Managed Vaultwarden hosting

Collaboration and identityOn-prem or your region

A password manager for the whole organisation, compatible with the Bitwarden apps, on a server you choose and with vaults only your people can decrypt. Pilae runs it on your own servers, or in Zurich, Switzerland, and eleven other Pilae Cloud regions.

Talk to us about Vaultwarden

Licence: AGPL-3.0
Runs on: Your own hardware, or any of 10+ Pilae regions — six of them in Switzerland and the EU
Upgrades: Pinned, tested against your configuration, applied in your window
Upstream: github.com

Running Vaultwarden in production: what it takes

Pin and deploy
A Vaultwarden release we have tested, on a dedicated machine or your own hardware, with open sign-up switched off and the admin page restricted to the private network.
Set the policies
Master password strength, required second factor, organisation policies and emergency access configured to your security rules.
Back up and restore
Database and data directory backed up daily, encrypted again and stored at a second site in the same jurisdiction. Once a month we restore both into a scratch server and unlock a test vault against the restored copy.
Watch and alert
Probes every 60 seconds on the web vault and API, plus machine metrics. Alerts reach a Pilae engineer around the clock, because a password server that is down stops people working.
Upgrade in your window
Vaultwarden follows changes in the Bitwarden clients. We test each release against the current browser extension and mobile apps, then the Pilae Agent applies it in your window after you approve.

What Vaultwarden is, and who runs it

Self-hosted password manager, operated for you

Vaultwarden is a password server compatible with the Bitwarden apps. Your people use the official Bitwarden browser extension, desktop and mobile apps, pointed at your own server. They get autofill, a password generator, shared collections, second factor codes, secure notes and encrypted file sharing through Send. It is a lightweight, independent server written in Rust, published under AGPL-3.0, and not associated with Bitwarden, Inc.

We operate it on a dedicated machine in any of 10+ Pilae Cloud regions, six of them in Switzerland and the EU, or on your own hardware, on premises or air-gapped. Vaultwarden answers on your private network, with the admin page never exposed. You receive deployment, policies, backups, monitoring and upgrades under one contract.

A 1Password and LastPass alternative you host

Teams move their passwords off 1Password or LastPass when credentials must stay in a jurisdiction they choose, when the choice of a hosted vault provider has become a board-level question, or when the per-user bill no longer makes sense. The move is covered above and on the 1Password alternative page, and our migration service runs it at a fixed price.

Encrypted on the device, backed up offsite

Vault items are encrypted by the clients before they reach the server, so the server holds only ciphertext. We still treat it as the most sensitive service we run. Backups are daily, encrypted and stored at a second site in the same jurisdiction, and restored every month with a test vault unlocked against the copy, as described on our backups page. Probes run every 60 seconds.

Upgrades you approve

The Pilae Agent plans each Vaultwarden upgrade, takes a verified backup, waits for your approval and applies it in your window. Every step is recorded in the audit log in the console. Managed operations include a monthly availability commitment with service credits from the Business plan. See pricing, or talk to us about moving your team’s passwords.

Vaultwarden system requirements

Before anything is deployed, this is what has to exist. We size it with you in the first session, and we say so when your own hardware is already enough.

CPU and memory: 1 vCPU · 1 GBVaultwarden is written in Rust and is light. A few thousand users fit on a small machine; the sizing is for headroom, not load.
Database: PostgreSQLVaultwarden also runs on SQLite or MySQL. We use PostgreSQL so the database is backed up and restored like every other one we run.
Data directory: Persistent volumeHolds attachments, Send files and the server key that signs sessions. It is backed up with the database.
Mail: SMTP relayFor invitations, email second factor, emergency access and new-device notices.
DNS and TLS: 1 hostnameThe Bitwarden clients require HTTPS. The hostname is what every device is configured with, so it is chosen once.
Access: Private network or gate on 443Laptops reach it over your private mesh; phones can come through the one hardened gate. The admin page is reachable only on the mesh.

Migrating from 1Password to Vaultwarden

Leaving 1Password is done by each person or by an administrator, from an export, because a vault can only be exported by someone who can decrypt it. 1Password exports to its own 1PUX format or to CSV, and the Bitwarden clients that talk to Vaultwarden import both. Logins, secure notes, cards and identities come across. Shared vaults become organisation collections, and we set those up with you before anyone imports, so shared items land in the right place. Attachments and passkeys need checking item by item, and TOTP seeds come across only where the export includes them. The export file is plaintext, so we give your people a short procedure: export, import, verify, delete the file.

