Last updated: March 21, 2026

Self-hosting a password manager keeps your credentials off someone else’s server. The tradeoff is that you own the operational burden. backups, updates, uptime. This comparison covers the four most practical options: Vaultwarden, KeePass/KeePassXC, Passbolt, and Padloc.

Table of Contents

The Four Options at a Glance

  Vaultwarden KeePassXC Passbolt Padloc
Server required Yes No (file-based) Yes Yes
Team/sharing Yes Manual Yes (built for teams) Yes
Mobile app Bitwarden app KeePass apps Official app Official app
Browser extension Bitwarden ext. KeePassXC-Browser Official ext. Official ext.
Emergency access Yes (via Bitwarden) No No No
Setup difficulty Medium Low Medium-High Medium
License GPLv3 GPL AGPLv3 GPLv3

Option 1 - Vaultwarden

Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. It’s the most popular self-hosted option because it unlocks all Bitwarden premium features (TOTP, encrypted attachments, organizations) without a subscription.

Quick Setup with Docker

docker run -d \
  --name vaultwarden \
  -e DOMAIN="https://vault.yourdomain.com" \
  -e SIGNUPS_ALLOWED=false \
  -e ADMIN_TOKEN=$(openssl rand -base64 48) \
  -v /opt/vaultwarden/data:/data \
  -p 8080:80 \
  --restart unless-stopped \
  vaultwarden/server:latest

Pair with Caddy for automatic HTTPS:

vault.yourdomain.com {
    reverse_proxy localhost:8080
}

After first-user signup, set SIGNUPS_ALLOWED=false and INVITATIONS_ALLOWED=false to prevent public registration.

Best for - Individuals or small families who want the full Bitwarden feature set without a subscription, and are comfortable managing a VPS or home server.

Option 2 - KeePassXC

KeePassXC is a local database encrypted with AES-256 or ChaCha20. There is no server. the .kdbx file is your vault. You sync it yourself via cloud storage, Syncthing, or a network share.

Database Setup

Install
sudo apt install keepassxc   # Debian/Ubuntu
brew install keepassxc       # macOS

Create a new database via GUI or CLI
keepassxc-cli db-create --set-password vault.kdbx

Add an entry
keepassxc-cli add vault.kdbx "GitHub" --username myuser --generate-password

Get an entry (prompts for DB password)
keepassxc-cli show vault.kdbx "GitHub"

Sync with Syncthing (recommended):

Install Syncthing on both devices and share the folder containing vault.kdbx. Set conflict resolution to “keep both”. KeePassXC handles merge conflicts with its own mechanism.

Best for - Security-conscious individuals who prefer zero network exposure and are comfortable with manual sync. Also good for air-gapped environments.

Option 3 - Passbolt

Passbolt is built for teams. It uses OpenPGP for end-to-end encryption. each password is encrypted with the public keys of people who have access. Even the server admin can’t read your passwords.

Docker Compose Setup

version: "3.8"
services:
  passbolt:
    image: passbolt/passbolt:latest-ce
    restart: unless-stopped
    depends_on:
      - db
    environment:
      APP_FULL_BASE_URL: https://passbolt.yourdomain.com
      DATASOURCES_DEFAULT_HOST: db
      DATASOURCES_DEFAULT_DATABASE: passbolt
      DATASOURCES_DEFAULT_USERNAME: passbolt
      DATASOURCES_DEFAULT_PASSWORD: strongpassword
      EMAIL_TRANSPORT_DEFAULT_HOST: your-smtp-host
      EMAIL_DEFAULT_FROM: no-reply@yourdomain.com
    volumes:
      - gpg_volume:/etc/passbolt/gpg
      - jwt_volume:/etc/passbolt/jwt
    ports:
      - "8080:80"
      - "8443:443"

  db:
    image: mariadb:10.11
    environment:
      MYSQL_DATABASE: passbolt
      MYSQL_USER: passbolt
      MYSQL_PASSWORD: strongpassword
      MYSQL_RANDOM_ROOT_PASSWORD: "true"
    volumes:
      - database_volume:/var/lib/mysql

volumes:
  database_volume:
  gpg_volume:
  jwt_volume:

Create the first admin after startup:

docker compose exec passbolt su -m -c "/var/www/passbolt/bin/cake \
  passbolt register_user \
  -u admin@yourdomain.com \
  -f Admin \
  -l User \
  -r admin" -s /bin/sh www-data

Best for - Small development teams or organizations that need proper sharing controls and can manage a more complex setup.

Option 4 - Padloc

Padloc is a newer option with a clean UI and E2E encryption. The server is optional. the client runs in the browser or as a desktop app with local storage.

Docker Setup

docker run -d \
  --name padloc \
  -e PL_PWA_URL=https://padloc.yourdomain.com \
  -e PL_EMAIL_SERVER=smtp.yourdomain.com \
  -e PL_EMAIL_PORT=587 \
  -e PL_EMAIL_USER=noreply@yourdomain.com \
  -e PL_EMAIL_PASSWORD=yoursmtppassword \
  -v /opt/padloc/data:/data \
  -p 3000:3000 \
  padloc/server:latest

Best for - Users who want a modern interface and are fine with a smaller environment.

Security Considerations for All Options

Regardless of which option you pick:

Which to Choose

Frequently Asked Questions

Can I use the first tool and the second tool together?

Yes, many users run both tools simultaneously. the first tool and the second tool serve different strengths, so combining them can cover more use cases than relying on either one alone. Start with whichever matches your most frequent task, then add the other when you hit its limits.

Which is better for beginners, the first tool or the second tool?

It depends on your background. the first tool tends to work well if you prefer a guided experience, while the second tool gives more control for users comfortable with configuration. Try the free tier or trial of each before committing to a paid plan.

Is the first tool or the second tool more expensive?

Pricing varies by tier and usage patterns. Both offer free or trial options to start. Check their current pricing pages for the latest plans, since AI tool pricing changes frequently. Factor in your actual usage volume when comparing costs.

How often do the first tool and the second tool update their features?

Both tools release updates regularly, often monthly or more frequently. Feature sets and capabilities change fast in this space. Check each tool’s changelog or blog for the latest additions before making a decision based on any specific feature.

What happens to my data when using the first tool or the second tool?

Review each tool’s privacy policy and terms of service carefully. Most AI tools process your input on their servers, and policies on data retention and training usage vary. If you work with sensitive or proprietary content, look for options to opt out of data collection or use enterprise tiers with stronger privacy guarantees.

Related Articles