I need a password manager that supports self-hosting and does not rely on their cloud.

If you want a password manager that you run yourself and that does not depend on the vendor’s cloud, these are the strongest options:

My recommendations

Best overall: Vaultwarden

For a personal server or family setup, I would usually pick Vaultwarden.

Pros:

• Runs easily with Docker.
• Uses the mature Bitwarden ecosystem of apps.
• Lightweight enough for a Raspberry Pi, NAS, VPS, or home server.
• Your vault database stays on your machine.

Typical setup:

• Docker Compose
• Reverse proxy (Caddy, Nginx Proxy Manager, Traefik, etc.)
• HTTPS certificate
• Regular encrypted backups

Caveat:

• It is not the official Bitwarden server; it is a community-compatible implementation. Bitwarden notes that official clients generally work with Vaultwarden but support is limited compared with an official Bitwarden deployment.

Best polished/official option: Bitwarden self-hosted

Choose this if you want vendor-backed self-hosting.

Pros:

• Official apps and ecosystem.
• Docker-based deployment.
• Good for families, businesses, and teams.
• Open-source codebase.

Cons:

• More resource-heavy than Vaultwarden.
• More complicated to maintain.

Best "no server at all": KeePassXC

If you do not need live multi-user syncing:

• KeePassXC stores an encrypted vault file locally.
• You choose where it is stored.
• No account, subscription, or hosted service required.

A common setup is:

• KeePassXC on desktop
• KeePassDX/KeePass-compatible app on mobile
• Sync the .kdbx file with Syncthing or your own NAS

What I would avoid for your requirement

I would not choose:

• 1Password — excellent product, but fundamentally cloud-based.
• LastPass — cloud service.
• Dashlane — cloud service.
• Vendor "self-hosting" options that still require their authentication service.

Minimum security checklist for a self-hosted password manager

Regardless of choice:

• Use a strong master password/passphrase.
• Enable MFA (preferably a hardware security key).
• Keep the server patched.
• Back up the encrypted vault/database.
• Do not expose the admin interface publicly.
• Test restoring backups before you need them.

If you tell me your environment (Docker/NAS/Raspberry Pi/Linux server, number of users, and whether you need sharing), I can narrow this to the best fit.

If you want total control over your data with zero reliance on a commercial cloud, several stellar open-source and self-hosted password managers fit the bill . They range from lightweight server-client setups to completely serverless local files.

Top Self-Hosted Password Manager Options

• Vaultwarden : An unofficial, lightweight alternative server written in Rust that is compatible with official Bitwarden clients (browser extensions, mobile apps, and desktop apps). It consumes a tiny fraction of the RAM that the official Bitwarden self-hosted stack requires, making it the community favorite for personal or family self-hosting.
• KeePass (or KeePassXC) + Syncthing / Nextcloud : If you don't want to run a dedicated authentication server at all, KeePass stores your entire database in a local .kdbx encrypted file. You can sync this file across your devices yourself using Syncthing or Nextcloud , giving you 100% offline ownership with zero cloud infrastructure.
• Passbolt : An open-source password manager built specifically for teams and collaboration, heavily focused on OpenPGP technology. It features a great web interface and browser extension, though it requires a bit more configuration (like an SMTP server for invites).
• GoPass / Pass : A command-line password manager based on the standard Unix password store pass , utilizing Git for synchronization and GPG for encryption. Ideal if you prefer terminal workflows and explicit control over your Git remotes.

Are you looking for a solution with full GUI apps and browser extensions (like Vaultwarden), or would you prefer a file-based local database that you sync yourself (like KeePass)?

