Host Vaultwarden without installing anything
The Bitwarden server, made light: your official extensions and apps connect to it by changing a single address.
Starting at €4.99/month
Introduction
Vaultwarden installed, updated and backed up by us, on a machine in France. You install nothing and configure no server: the application is online a few minutes after you order, under your own name.
The plan that suits it is App Essentiel at €4.99/month incl. VAT — 2 GB of memory. Vaultwarden is written in Rust and keeps the vault in a SQLite database: it is one of the most frugal applications in the catalogue and stays comfortably below 512 MB in everyday use. The headroom goes to the rest — attachments stored on entries, exports, and the system underneath.
Vaultwarden speaks Bitwarden's protocol, and that is the whole point: the Firefox, Chrome, Edge and Safari extensions, the iOS and Android apps, the desktop client and the bw command line connect to it unmodified — you simply enter your server address before signing in. A vault exported from LastPass, 1Password, Dashlane or KeePass is imported back through the web vault in a few minutes. On mobile, instant syncing relies on Bitwarden's notification relay; without it, the app refreshes when you open it and on demand.
What managed hosting changes
The official Bitwarden clients, unmodified
Firefox, Chrome, Edge and Safari extensions, iOS and Android apps, desktop client, command line: these are the official Bitwarden applications. You type your server address on the sign-in screen, and nothing else changes.
Encrypted before it leaves your device
The key is derived from your master password (PBKDF2 or Argon2id) and never leaves the client: the server only ever holds ciphertext. That is also the trade-off — lose that password and nobody reopens the vault, ourselves included.
Organisations and shared collections
An "Accounting" collection, a "Management" one, permissions per user and per group. The team sharing that the hosted edition bills per seat is simply part of the software here.
TOTP codes, FIDO2 keys and expiring sends
Every entry can generate its own one-time code, sign-in accepts WebAuthn security keys, and Bitwarden Send hands over a password or a file with an expiry date.
Why hand it over rather than install it
A sole trader and twenty accounts
The bank, the insurer, the website, two suppliers, the telecom portal. It all sits in the vault and comes back on the phone, on site, without reopening a notebook.
A three-person practice
One collection shared with the accountant for billing logins, another kept for the partners. You grant access, you revoke it; nobody circulates a spreadsheet any more.
A club electing a new committee
The website, bank and social media credentials are handed over with the mandate, instead of living in a chat thread everyone forgets to delete.
An agency holding client credentials
One organisation per client, separate collections, and access revoked the day the contract ends — without having to rotate every password at once.
A team leaving a paid manager
The export from the previous manager is imported as-is. Users keep their apps and their habits: only the server address changes.
Hosted in France
A password vault is the most sensitive data an organisation holds. Yours sits in our own infrastructure in Nouvelle-Aquitaine, which we operate ourselves, and the person on the phone speaks your language.
Frequently asked questions
No — those are exactly the ones you keep. In the extension or the mobile app, before entering your username, open the environment settings, choose "self-hosted" and paste your instance address. The interface stays the same, because it is the same.
Export from the old manager, then open "Tools" and "Import data" in the web vault. The LastPass, Dashlane and browser CSV files, 1Password's 1pux format and KeePass 2 XML are all recognised. Delete the export file afterwards: it is in clear text.
The vault stays unreadable, including to us: decryption happens on your device and we only host encrypted data. Vaultwarden's answer to this is emergency access — you nominate a trusted person who can take over the vault after a delay you set. It has to be arranged before you need it.
Nothing. You choose the application, fill in the fields it asks for — often an email address and a name — and it goes online. Access arrives by email with the address and the credentials.
Yes, they are part of the service. Vaultwarden tracks changes in the Bitwarden protocol closely: staying up to date is also what keeps the official apps connecting without errors.