# Vaultwarden Hosting in Germany from €3.25/mo > Self-host Vaultwarden, the Bitwarden-compatible password manager, in one click. SQLite on a 1 GB disk in Germany, invite-only sign-ups, about €3.25 a month. [Templates](/templates) Vaultwarden # One-click Vaultwarden hosting Self-hosted Vaultwarden A password manager you run yourself, with the Bitwarden apps you may already use. Passwords, passkeys, 2FA codes and shared vaults for your family or team, kept on your own disk in Germany. Nobody can sign up on your URL: you invite the people who get an account. [ Deploy on Runsite](https://dashboard.runsite.app/templates)[ View on GitHub](https://github.com/runsite-platform/runsite-vaultwarden-template) Runs on the €5 starting credit, valid for 90 days. No card needed to try it. vault.yourfamily.com ![Vaultwarden web vault listing logins for Booking.com, Deutsche Bahn, Figma and GitHub with folders and collections in the sidebar](/templates/vaultwarden/vault-light-2560.webp)![Vaultwarden web vault listing logins for Booking.com, Deutsche Bahn, Figma and GitHub with folders and collections in the sidebar](/templates/vaultwarden/vault-dark-2560.webp) The template €0 MIT; Vaultwarden itself is AGPL-3.0 Running it €3.25/mo Nano web service and a 1 GB disk Where it runs Germany No limit on users or items ## What you get after the deploy Every screenshot here comes from this template running on a laptop, with a made-up vault for a small Berlin coffee roastery. vault.yourfamily.com ![Vaultwarden login item for GitHub showing a username, a hidden password and a live six-digit verification code](/templates/vaultwarden/item-light-2560.webp)![Vaultwarden login item for GitHub showing a username, a hidden password and a live six-digit verification code](/templates/vaultwarden/item-dark-2560.webp) ### Passwords and one-time codes in one place Each login can hold its TOTP secret, so the six-digit code sits next to the password and the extension copies it right after filling the login. On bitwarden.com that needs a paid plan; Vaultwarden includes it. vault.yourfamily.com ![Vaultwarden organization with collections named Suppliers, Social media, Shop and Office](/templates/vaultwarden/collections-light-2560.webp)![Vaultwarden organization with collections named Suppliers, Social media, Shop and Office](/templates/vaultwarden/collections-dark-2560.webp) ### Share with family or a small team An organization holds collections that members can see or edit. Here a coffee roastery keeps its shop, supplier, social media and office logins apart. vault.yourfamily.com ![Vaultwarden reused passwords report listing Booking.com, DeepL, Netflix and Spotify Family, each reused twice](/templates/vaultwarden/reports-light-2560.webp)![Vaultwarden reused passwords report listing Booking.com, DeepL, Netflix and Spotify Family, each reused twice](/templates/vaultwarden/reports-dark-2560.webp) ### Find the passwords you reused Reused, weak and http-only passwords, plus logins that offer two-step login you have not turned on. The checks run in your browser on the decrypted vault. vault.yourfamily.com ![Vaultwarden new text Send with a Wi-Fi password, a seven-day deletion date and a maximum access count of one](/templates/vaultwarden/send-light-2560.webp)![Vaultwarden new text Send with a Wi-Fi password, a seven-day deletion date and a maximum access count of one](/templates/vaultwarden/send-dark-2560.webp) ### Hand over a secret once Send shares a text or a file through a link that expires. Set it to one view, and the link is dead once the new hire has opened it. vault.yourfamily.com ![Vaultwarden admin panel with three registered users, two of them invited, and an invite form](/templates/vaultwarden/admin-light-2560.webp)![Vaultwarden admin panel with three registered users, two of them invited, and an invite form](/templates/vaultwarden/admin-dark-2560.webp) ### Users, invitations and settings at /admin Vaultwarden's own panel, protected by ADMIN\_TOKEN. Invite people, see when they were last active, sign them out everywhere or disable an account. Switch the site theme to see Vaultwarden in dark mode. ## Keep the Bitwarden apps Vaultwarden answers the same API as Bitwarden's servers, so you don't install anything new. Point the official apps at your URL and they sync with it. * Browser extension Chrome, Firefox, Safari, Edge * Desktop Windows, macOS, Linux * Mobile iOS and Android, with autofill * CLI bw, for scripts and servers Moving from another manager? In the web vault open Tools, Import and pick the export of 1Password, KeePass, LastPass, a browser or a Bitwarden account. Each device keeps an encrypted copy of the vault, so it still opens if the server is briefly down. Log in to Bitwarden Server URL https://vault.yourfamily.com Email address