If you want a password manager that you can completely self-host—meaning zero reliance on an external vendor's cloud or servers—there are a few standout open-source options depending on your setup and needs:

• KeePassXC (or KeePass ecosystem) : The ultimate choice for local-only, offline security.
  • How it works : Your entire database is a single encrypted file (.kdbx) stored locally on your device. You can sync that file across your own devices using a local network share, Nextcloud, or Syncthing, but the app itself has no cloud backend.
  • Pros : 100% offline, highly secure, zero third-party dependency, open-source.
  • Cons : Manual syncing setup if you use multiple devices; no native slick web-based portal.
• Vaultwarden (formerly Bitwarden_RS) : An unofficial, lightweight server re-implementation of Bitwarden written in Rust.
  • How it works : It is fully compatible with official Bitwarden browser extensions and mobile apps, but runs on your own hardware (via Docker) and talks to your private server instead of Bitwarden's cloud.
  • Pros : Uses the polished Bitwarden client apps; consumes very minimal system resources; supports browser autofill, mobile apps, and multi-user setups seamlessly.
  • Cons : It is an independent community project, not officially supported by Bitwarden Inc. (though heavily trusted in the self-hosting community).
• Passbolt : An open-source password manager built specifically with self-hosting and team/collaboration in mind.
  • How it works : OpenPGP-based, deployable on-premises or via Docker, and offers great browser extensions with a strong focus on sharing credentials securely within a team or family.
  • Pros : Excellent UI for collaboration, robust audit logs, explicitly designed to be hosted on your own infrastructure.
  • Cons : Might be slightly overkill for a single individual just looking for a personal vault.

To help narrow down the best fit, tell me:

• Do you need multi-device syncing (phone, laptop, work PC) or just a single local vault?
• Are you looking for a lightweight Docker container (like Vaultwarden) or a completely offline file (like KeePassXC)?
• Is this for just you or a team/family?

Yes. If your requirement is “my passwords live on infrastructure I control, with no dependency on the vendor’s cloud,” there are a few good choices.

My top picks

🥇 I'd choose Vaultwarden

Vaultwarden is an independent, lightweight Rust implementation of the Bitwarden server API. You run it yourself, typically as a Docker container, and can use the official Bitwarden desktop, browser, and mobile clients against your own server.

The important distinction is that Vaultwarden isn't Bitwarden's official server. Bitwarden itself explicitly says it doesn't guarantee that its official clients will always work perfectly with non-official servers, although Vaultwarden is designed to be compatible with them.

For a homelab/NAS/VPS, I'd consider this the sweet spot:

• Docker/Podman deployment
• Very lightweight
• Your database and attachments stay on your machine
• Bitwarden-compatible apps
• 2FA, FIDO2/WebAuthn, organizations/sharing, etc.
• Open source
• No vendor subscription required
• You can keep the server entirely on your LAN if desired

One caveat: because you're responsible for the server, backups become your responsibility. Vaultwarden specifically recommends regular backups.

🥈 Official Bitwarden self-hosting

If you want the official Bitwarden server, that's also an option. Bitwarden provides Docker-based self-hosting and supports Linux and Windows deployments.

The downside is that the official stack is considerably heavier than Vaultwarden. Also, a normal Bitwarden self-hosted deployment can make outbound connections for things such as updates and push notifications. Bitwarden provides offline deployment instructions if you specifically don't want connections outside your infrastructure.

So if your definition of “does not rely on their cloud” is strict, official Bitwarden can meet that requirement, but I'd configure it carefully.

🥉 KeePassXC — if you don't actually need a server

There's another approach that's arguably even more independent: KeePassXC.

KeePassXC stores an encrypted .kdbx database locally and explicitly doesn't store anything on remote servers.

You can then put the encrypted database on your own NAS/Nextcloud/Syncthing setup and synchronize it between devices. KeePassXC itself deliberately doesn't implement cloud synchronization; it lets your chosen synchronization mechanism handle the file.

That's arguably the strongest answer if “no cloud” is the overriding requirement, but the user experience for multi-device sharing isn't quite as seamless as Bitwarden/Vaultwarden.

What I'd recommend

If this is for yourself/family:

Vaultwarden + Docker + HTTPS + regular automated backups.

If you're running a serious business/team deployment:

Official self-hosted Bitwarden or Passbolt, depending on your sharing/workflow requirements.

If you want absolute minimum infrastructure and maximum independence:

KeePassXC + your own file synchronization/backup system.

