Bitwarden self hosted for your team, on a server of your own

Is the official server the one you want?

Yes, if the vault is for a company or a team that wants Bitwarden's support and its paid organisation features. Bitwarden offers several ways to self-host, and two matter here. The standard deployment is its full server and the one it tells businesses to use. Bitwarden lite is a single container (its name until December 2025 was Bitwarden Unified), which Bitwarden describes as meant for individuals and home-lab setups.

You may also have met Vaultwarden. It is a different, unofficial server that speaks to the same apps; Bitwarden says it cannot promise its own apps work perfectly with servers like that, and its support team may not be able to help much if you do. If that trade suits you, our Vaultwarden guide walks through it. This page sticks to Bitwarden's own server.

How much server it really needs

Not much, by Bitwarden's own numbers for the Linux standard deployment:

• Processor: an x64 chip, 1.4 GHz at the very least, a 2 GHz dual core recommended. Bitwarden's table names only x64 chips, and it presents ARM as something lite can do, so our understanding is that this deployment wants x64.
• Memory: 2 GB minimum, 4 GB recommended.
• Disk: 12 GB minimum, 25 GB recommended.
• Software: Docker Engine 26 or newer, which brings Docker Compose with it as a plugin.

The database that comes in the box is MSSQL Express. It needs no licence of its own, but it tops out at 10 GB of data; a bigger organisation can point Bitwarden at its own MSSQL 2019 or newer instead. Lite, by comparison, asks for only 200 MB of RAM and a 1 GB disk, but you bring and look after its database yourself.

The server that fits

Because the vault is small, the thing to pay attention to is not speed but who else is on the machine and how you get back in when something breaks. A dedicated server gives you a whole physical computer that runs only your work, you log in as root, and it is handed over within 30 minutes of the payment being approved.

For a team vault, the small cartridge servers are made for exactly this: one job, one machine. Not every one reaches the recommended 2 GHz, since some run at 1.7 or 1.8 GHz, so choose one clocked at 2 GHz or more, for example an Intel Xeon E3-1585L v5 (3 GHz) or an Intel Atom C2750 (2.4 GHz). Skip the X-Gene ARM option: by our reading of Bitwarden's docs, which list only x64 for the standard deployment, it would not run there. If you would like a safety net for firewall mistakes, choose a rack server, a blade, or an m510 or m710x cartridge: those include out-of-band console access, meaning the screen and the power button in your browser even when SSH stops answering. On the remaining cartridges you get remote power on and off, without a console.

Before you install: three things to sort out

1. A name. Create a DNS record for the server, for example vault.example.com. Bitwarden advises leaving the word Bitwarden out of the hostname, so it does not announce what the machine runs, and it will not work under a folder like example.com/vault.
2. Your installation id and key. Request them with a working email address at bitwarden.com/host, and pick the region (US or EU) where your Bitwarden cloud account lives. They register your install with Bitwarden, let it send push notifications to your apps and let it check licences. Keep them private, like a password, and never reuse one pair on a second server.
3. A firewall. Allow SSH, 80 and 443 and nothing else, before anything starts listening. Bitwarden needs both web ports; it will not run on just one.

grep '^IPV6=' /etc/default/ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

The first line should answer IPV6=yes; that is what makes each rule cover IPv6 as well, and the status output shows the extra (v6) lines. IPv6 comes at no charge with our servers. One catch, from Docker's own documentation: ports a container publishes skip ufw entirely. So once Bitwarden runs, check with sudo ss -tlnp, which lists listeners on both IPv4 and IPv6, that only 22, 80 and 443 are open to the outside.

Up and running in an evening

Install Docker first. Then give Bitwarden its own account and folder, as Bitwarden's guide does, and run the installer as that account rather than as root, which Bitwarden says causes problems. Choose a strong password for the account: anyone in the docker group can control every container on the server.

sudo adduser bitwarden
sudo groupadd docker
sudo usermod -aG docker bitwarden
sudo mkdir /opt/bitwarden
sudo chmod -R 700 /opt/bitwarden
sudo chown -R bitwarden:bitwarden /opt/bitwarden
sudo -iu bitwarden
cd /opt/bitwarden
curl -Lso bitwarden.sh "https://func.bitwarden.com/api/dl/?app=self-host&platform=linux" && chmod 700 bitwarden.sh
./bitwarden.sh install

If groupadd complains that the group exists, Docker made it already, and you can carry on. The installer asks for your domain, offers a free Let's Encrypt certificate (say yes and give an email for renewal reminders), then asks for the installation id, the key and the region. It writes everything into a bwdata folder next to the script, which the 700 permissions keep private to the bitwarden account.

