs its server component, and stores its encrypted vault, on infrastructure you control instead of a vendor's cloud. Most still use a client-server model: you deploy the server (usually via Docker), then connect official or compatible apps and browser extensions to your own domain. A smaller category, like KeePassXC, has no server at all: the vault is a single encrypted file that you sync yourself over Syncthing, a private cloud folder, or a WebDAV server.
What all of them share is end-to-end encryption: the server (or file) only ever stores ciphertext, and the master password that decrypts it never leaves your device.
Why Self-Hosting a Password Manager Matters
Your password vault is the single highest-value target an attacker or a careless vendor could touch: it is the master key to your email, banking, and every other account you own. Self-hosting means a hosted-service breach at a third party cannot expose your vault, because there is no copy of it outside your own server. It also removes the risk of a company pulling free-tier features, discontinuing a product, or getting acquired and changing its privacy terms overnight.
The tradeoff is operational: you are responsible for backups, updates, and uptime. A self-hosted server that nobody patches is worse than a managed one that gets patched automatically, so this only pays off if you are willing to actually maintain it.
Key Features to Look For
The code that handles your encrypted vault should be publicly auditable, not a closed binary you have to trust blindly.
Look for real browser extensions and mobile apps, not just a web login, or you will end up copy-pasting passwords.
The server should only ever store ciphertext; decryption happens on your device with a key it never sees.
A documented docker-compose setup with clear environment variables saves hours versus building from source.
Check recent commits and release dates; an abandoned self-hosted server is a liability once a vulnerability surfaces.
If you're hosting for a family or company, look for folders, groups, and permission levels, not just a single shared vault.
Mistakes to Avoid
- ×
Exposing the admin panel or unauthenticated setup page to the public internet instead of locking it behind a VPN or IP allowlist.
- ×
Skipping automated, tested backups of the vault database, so a disk failure means every password is gone for good.
- ×
Running an old container image for months because self-hosting removed the vendor's automatic security patching, not the need for patching.
- ×
Choosing a file-based tool like KeePassXC for a team, then improvising sharing over email or chat instead of a client-server manager built for it.
- ×
Forgetting that self-hosting shifts liability to you: if your server is compromised, there is no vendor incident response team to call.
Expert Tips
- →
Put the server behind a reverse proxy with automatic TLS (Caddy or nginx plus certbot) from day one; never run the vault over plain HTTP.
- →
Set up off-site backups (not just a snapshot on the same VPS) since a lost vault is unrecoverable without your master password anyway.
- →
For Vaultwarden and Bitwarden, enable the built-in admin token and disable public sign-ups once your users are created.
- →
If you choose KeePassXC, use Syncthing instead of a third-party cloud folder if you want sync without any external server at all.
- →
Watch each project's GitHub releases for security advisories; self-hosted software only stays safe if you actually apply the updates.
The Bottom Line
For most people, Vaultwarden is the easiest path to a fully self-hosted vault that still works with Bitwarden's polished apps, while KeePassXC is the right call if you want no server at all. Teams that need shared credentials with real access control should look at Passbolt or Psono instead. From the 10,000+ tools Toolradar tracks, these are the password managers you can self-host, so your vault never leaves your server.
Frequently Asked Questions
What is the best self-hosted password manager?
Vaultwarden is the most widely recommended option because it is lightweight, free, and fully compatible with the official Bitwarden apps and browser extensions. Bitwarden's own official self-host image is a solid alternative if you want vendor-maintained code instead of a community fork. Teams often prefer Passbolt or Psono for their sharing and permission controls.
Is Vaultwarden safe to use instead of official Bitwarden?
Yes, when kept updated and run behind TLS. Vaultwarden is an open-source Rust reimplementation of the Bitwarden server API, so the client-side encryption model is the same as official Bitwarden; the server never sees your master password. The main risk is operational, not cryptographic: you are responsible for patching and backups instead of the vendor.
Do I need a server to self-host a password manager?
Not necessarily. KeePassXC has no server component at all; your vault is a single encrypted file you sync manually or with a tool like Syncthing. Every other option here, Vaultwarden, Bitwarden, Passbolt, Psono, and Padloc, does require a server, typically deployed with Docker.
Is self-hosting a password manager actually free?
The software is free in every case here: Vaultwarden, Bitwarden's self-host image, KeePassXC, Passbolt Community, Psono Community, and Padloc are all open source with no license fee for self-hosting. You still pay for the infrastructure, typically a few dollars a month for a small VPS, plus your own time for setup and maintenance.
Which self-hosted password manager is best for a small team?
Passbolt and Psono are built specifically for teams, with folder-level sharing and no per-user limit on their free Community editions. Vaultwarden also supports organizations and shared collections if your team already prefers the Bitwarden client experience.
Related Guides
Ready to Choose?
Compare features, read reviews, and find the right tool.