If you tell me what you're running it on (e.g. Synology, TrueNAS, Unraid, Raspberry Pi, Linux server, Windows Server, VPS) and whether you need iPhone/Android access, I can give you a specific setup I'd use.

Yes. If your requirement is “my password vault should live on my infrastructure, with no dependency on the vendor’s cloud”, there are several good choices.

My top picks

1. Bitwarden — best overall

• Official self-hosted server.
• Runs with Docker and supports Linux, Windows, and macOS hosts.
• Excellent clients: browser extensions, Windows/macOS/Linux, iOS and Android.
• Your vault can be entirely on your own server.
• Bitwarden's self-hosted architecture uses end-to-end encryption, so even Bitwarden can't read your vault.
• Downside: the full official server is relatively heavyweight.

Bitwarden now also has Bitwarden Lite, a single-container deployment aimed specifically at personal users and home labs.

bitwarden.com 2. Vaultwarden — best for a home server/NAS

• Lightweight Rust implementation of the Bitwarden server API.
• Designed specifically for self-hosting and works with official Bitwarden clients.
• Much easier on RAM/CPU than the official Bitwarden stack.
• Excellent choice for a Raspberry Pi, NAS, mini-PC, Proxmox VM, etc.
• Important: it is an independent, unofficial implementation, so Bitwarden doesn't guarantee compatibility/support.

github.com 3. Passbolt — best for teams

• Open-source and self-hostable.
• Specifically designed around sharing credentials securely among teams.
• I'd choose it over Bitwarden/Vaultwarden if your primary requirement is collaborative/team credential management.

What I'd choose

One important distinction: self-hosted doesn't necessarily mean “the software never talks to the Internet.” For example, updates, push notifications, email, or certificate issuance can involve external services depending on how you configure it. But the vault/database itself can remain entirely under your control.

If you tell me what you're running it on (e.g. Synology, TrueNAS, Proxmox, Docker, Raspberry Pi, Windows Server, or a VPS), I can recommend the best one and give you a secure setup architecture.

If you want a password manager that you can entirely self-host without depending on a third-party cloud infrastructure, there are two standout open-source options depending on your preference for a lightweight setup or an enterprise-grade official stack.

1. Vaultwarden (The Community Favorite for Self-Hosting)

• What it is: An unofficial, lightweight alternative server implementation of the Bitwarden API, written in Rust.
• How it works: It uses the official Bitwarden browser extensions, desktop apps, and mobile apps , but replaces the heavy backend server with a tiny, resource-efficient container.
• Why it fits: It runs easily on low-power hardware (like a Raspberry Pi or a small VPS), requires zero connection to Bitwarden's cloud, and consumes minimal RAM.
• Best for: Individuals, families, and small setups wanting the polished UI and app ecosystem of Bitwarden entirely on their own hardware.

2. Bitwarden Official Self-Hosted

• What it is: The official enterprise-grade self-hosted server stack provided by Bitwarden.
• How it works: Distributed via Docker, it runs the official complete backend.
• Why it fits: Fully supported by the company, though it is heavier on resource usage (recommending a decent amount of RAM and multi-container orchestration via Docker Compose).
• Best for: Power users, businesses, or homelabs that want official vendor support for their self-hosted infrastructure.

Alternative: Local-Only (Zero Server Required)

If by "self-hosting" you mean keeping your data entirely offline on your own devices without running a home server or Docker container:

• KeePassXC : A completely offline, open-source password manager. Your database is saved as a local encrypted file (.kdbx) on your machine. If you want to sync it across devices, you have to manually transfer the file or use your own private sync tool (like Syncthing or a local NAS)—no external cloud required.

To help narrow down the best choice, tell me:

• Do you want to use official mobile and browser apps (via Vaultwarden/Bitwarden)?
• Do you already have a Docker / homelab server set up?
• Or would you prefer a completely offline file-based approach like KeePassXC?

Yes. If your requirement is “my passwords live on infrastructure I control, with no dependency on the vendor’s cloud,” there are several good choices.