Email, the admin portal and closing sign-ups

Bitwarden will not do much without email: it is how accounts get verified, how people are invited to your organisation, and how admins log in. Open ./bwdata/env/global.override.env and fill in the globalSettings__mail__smtp__ lines for your mail provider. Bitwarden's SMTP guide recommends port 587 with startTls=true and ssl=false. While you are in that file, add your address to adminSettings__admins, and remember that it also holds your database password.

Apply the changes with ./bitwarden.sh restart. You will find the System Administrator Portal at /admin on your web address. Nobody types a password there: Bitwarden emails a sign-in link, good for 15 minutes, sent only to the addresses in that list. The portal shows versions and settings and can delete users and organisations, but it cannot open anyone's vault. We suggest using a mailbox protected by two-step login, since that inbox is the key to the portal.

Out of the box, anyone who finds your web address can register. Create and verify your own account first, then add globalSettings__disableUserRegistration=true to the same file and restart. Everyone else comes in by invitation to your organisation.

Keeping your passwords safe from a bad day

Bitwarden backs up its database every night, as long as the mssql container is running, and keeps each backup for 30 days in ./bwdata/mssql/backups. Those files live next to the live data on one disk, though, so a failed disk takes both. Bitwarden's advice is to also copy the whole bwdata folder somewhere safe, especially the env folder, the attachments, the database files and the aspnet-dataprotection folder.

1. Bitwarden's guide gives a one-line docker exec command that runs the backup script inside the mssql container on demand. Use -i, not -it, and it runs fine from a schedule.
2. Pack bwdata into an archive and keep it somewhere other than this server. It holds passwords and keys, so keep it readable by you only (chmod 600), and encrypt the file so nobody can read it in transit.
3. Before each update, back up, then run ./bitwarden.sh updateself and ./bitwarden.sh update. Bitwarden says updates can carry security fixes and that newer apps may stop supporting old servers, so do not let it drift.
4. Practise a restore once: Bitwarden's backup guide uses sqlcmd in the mssql container to load a nightly file back.

Premium and organisation features

Running the server costs nothing in Bitwarden licences; paid features are switched on by uploading a licence you download from your account on Bitwarden's cloud. Of the organisation plans, Families and Enterprise are the two that can move to your own server, and you create the organisation in the cloud first, then download its licence using your installation id. Keep the licence current: after each renewal you have 60 days to update it before the self-hosted organisation is disabled. Billing sync saves you uploading a new file by hand. Set globalSettings__enableCloudCommunication=true and your cloud region in global.override.env; next comes ./bitwarden.sh rebuild and a restart; let the server reach Bitwarden's API and identity addresses, and finally paste in the billing sync token you generate in the cloud Admin Console. Even so, each renewal needs you to click Sync license. Families organisations cannot use sync at all and upload each new licence by hand, and an organisation still on a free trial cannot set it up.

When this is not the right setup

One server means one place things can fail. If you need the vault to survive a machine going down, Bitwarden points to its Kubernetes (Helm) deployment for high availability. If nobody on your team wants to look after Linux, Docker and backups, Bitwarden's cloud service may suit you better, because with a server here you manage the software and we keep the hardware and network running. Moving later is a normal job: our migration guide explains the cutover, and instant servers shows what can be handed over quickly.

Questions people ask

Can a small server run Bitwarden for a whole team?

For its standard Linux deployment Bitwarden recommends two 2 GHz x64 cores, 4 GB RAM and 25 GB of storage. The bundled database stops at 10 GB of data, after which you can connect your own MSSQL 2019 or newer. Most of the work is in keeping it updated and backed up, not in raw power.

Do I pay Bitwarden to host it myself?

Bitwarden says self-hosting is free. You only need a paid subscription for Premium or organisation features, which you unlock by uploading a licence file. Self-hosted organisations must be on the Families or Enterprise plan.

Why should I keep the installation key private?

The installation id and key tie your server to Bitwarden for push notifications and licence checks, and Bitwarden tells you to treat them as secrets. Do not paste them into tickets or share them between servers. Each install should get its own pair from bitwarden.com/host.

Is Bitwarden lite fine for my business?

Bitwarden says no: lite is built for individuals and home labs, and businesses should run a standard deployment. Lite also skips the nightly database backup, leaving all of that to you.

Who can open the /admin page?

Only people whose email address is listed in adminSettings__admins. They receive a sign-in link that expires after 15 minutes, so your mail settings have to work first. The portal can manage users and organisations but cannot read anyone's passwords.

Will the Bitwarden apps work with my server?

Yes. In the browser extension, desktop or mobile app, you choose a self-hosted server and enter your own web address before logging in. Bitwarden also requires WebSocket connections between the apps and the server, so do not block them on the way.