lena@vogel-roesterei.de The same two fields in the extension, the desktop app and the phone app. Set once per device. ## What one click sets up A repository, a web service and a disk, already connected. No database server: Vaultwarden keeps the vault in SQLite on the disk, which is how most people run it. * Your own GitHub repository A copy of the template in your account. It pins the Vaultwarden version, so an update is a one-line commit. €0 Stays yours if you leave Runsite * [Web service](/services/web-services) Runs the official vaultwarden/server image behind HTTPS. It uses about 35 MB of memory when idle. Variables it fills in * `ADMIN_TOKEN` * `PUBLIC_URL` €3/mo Nano plan: 0.1 vCPU, 256 MB * Persistent disk 1 GB mounted at /data. The SQLite database, the signing key, attachments and Sends all live here. \~€0.25/mo Can be made larger later Billed by the hour at the normal Runsite rates. about €3.25 a month Every plan is on the [pricing page](/pricing). Try it on €5 of credit Every new account gets €5, valid for 90 days from sign-up. No card needed. At about €3.25 a month, Vaultwarden runs on it for roughly 46 days. [ Deploy Vaultwarden](https://dashboard.runsite.app/templates) Sign-upDay 90, credit expires Around day 46 the €5 is spent and the service stops. Its data is kept for 7 days, so a top-up from €5 brings it back as it was. ## Only people you invite get an account Out of the box, Vaultwarden lets anyone who finds the URL register. The template turns public sign-ups off before the first start, so your vault is not an open door while you are still reading the docs. * ### The admin panel has its own key ADMIN\_TOKEN is 48 random characters, generated for your deploy. Delete the variable to turn /admin off completely. * ### Company domain only, if you want Set SIGNUPS\_DOMAINS\_WHITELIST to your domain and colleagues can register without an invite. Everyone else still can't. Vaultwarden Admin INVITATIONS\_ALLOWEDtrue Invite user jonas@vogel-roesterei.de Invite Without SMTP no email goes out: the invited address simply registers on your URL. ## Everything lives on one disk The disk survives redeploys and updates. If it is missing or read-only, the start script stops with an error instead of running a vault that loses data on the next deploy. /data 1 GB persistent disk db.sqlite3 Accounts, vault items, folders, organizations If lost: Everyone has to restore from an export rsa\_key.pem The key that signs login tokens If lost: All devices are signed out, nothing else attachments/ Files attached to vault items If lost: Attachments are gone, the items stay sends/ Files shared through Send If lost: Open Send links stop working config.json Settings saved in /admin If lost: The environment variables apply again Vault items in the database are encrypted by the apps before they arrive. A copy of the disk without your master passwords is a pile of ciphertext. ## Back it up two ways Runsite does not snapshot the disk, so take your own copies. Both of these take a minute. ### Encrypted export In the web vault, Tools, Export vault, encrypted JSON. It restores into any Bitwarden-compatible server. Each person exports their own vault; organization owners export shared items. ### Full server copy In the dashboard, web service, Shell. The command writes a consistent copy of the database next to the original; download it with `rsa_key.pem`, `attachments/` and `sends/`, then delete old copies so they don't fill the disk. $ /vaultwarden backup Backup to '/data/db_20261026_101500.sqlite3' was successful $ ls /data attachments db.sqlite3 db_20261026_101500.sqlite3 icon_cache rsa_key.pem sends ## Nano is enough here Vaultwarden idles at about 35 MB. Nano sleeps after 14 days without traffic, and the first request wakes it; your devices keep working from their local copy in between. * Nano 256 MB, €3/mo Recommended. A family or a small team. Apps sync whenever they unlock, so a vault in use rarely sleeps. * Starter 512 MB, €5/mo Never sleeps, for a vault that has to answer at once even after weeks of quiet. * Standard 1 GB, €12/mo Hundreds of users and lots of attachments. Most setups never get here. ## From click to first login You fill in nothing before the deploy. The admin token and the public URL are set for you. 1. ### Click Deploy The Nano web service and the 1 GB disk both run on the €5 starting credit, so you can try Vaultwarden before you top up. 2. ### Name the project and the repository Runsite copies the template into your GitHub account, creates the service and the disk and starts the first build. 3. ### Copy ADMIN\_TOKEN Web service, Environment. It is 48 random characters, generated once for this deploy. 4. ### Invite yourself at /admin Open your service URL with /admin, paste the token, go to Users and invite your email address. 