My top picks

1. Vaultwarden — my recommendation

Vaultwarden is a lightweight, Rust-based, self-hosted implementation of the Bitwarden server API. It works with the official Bitwarden clients, including browser, desktop, and mobile apps.

This is probably the sweet spot if you want:

• Docker/Podman deployment
• Your own server/NAS/VPS/Raspberry Pi
• Browser extensions
• iOS/Android apps
• Desktop apps
• Password sharing
• 2FA/passkeys
• Attachments
• No Bitwarden cloud account required

The important distinction is that Vaultwarden isn't the official Bitwarden server; it's an independent implementation of the Bitwarden API. Bitwarden itself notes that it cannot guarantee every official client feature will work perfectly with non-official servers.

For a personal or family setup, I'd strongly consider this first.

2. Official Bitwarden self-hosting

If you want the official Bitwarden server rather than Vaultwarden, Bitwarden supports deploying its server yourself with Docker.

The downside is that it's considerably heavier and more complicated than Vaultwarden. For a single person or family, I would generally choose Vaultwarden unless having official vendor support is particularly important.

3. KeePassXC — maximum independence

This is a fundamentally different approach. KeePassXC stores your encrypted password database as a file on your own devices and doesn't use a remote server at all. The project explicitly describes itself as cloud-free, with no remote password storage.

You can put the .kdbx database on something you control—NAS, Syncthing, USB drive, etc.—and access it from multiple devices.

I'd pick this if your priority is:

“I don't even want a password-manager server running.” The tradeoff is less seamless multi-device synchronization than Vaultwarden.

4. Passbolt

Passbolt is another open-source, self-hostable option, particularly aimed at teams and shared credentials. It supports running entirely on your own infrastructure, including behind your firewall or even in an air-gapped environment.

Its security model uses OpenPGP and keeps users' secret keys from being sent to the server in cleartext.

For an individual, though, I'd generally choose Vaultwarden or KeePassXC instead.

What I'd choose

If this were my setup:

Personal/family: → Vaultwarden

I want zero server/cloud dependency: → KeePassXC + Syncthing

Business/team: → Passbolt or official Bitwarden self-hosted

I want the Bitwarden ecosystem but insist on official software: → Bitwarden self-hosted

One important caveat: self-hosting doesn't eliminate the need for backups. With Vaultwarden/Bitwarden/Passbolt, your server becomes the thing you need to protect and back up. I'd use encrypted, offline/remote backups and make sure you can actually restore them before trusting it with your entire password vault.

If you tell me what you're planning to run it on (e.g. Synology, Unraid, Proxmox, Raspberry Pi, Windows, Linux server, VPS), I can recommend the simplest architecture and setup.

If you want total control over your data with zero reliance on third-party cloud infrastructure, there are a few standout self-hosted password managers depending on whether you want a lightweight server-client setup or a fully local file-based vault.

• Vaultwarden (formerly Bitwarden_RS)
  • What it is: An unofficial, incredibly lightweight server written in Rust that is fully compatible with the official Bitwarden browser extensions, desktop apps, and mobile clients.
  • Why it fits: It gives you the polished, seamless ecosystem experience of Bitwarden (auto-fill, cross-device sync) while running on a tiny footprint (ideal for a Raspberry Pi, home server, or mini PC). It doesn't require a paid subscription for advanced features like TOTP generation, which Bitwarden charges for on its official tier. [1][2]
• Bitwarden (Official Self-Hosted)
  • What it is: The official enterprise-grade self-hosted deployment provided by Bitwarden.
  • Why it fits: It's open-source and enterprise-ready, but it is heavier on resource usage (running via Docker with multiple containers) compared to Vaultwarden. Choose this if you need strict official enterprise compliance or support. [1][2]
• KeePassXC
  • What it is: A purely local, offline password manager.
  • Why it fits: There is no "server" component at all. Your database file (.kdbx ) lives entirely on your device. If you want multi-device synchronization without a third-party cloud, you host your own sync layer using local tools like Syncthing or a private Nextcloud instance. It is the ultimate choice if you don't want a web-accessible backend running 24/7.
• Psono
  • What it is: A secure, feature-rich open-source password manager built specifically for self-hosting, complete with team sharing and Single Sign-On (SSO) options.
  • Why it fits: Great if you are managing credentials for a larger household or small team and want robust access control entirely on your own hardware.

