AltFreeStack
ESEN
Password Managersdocker-readyOpen-Core🟢 Lightweight · ~256MB

Bitwarden (self-hosted): Open-Core alternative to 1Password in 2026

Bitwarden offers its full official server for self-hosting, with all the features of the cloud version (organizations, SSO, security reports) on your own infrastructure.

Core is open source, but advanced features or enterprise support may be behind a paid tier — check the license.

ℹ️ Bitwarden migrated its official self-hosting image from bitwarden/self-host (Docker Hub) to ghcr.io/bitwarden/lite (a single container). We've updated the image and version, but haven't verified the new container's environment variables one by one — check Bitwarden's official deployment guide before running this in production.

Alternative to 1PasswordAlternative to LastPass
License AGPL-3.020.3k starsWebsite GitHub Repository

Audit Snapshot

View notes →

  • License — Not verifiable on GitHub

  • GitHub — Active

  • Latest release — v2026.9.2 · 13 days ago

  • Docker Compose — Partial

  • Production — Not production-tested by AltFreeStack

Bitwarden (self-hosted) vs. 1Password

Pros

  • It's the official server, with direct support from Bitwarden

Things to consider

  • Considerably heavier on resources than Vaultwarden

Quick Docker installation guide

Copy this docker-compose.yml, adjust the example passwords and run docker compose up -d on your server. See the full step-by-step guide →

💡 Official SaaS or self-hosted with AltFreeStack?

  • On the official cloud: $7.99/mo per user on 1Password.
  • On your own VPS: the core is free to self-host on your own server — no more monthly SaaS fee, though some advanced features stay behind a paid plan.
docker-compose.yml
version: "3.9"
services:
  bitwarden:
    image: ghcr.io/bitwarden/lite:2026.9.0
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      - globalSettings__baseServiceUri=http://localhost:8080 # CHANGE THIS TO YOUR DOMAIN
    volumes:
      - bitwarden_data:/etc/bitwarden
volumes:
  bitwarden_data:

🚀 Deploy in 1 command

Recommended for beginners

Copy this single command and paste it into your freshly created VPS's console (Vultr, DigitalOcean...). It downloads the script, prints it to your screen so you can see exactly what it's about to do (never a blind direct pipe), and only then installs Docker if needed, writes the files with secrets already generated, and starts everything — no nano, no pasting code blocks.

curl -sSL ".../api/deploy?stack=bitwarden-self-hosted" -o deploy.sh && cat deploy.sh && bash deploy.sh
See what this script does →

This docker-compose corresponds to an actively maintained project — last commit today.

This docker-compose not working for you? Report it on GitHub →

Technical profile

License
AGPL-3.0
Category
Password Managers
Replaces
1Password, LastPass
Tech stack
.NETSQL Server

Under the hood

Database

SQL Server / PostgreSQL / MySQL / SQLite

Language

C# (.NET)

Platforms

Web · Desktop (Mac/Win/Linux) · Mobile (iOS/Android)

Key features

  • Organizations and enterprise groups
  • Security reports and SSO
  • All the features of the official cloud version

Preview

Bitwarden (self-hosted) interface preview

Public image provided by Bitwarden (self-hosted) on its own website.

💾 Backups in 3 steps (Day 2)

As long as the ./data folder (the "volume" mapped into the container) exists on your server, your data survives any restart or container update — that's the only thing you need to back up.

1. Create a compressed backup on the server

tar -czvf backup-$(date +%F).tar.gz ./data

2. Download it to your computer

From your computer's terminal (not your server's):

scp root@YOUR_IP:~/app/backup-*.tar.gz ./

3. Restore in case of emergency

tar -xzvf backup-file.tar.gz
🌐 Connect your domain with free SSL

Step 1 — Set up the DNS

In your domain registrar's dashboard (Cloudflare, Namecheap, GoDaddy...), create a record:

Type
A
Name/Host
@ (root domain) or a subdomain, e.g. app
Content/Value
Your server's public IP

Wait 5 to 15 minutes for the record to propagate across the internet.

Step 2 — Automatic reverse proxy with Caddy

One single file, no Nginx config or manual certificates — Caddy issues and renews Let's Encrypt HTTPS on its own.

Create a file called Caddyfile:

yourdomain.com {
    reverse_proxy localhost:8080
}

Start Caddy with this command (pulls the image and runs it in the background):

docker run -d -p 80:80 -p 443:443 --name caddy --restart always -v $PWD/Caddyfile:/etc/caddy/Caddyfile -v caddy_data:/data caddy