Vaultwarden vs Bitwarden vs Passbolt (2026)

TL;DR: Vaultwarden is my pick for individuals and small teams, official Bitwarden is the safer supported choice for businesses, and Passbolt is strongest when team credential sharing is the whole job.

Choosing a self-hosted password manager is not really a choice between three similar login screens. Vaultwarden, Bitwarden, and Passbolt have different operational costs, support models, and ideas about who owns a credential.

I tested all three on Docker on July 25, 2026. Vaultwarden was dramatically lighter, Bitwarden Lite provided the official Bitwarden server in one container, and Passbolt brought the most team-oriented workflow but also the most moving parts. This comparison uses those measurements alongside current official documentation and pricing.

Disclosure: this comparison contains no affiliate links. I have run Vaultwarden in production; the Bitwarden Lite and Passbolt results below come from fresh isolated test deployments.

Vaultwarden vs Bitwarden vs Passbolt: quick answer

Vaultwarden wins for most self-hosters, but it is not the universal winner. Use official Bitwarden when vendor support and exact client compatibility matter more than resource use. Use Passbolt when credentials belong to teams, groups, and shared folders rather than primarily to individuals.

These are cold-start snapshots, not capacity benchmarks. I measured each stack immediately after its health endpoint or web UI became available. Database cache, traffic, attachments, audit events, and user count will change the numbers.

How I tested the three password managers

I used the same idle x86-64 server and the same measurement method for every deployment. The host ran Ubuntu 24.04, Docker 29.6.1, two or more available cores, and 8 GB RAM. Each web port bound only to 127.0.0.1; none of the test instances was exposed publicly.

For Vaultwarden, I ran vaultwarden/server:1.37.0 with SQLite on a temporary filesystem and disabled public signups. Its /alive endpoint answered after two seconds, the web vault returned HTTP 200, and docker stats reported 8.0 MiB.

For Bitwarden, I tested the current Bitwarden Lite image with SQLite. Lite is the single-container deployment formerly called Unified. The web vault returned HTTP 200 after ten seconds and used 162 MiB. Bitwarden's documentation specifies at least 200 MB RAM and 1 GB storage, so I would budget above my empty-vault measurement.

For Passbolt, I used its official CE topology: Passbolt 5.13.0 plus MariaDB 10.11. The database took six seconds to accept connections; the app health endpoint returned a success response seven seconds later. The app used 63.5 MiB and MariaDB 317.8 MiB at that snapshot.

Every temporary container, network, and downloaded test image was removed after the measurements. The production ByteGuard stack was not involved.

Why choose Vaultwarden?

Choose Vaultwarden when you want the Bitwarden client experience with the smallest practical server footprint. It is an independent Rust implementation of the Bitwarden client API, not a stripped-down official Bitwarden build.

Vaultwarden bundles a modified web vault and works with the official Bitwarden browser, desktop, mobile, and CLI clients. Its documented feature set includes personal vaults, Send, attachments, organizations, collections, groups, event logs, several 2FA methods, and emergency access. A single-container SQLite deployment is easy to understand and easy to include in a filesystem backup.

The operational advantage is hard to ignore. My empty test instance used about one twentieth of Bitwarden Lite's memory. On a small VPS already running a reverse proxy and monitoring, that leaves useful headroom.

The cost is the support boundary. Vaultwarden is unofficial, and Bitwarden explicitly says it cannot guarantee every official client feature against a non-official server. That warning became concrete this week: Vaultwarden 1.37.0 is required for Bitwarden clients 2026.7.0 and newer and includes several security fixes. An unattended, old Vaultwarden instance is not a low-maintenance win.

For deployment details, use my Vaultwarden Docker guide, then put the service behind HTTPS and disable open registration.

Vaultwarden pros

• Lowest measured resource use and simplest backup surface
• Familiar, polished Bitwarden clients on every major platform
• Rich personal and small-organization feature set without a per-seat server fee
• SQLite by default, with PostgreSQL and MySQL/MariaDB available

Vaultwarden cons

• No official Bitwarden support
• Compatibility can lag a new Bitwarden client release
• The operator must track security releases and test backups
• Easy installation can encourage unsafe exposure of /admin or public signups

Why choose official Bitwarden?

Choose official Bitwarden when supportability is a security requirement, not an optional convenience. Bitwarden Lite has removed much of the old "resource-heavy official stack" objection for personal and home-lab use.

Lite supports SQLite, PostgreSQL, MySQL/MariaDB, and MSSQL and runs in one container. It still requires a Bitwarden installation ID and key, a TLS deployment, and more configuration than Vaultwarden. My test image was about 795 MB and the running container used 162 MiB, but that is reasonable on a modern VPS.

The official route matters most for organizations. Bitwarden lists Teams at $4/user/month and Enterprise at $6/user/month when billed annually. Its pricing page places the self-host option in Enterprise, along with policies, custom roles, passwordless SSO, and account recovery. The vendor maintains the server and clients together and can support failures across that boundary.

There is an important distinction: Bitwarden says Lite is for personal use and home labs, not business deployments. Businesses should evaluate the standard deployment and its license rather than treating Lite as a free shortcut to the Enterprise feature set.

Bitwarden pros

• Server and clients maintained by the same vendor
• Broadest polished client ecosystem of the three
• Lite makes an official personal deployment practical on modest hardware
• Enterprise policies, SSO, recovery, SCIM, and vendor support are available

Bitwarden cons

• Heavier than Vaultwarden in my like-for-like single-container test
• Business self-hosting is tied to the Enterprise plan
• Standard deployment is more complex and uses MSSQL by default
• Installation IDs, licensing, SMTP, TLS, and backups add operational work

Why choose Passbolt?