To help narrow down the best fit, let me know:

• Do you want seamless cross-device sync via a self-hosted server (like Vaultwarden), or a strictly offline local file (like KeePassXC)?
• What is your preferred hosting environment (Docker, a Raspberry Pi, or a local machine)?

If you want a secure password manager that you can completely self-host—keeping your data entirely on your own hardware without relying on a third-party cloud—here are the top options available, ranked by community consensus and usability:

1. Vaultwarden (Formerly Bitwarden_RS)
   • What it is: An unofficial, lightweight alternative server written in Rust that is fully compatible with official Bitwarden clients (browser extensions, mobile apps, and desktop apps).
   • Why choose it: The official Bitwarden self-hosted server is quite resource-heavy (requiring MS SQL and a larger footprint). Vaultwarden uses a tiny fraction of the memory/CPU, runs effortlessly in a single Docker container, and unlocks features like built-in TOTP/2FA autofill that require a paid subscription on official servers.
   • Cloud reliance: None. Your database lives on your local server/disk.
2. KeePass / KeePassXC (File-Based / Local Sync)
   • What it is: The classic offline password manager. Instead of running a server container, it stores your database in a single encrypted .kdbx file.
   • Why choose it: It is entirely local-first. You physically own the file. To sync across devices, you can move the file manually or sync it via your own private tools like Syncthing, a local Nextcloud instance, or a private SFTP server.
   • Ecosystem clients: KeePassXC for desktop, KeePassDX for Android, and Strongbox for iOS.
   • Cloud reliance: Zero. No server software or internet connection is required at all.
3. Bitwarden Official Self-Hosted
   • What it is: The official enterprise-grade self-hosted deployment provided by Bitwarden.
   • Why choose it: If you are running an organization or prefer strictly official software stacks, you can deploy Bitwarden's official containers on your own infrastructure. However, it requires significantly more heavy-lifting and hardware resources (Docker, MSSQL/PostgreSQL, proxy configurations) than Vaultwarden.
   • Cloud reliance: None, once deployed locally.
4. Pass (The standard unix password manager)
   • What it is: A command-line and text-file-based password manager that follows the Unix philosophy. It encrypts each password individually using GPG and stores them in a directory structure.
   • Why choose it: Perfect if you live in the terminal, use Git for version control/syncing, and want maximum transparency and control over your plain-text/encrypted file structure.
   • Cloud reliance: None. You can host your own private Git repository (via Gitea) to sync.

To help narrow down the best fit, tell me:

• Do you want to use official mobile and browser apps (like Bitwarden's ecosystem), or do you prefer a local file-based approach?
• What is your preferred hosting setup (e.g., Docker on a home server vs. strictly offline)?

Yes. If by “does not rely on their cloud” you mean the password database, authentication, and synchronization can all stay on infrastructure you control, there are several good choices.

My shortlist

1. Bitwarden — my default recommendation

The official Bitwarden server can be run entirely on your own infrastructure. Bitwarden currently offers a Lite deployment specifically aimed at personal users, home labs, and lightweight sharing, in addition to the full self-hosted deployment.

The important distinction is that you're using Bitwarden's actual server software, rather than an unofficial compatibility implementation. It supports Docker and can even be deployed in an offline/air-gapped environment.

I'd choose this if: you want a polished experience across Windows/macOS/Linux/iOS/Android and browsers while retaining control of the server.

2. Vaultwarden — excellent for a personal server

Vaultwarden is a lightweight, community-developed server that implements the Bitwarden-compatible API. It's particularly popular for homelabs because it uses substantially fewer resources than the complete official Bitwarden stack.

The tradeoff is important: Vaultwarden isn't Bitwarden's official server, so you're depending on a third-party project for server compatibility and maintenance.