5. ### Create your account Open the service URL, choose Create account and register with the invited email and a long master password. Then open the Bitwarden app on your phone, choose Self-hosted and enter the same URL. Any other [Vaultwarden setting](https://github.com/dani-garcia/vaultwarden/blob/main/.env.template) can be added in the web service environment; saving redeploys the service. ## Updating Vaultwarden The version is pinned in the Dockerfile. Change the number, commit and push; Runsite rebuilds and Vaultwarden migrates the database on start. # Dockerfile ARG VAULTWARDEN_VERSION=1.37.4 Run a backup first. Migrations are not undone if you go back to an older version. ## The same setup in Docker The repository ships a docker-compose.yml with a volume for /data, so you can try a change on your laptop before you push it. $ docker compose up --build # open http://localhost:8080/admin and invite yourself Recent web vault builds refuse to create an account over plain http, even on localhost. For a local test, put a proxy with a self-signed certificate in front, such as Caddy with internal certificates. ## What this template does not do ### Backups are yours to take The disk is not backed up for you. Export the vault or copy a /vaultwarden backup off the server on a schedule you can keep. ### One instance Vaultwarden runs as a single replica and the disk attaches to one service. For a password manager that serves a team, that is plenty. ### No email until you add SMTP Invitations still work without it: the invited address registers directly. Email 2FA, emergency access and password hints need SMTP. ### About the license The template files are MIT. Vaultwarden is open source software by Daniel García and contributors under the [GNU AGPL-3.0](https://github.com/dani-garcia/vaultwarden/blob/main/LICENSE.txt). It is not associated with Bitwarden, Inc. Bitwarden is a trademark of Bitwarden, Inc. ## Questions How much does it cost to self-host Vaultwarden on Runsite? About €3.25 a month: €3 for a Nano web service and roughly €0.25 for the 1 GB disk. The template is free. Billing is hourly, and the €5 starting credit, valid for 90 days, runs it for about 46 days. Is Vaultwarden the same as Bitwarden? No. Vaultwarden is an independent server written in Rust that speaks the same API as Bitwarden, so the official Bitwarden apps and extensions work with it. It is not made by or affiliated with Bitwarden, Inc. The web vault it serves is a patched build of the Bitwarden web client. Which Bitwarden paid features does Vaultwarden include? TOTP codes in vault items, file attachments, vault health reports, emergency access and organizations with collections are all available without a subscription. Organizations have no seat limit; the disk is the only ceiling. Can the server read my passwords? No. The apps encrypt every vault item with a key derived from your master password before it is sent, so the database on the disk holds only encrypted data. The flip side: nobody, including the admin, can reset a lost master password. How do I connect the Bitwarden app to my server? On the login screen of the browser extension, desktop or mobile app, open the region menu, pick Self-hosted and enter your service URL, for example https://vault.yourfamily.com. Then sign in with your email and master password. Can I use my own domain? What about passkeys? Yes. Attach a domain such as vault.yourfamily.com to the web service and set PUBLIC\_URL to it. Passkeys and security keys are bound to the domain, so do this before anyone registers them. I lost the admin token. What now? Put a new value in ADMIN\_TOKEN in the web service environment and save; the service redeploys and the old token stops working. Vault data is not affected, because the token only opens the /admin panel. Can I use PostgreSQL instead of SQLite? Yes. Create a PostgreSQL database in the same project and set DATABASE\_URL on the web service. The disk stays, because the signing key, attachments and Sends are files. Switching later does not move data, so decide before people start using it. Can I run the same setup with Docker elsewhere? Yes. The repository is a thin layer over the official vaultwarden/server image and ships a docker-compose.yml. docker compose up --build starts it on your laptop or any server, with an optional PostgreSQL profile. Running it on your own server? The [Vaultwarden Docker Compose guide](/blog/vaultwarden-docker-compose) covers HTTPS, the admin token and a full backup. ## Your app deserves to be online €5 of credit on signup. Deploy in under a minute. No credit card needed. [Start deploying](https://dashboard.runsite.app/login)[View documentation](https://docs.runsite.app) --- Source: https://runsite.app/templates/vaultwarden