Design the collections
Which shared vaults exist today, who uses each, and how they map to Vaultwarden organisations, collections and groups.
Invite and enrol
People are invited by email, create their account and master password, and install the Bitwarden browser extension and mobile app pointed at your server.
Import personal and shared vaults
Each person imports their own export; an administrator imports shared vaults into collections. Plaintext export files are deleted on the same day.
Close the old account
After a parallel period for people to confirm nothing is missing, the 1Password or LastPass subscription is cancelled.

What a Vaultwarden backup contains

postgres/
- vaultwarden.dumpusers, organisations, encrypted items
data/
- rsa_key.pemsession signing key
- attachments/encrypted by the client
- sends/encrypted by the client
- config.jsonadmin settings
manifest.txtchecksums, restore test 2026-09-01: ok

An example of the contents of one nightly Vaultwarden backup. Vault items are stored encrypted by the clients, so the backup holds ciphertext the server itself cannot read.

What Pilae is responsible for

A pinned version

A version we have run, not whatever latest resolves to that day.

A runbook

What it depends on, how it fails, what to do about it. In your repository.

A restore drill

Backups restored on a schedule. A backup nobody has restored is a file.

A patch window

Security updates in a window you agreed, with a rollback ready.

Someone watching

Every endpoint probed on the minute. An alert reaches a person, not a dashboard nobody opens.

Where it runs: zur1, fra1, fal1, gra1, ams1, hel1, lon1, ash1, hil1, sin1, tok1, syd1, on-premZurich, Frankfurt, Falkenstein, Gravelines, Amsterdam, Helsinki, London, Ashburn, Hillsboro, Singapore, Tokyo, Sydney, Your own hardware
Who holds the credentials: You do. Ours are separate, named, logged and revocable with one command. We ask before anything changes outside an agreed window.
If you leave: The machine, the data, the compose files and the runbook are already yours. Nothing stops when our access does.

What running Vaultwarden costs

On Starter, Vaultwarden runs in Pilae Cloud for CHF 449EUR 479USD 559 a month, hosting and onboarding included. On Business, it is one of up to three apps for CHF 1,590EUR 1,690USD 1,990 a month, on your own servers or in Pilae Cloud. Enterprise is quoted. The plans set what each includes; these are the inputs that move the price around them.

Instance size: The CPU, memory and, where a model runs, the GPUs the app needs for your users and your data.
High availability: One machine with tested restores, or a replicated setup that keeps serving when a node fails.
Storage and backups: How much data it holds, how long backups are kept, and point-in-time recovery for its database.
Plan and support: Starter, Business or Enterprise: support hours, response times in the contract and how often we review the service with you.
Region: Your own hardware, where the infrastructure is already yours, or a Pilae Cloud region, where machines are priced per month. On Starter, Pilae chooses the site.
Sign-on and integrations: Single sign-on, directory sync, mail relays and the other systems the app has to reach.

Vaultwarden: common questions

Is Vaultwarden the same as Bitwarden?

No. Vaultwarden is an independent, unofficial server that implements the Bitwarden API and is not associated with Bitwarden, Inc. It works with the official Bitwarden browser extensions, desktop, mobile and command-line clients. Bitwarden also publishes its own self-hosted server, which is heavier and licenses some features commercially.

Can Pilae read our passwords?

No. The Bitwarden clients encrypt every item on the device with a key derived from the master password before it reaches the server. The server, our engineers and our backups hold only ciphertext. Losing a master password therefore means losing that vault, unless emergency access or admin recovery was set up.

Can we import from 1Password or LastPass?

Yes. The Bitwarden clients import 1Password exports in 1PUX or CSV format and LastPass CSV exports. Shared vaults become organisation collections. Export files are plaintext, so we give your people a procedure that ends with deleting them.

Can people sign in with Keycloak or Entra ID instead of a master password?

Alongside it, not instead of it. Vaultwarden now supports sign-in through OpenID Connect, which covers Keycloak and Entra ID. The master password still unlocks the vault on the device, because it is what the encryption keys are derived from. Your identity provider then governs who can sign in, and a leaver disabled in your directory can no longer log in.

What happens when someone leaves?

An administrator removes them from the organisation, and they lose access to every shared collection at once. Their personal vault stays theirs to export or delete. Shared passwords they had seen should still be rotated, as with any password manager.

Back to apps

Bring us your Vaultwarden. We will tell you what it takes.

Thirty minutes on the deployment you already have, or the one you are about to start.

Start with one workload Book a 30-minute briefing