I'd choose this if: you're technically comfortable maintaining Docker containers and want something small and efficient for yourself or a small household.

3. Passbolt — particularly good for teams

Passbolt is an open-source credential manager designed heavily around sharing credentials between users and teams. It has an official self-hosting/hosting guide and can be run entirely on your own infrastructure.

Its model is somewhat different from Bitwarden, with a stronger emphasis on organizational credential sharing, permissions, and administration.

I'd choose this if: you're managing passwords for a small business, IT team, or multiple users with different access levels.

4. KeePassXC — if you want zero server dependency

This is the most radically self-sovereign option. Your passwords live in an encrypted KeePass database file. You can keep that file on your own NAS, Syncthing, USB drive, etc., rather than operating a password-manager server at all.

The downside is synchronization and multi-user sharing aren't as seamless as Bitwarden/Vaultwarden.

I'd choose this if: your priority is "I don't want my password manager to depend on anyone else's infrastructure, ever."

What I'd pick

For a personal homelab, I'd rank them:

1. Bitwarden Lite — best combination of official support, clients, and self-hosting.
2. Vaultwarden — best if you want a very lightweight Docker deployment.
3. KeePassXC — best if you want the fewest moving parts and don't need a server-based system.
4. Passbolt — move this to #1 if you're primarily managing credentials for a team.

One caveat: self-hosting doesn't automatically mean “no Internet dependency.” For example, Bitwarden's self-hosted deployment has specific networking requirements, although Bitwarden also documents an offline/air-gapped deployment.

If you tell me whether this is just for you, a family, or a team, and whether you have Docker/NAS/home server, I can narrow it down to one and compare the security model, mobile apps, backups, 2FA, and maintenance burden.

The official Bitwarden server can be run entirely on your own infrastructure. Bitwarden currently offers a Lite deployment specifically aimed at personal users, home labs, and lightweight sharing, in addition to the full self-hosted deployment.

The important distinction is that you're using Bitwarden's actual server software, rather than an unofficial compatibility implementation. It supports Docker and can even be deployed in an offline/air-gapped environment.

I'd choose this if: you want a polished experience across Windows/macOS/Linux/iOS/Android and browsers while retaining control of the server.

2. Vaultwarden — excellent for a personal server

Vaultwarden is a lightweight, community-developed server that implements the Bitwarden-compatible API. It's particularly popular for homelabs because it uses substantially fewer resources than the complete official Bitwarden stack.

The tradeoff is important: Vaultwarden isn't Bitwarden's official server, so you're depending on a third-party project for server compatibility and maintenance.

I'd choose this if: you're technically comfortable maintaining Docker containers and want something small and efficient for yourself or a small household.

3. Passbolt — particularly good for teams

Passbolt is an open-source credential manager designed heavily around sharing credentials between users and teams. It has an official self-hosting/hosting guide and can be run entirely on your own infrastructure.

Its model is somewhat different from Bitwarden, with a stronger emphasis on organizational credential sharing, permissions, and administration.

I'd choose this if: you're managing passwords for a small business, IT team, or multiple users with different access levels.

4. KeePassXC — if you want zero server dependency

This is the most radically self-sovereign option. Your passwords live in an encrypted KeePass database file. You can keep that file on your own NAS, Syncthing, USB drive, etc., rather than operating a password-manager server at all.

The downside is synchronization and multi-user sharing aren't as seamless as Bitwarden/Vaultwarden.

I'd choose this if: your priority is "I don't want my password manager to depend on anyone else's infrastructure, ever."

What I'd pick

For a personal homelab, I'd rank them:

1. Bitwarden Lite — best combination of official support, clients, and self-hosting.
2. Vaultwarden — best if you want a very lightweight Docker deployment.
3. KeePassXC — best if you want the fewest moving parts and don't need a server-based system.
4. Passbolt — move this to #1 if you're primarily managing credentials for a team.

One caveat: self-hosting doesn't automatically mean “no Internet dependency.” For example, Bitwarden's self-hosted deployment has specific networking requirements, although Bitwarden also documents an offline/air-gapped deployment.