Somebody on a forum once asked me why I'd bother running my own password vault when Bitwarden's cloud costs three dollars a month. Fair question. My answer after two years of hosting my own: because a breach at a third party is not something I can fix from my side of the fence, and because I got tired of trusting a company's incident response with the keys to my entire digital life.
That said, the self-hosted open source password manager space has a trap in it that almost nobody explains properly. I'll get there. First, the landscape.
Key takeaways
- Vaultwarden is the pragmatic pick for most homelabbers: it fits in under 200 MB of RAM and speaks the Bitwarden client protocol, so Android, iOS, and browser extensions just work.
- Passbolt and Psono are built for teams, not individuals — and their licensing is subtler than "open source" suggests.
- KeePassXC can be self-hosted only in the sense that you sync an encrypted .kdbx file yourself through Nextcloud or Syncthing. No web service at all.
- Psono's free tier caps out at 10 users before you pay.
- The biggest risk in self-hosting isn't the software. It's that you become the single point of failure for your own recovery.
Self-hosted open source password managers, compared honestly
Here's the thing about the phrase "open source password manager." It gets used for two very different animals. One is a genuinely liberal-licensed server you can fork, audit, and run forever. The other is an open core product where the clients are public but the server has proprietary enterprise bits bolted on.
Both have their place. But you should know which one you're installing before you migrate 400 credentials into it.
Vaultwarden
Vaultwarden is a Rust reimplementation of the Bitwarden server API. It is not affiliated with Bitwarden. That's the part people skim past. It works because the official Bitwarden clients — Android, iOS, Firefox, Chrome, desktop apps — talk to a documented API that Vaultwarden mimics closely.
What it costs you in resources is almost nothing. I ran it on a 1 GB VPS alongside two other services for the better part of a year and never saw it climb past 150 MB. Docker image, single database, done.
The catch? A Bitwarden client update can break compatibility, and you'll find out when your phone won't sync. Pin your client versions if you're cautious. I didn't, and got lucky — but I've seen the outage threads.
Passbolt
Passbolt is aimed squarely at teams and it shows in every design decision. Sharing is a first-class citizen: you create a password, you grant it to a group, permissions are auditable. It uses OpenPGP under the hood, which is either elegant or exhausting depending on your taste.
It needs MySQL or MariaDB, a fairly heavy PHP stack, and a browser extension for everyone. For a solo user, that's a lot of moving parts for little payoff. For a 15-person agency with a compliance-minded client base, it's a reasonable fit.
Psono and the rest
Psono sits in the same "team-first" bucket as Passbolt, with SAML and LDAP support in the paid tiers. Free for up to ten users, then it's a subscription. Nothing wrong with that model — just don't call it fully free and open if you need it at scale.
Beyond those, you'll run across Padloc (clean, smaller community) and Proton Pass (not self-hostable; you use their infrastructure). Worth knowing they exist so you don't waste an evening hunting for a deployment guide that doesn't exist.
Which one actually fits your situation
Stop comparing feature lists for ten minutes. Ask three questions instead: how many people need access, do you need SSO, and how much RAM does your box actually have free?
| Tool | Sweet spot | Typical RAM footprint | Native team sharing | Licensing reality |
|---|---|---|---|---|
| Vaultwarden | Solo users, families, small homelabs | ~100–200 MB | Yes, via Bitwarden organizations | Fully open source (unofficial reimplementation) |
| Bitwarden (official server) | Teams wanting vendor support | 2 GB+ with MSSQL | Yes | Open core — server has proprietary modules |
| Passbolt | Teams with audit requirements | 1 GB+ | Yes, group-based | Open core, community edition limited |
| Psono | Teams needing LDAP/SAML | 1–2 GB | Yes | Free up to 10 users, then paid |
| KeePassXC + sync | One person, maximum control | None (no server) | File sharing only | GPL, fully open |
My honest recommendation: if you're one person, Vaultwarden. If you're a team of five or more with IT budget, Passbolt or Psono. If you distrust servers entirely, KeePassXC plus a Syncthing folder.
Can I self-host KeePassXC?
Not in the way you're probably imagining. KeePassXC has no server component, no web interface, no API. It's a local application that writes an encrypted .kdbx database file.
What you can do is host the sync layer. Drop the .kdbx into a Nextcloud instance, a Syncthing folder, or a git repo you control, and every device opens the same encrypted file. The encryption happens on your machine before the bytes ever leave it, so your sync provider — even if it's a cloud service — only ever sees ciphertext.
I ran this setup for about eight months. It worked flawlessly. The failure mode I hit was merge conflicts: edit the file on your laptop and your phone while offline, and you get to pick which password survived. That's a real risk with a vault of 300+ entries, and it's why I eventually moved to Vaultwarden.
What is the 8 4 rule for passwords?
The 8 4 rule is a common security guideline stating that a password should be at least 8 characters long and include 4 different character types: uppercase letters, lowercase letters, numbers, and symbols.
Is it good advice? Meh. It reflects an older mindset, and it pushes people toward predictable patterns — Password1! satisfies the rule perfectly and is cracked in seconds. If you're running your own vault, you don't need to memorise anything anyway. Generate 20-plus random characters, or a five-word passphrase, and let the tool handle it. The 8 4 rule matters most for the one password you do memorise: your master password.
Can you really host your own password manager?
Yes, and it's easier than it was a few years ago. A Vaultwarden deployment is about twenty minutes if you're comfortable with Docker, a domain name, and a reverse proxy for HTTPS. And HTTPS is not optional — Bitwarden clients will refuse to talk to a plain HTTP endpoint outside localhost.
In practice, you want:
- A cheap VPS or a home server (a 1 GB instance is plenty for Vaultwarden)
- Caddy or Nginx handling TLS certificates automatically
- A real backup routine for the SQLite database — and I mean tested restores, not just copies sitting in a folder
Which brings up the part nobody enjoys. Your vault is now your responsibility. No support line. If your disk dies at 2 a.m., you're the incident response team. I keep an encrypted export on a USB stick in a drawer, refreshed monthly. It's not elegant. It is effective.
What is the best open-source password manager in 2026?
For most people asking this question, the answer is Vaultwarden. Not because it's the most feature-complete, but because the official Bitwarden clients give you a polished experience across every platform — including Android — while you keep the server on hardware you control.
If your needs are organisational rather than personal, Passbolt edges ahead on sharing and audit trails. If you want zero server footprint, KeePassXC with a synced database remains unbeatable for simplicity.
And if you're honest with yourself and realise you don't want to babysit a server, paying for a managed service isn't a moral failure. The point of self-hosting is control. If maintaining that control costs you more than it's worth, you've answered your own question.
The thing I keep coming back to: a password manager you actually use beats a theoretically superior one you abandon after the third broken update. Pick the one you'll still be running in eighteen months.