Choose Passbolt when controlled team sharing is more important than managing a personal vault. Its interface and security model are built around users, groups, shared folders, roles, and explicit transfer of access.

Passbolt Community Edition is free, AGPLv3-licensed, and allows unlimited users. It includes password sharing, users and groups, private and shared folders, role-based access control, browser extensions, mobile apps, a CLI, an open API, TOTP, and password expiry. That is unusually generous for a team-focused self-hosted product.

The official Docker deployment adds MariaDB, persistent GPG and JWT material, SMTP, and correct system time. Passbolt recommends at least two cores, 2 GB RAM, and 20 GB storage. My empty instance was healthy quickly, but its combined memory was more than either one-container alternative.

Passbolt Pro currently costs €4.50/user/month billed annually with a ten-user minimum. It adds LDAP, SSO, account recovery, audit activity, policies, SCIM, and business support. That makes the free-to-paid boundary easy to explain: Community is capable for a hands-on team; Pro buys identity integration, recovery, governance, and support.

Passbolt pros

• Team sharing and group ownership are first-class
• Community Edition is free for unlimited users
• Open API, CLI, roles, folders, and password-expiry features in CE
• Paid path adds the governance features businesses usually need

Passbolt cons

• More components and persistent key material to operate
• Higher measured combined memory than the other test stacks
• SMTP and accurate NTP are setup requirements, not optional polish
• Less natural than Bitwarden/Vaultwarden for a personal-first vault

Which is easiest to secure and back up?

Vaultwarden has the smallest backup surface, while official Bitwarden has the strongest vendor support model. Passbolt requires the most careful recovery runbook because its database and server-side cryptographic material must remain consistent.

Whichever one you choose:

1. Terminate TLS at a maintained reverse proxy and never publish the database.
2. Disable public registration after creating the intended accounts.
3. Require phishing-resistant 2FA where supported.
4. Pin or deliberately track versions; never leave latest unattended.
5. Back up the database, attachments, configuration, and cryptographic keys.
6. Restore the backup into an isolated instance and prove that login works.
7. Monitor the health endpoint and security release feed.

Start with the Docker security checklist, harden SSH access, and configure Nginx Proxy Manager without exposing admin ports. For off-site recovery, my restic and Backblaze B2 guide covers encrypted, versioned backups.

My recommendation

My overall self-hosting pick is Vaultwarden, with a firm size and support limit. I would use it for myself, a family, or a small trusted group where I control updates and recovery. Its 8 MiB test footprint, simple data layout, and official-client compatibility are excellent.

For a company that needs a support contract, enforced policies, predictable client compatibility, and an accountable vendor, I would buy Bitwarden Enterprise and use the supported deployment. Saving a few hundred megabytes is not worth creating an unsupported identity system for an employer.

For an infrastructure or operations team whose daily problem is sharing and revoking group credentials, I would trial Passbolt CE first. Its workflow is more deliberately collaborative than the personal-vault-first alternatives, and the unlimited-user Community Edition makes a real pilot possible.

FAQ

Is Vaultwarden the same as Bitwarden?

No. Vaultwarden is an independent, unofficial implementation of the Bitwarden server API. It works with official Bitwarden clients, but Bitwarden does not guarantee compatibility or provide support for the Vaultwarden server.

Is self-hosted Bitwarden free?

Bitwarden Lite is intended for personal and home-lab use and can be self-hosted, but business self-hosting and Enterprise capabilities require the appropriate paid plan. Confirm the current license terms before a company deployment.

Is Passbolt Community Edition really unlimited?

Passbolt lists Community Edition as free with unlimited users. LDAP, SSO, account recovery, activity logs, policies, SCIM, and vendor support sit in the paid Pro tier.

Which self-hosted password manager uses the least RAM?

Vaultwarden used the least RAM in my July 2026 empty-instance test: 8.0 MiB, compared with 162 MiB for Bitwarden Lite and 381 MiB for Passbolt plus MariaDB. Treat these as startup snapshots, not universal capacity figures.

Can I expose a password manager directly to the internet?

The user-facing HTTPS endpoint can be public, but the database and administrative interfaces should not be. Use a reverse proxy, rate limiting, strong 2FA, restricted admin access, monitored updates, and tested offline backups.

Conclusion

Vaultwarden, Bitwarden, and Passbolt solve three overlapping but different problems. Vaultwarden gives a self-hoster the best resource efficiency. Bitwarden gives an organization the cleanest support and compatibility story. Passbolt gives a technical team the most deliberate sharing workflow and a strong unlimited-user Community Edition.

The wrong choice is not the one that uses another 150 MiB of RAM. It is the one whose update, backup, and recovery model you will neglect. Pick the model you can operate on your worst week, write the restore procedure, and test it before the vault contains the only copy of anything important.

If you want the Vaultwarden route without spending a weekend on TLS, backups, and hardening, I offer a done-for-you VPS setup that includes the deployment and a handover checklist.

Sources and test notes

• Vaultwarden 1.37.0 release
• Vaultwarden project and features
• Bitwarden Lite deployment
• Bitwarden self-hosting options
• Bitwarden business pricing
• Passbolt CE Docker guide
• Passbolt server requirements
• Passbolt self-hosted pricing

Affiliate disclosure

There are no affiliate links in this comparison. The service link above points to ByteGuard's own VPS setup service.

— enim