# Vaultwarden

Vaultwarden is an unofficial, Bitwarden-API-compatible server written in Rust by dani-garcia. The official [[bitwarden]] server is a .NET / C# / MSSQL Express stack; Vaultwarden replaces it with a single Rust binary that's small enough to run on a Raspberry Pi and speaks SQLite, MySQL, or PostgreSQL.

It is the de facto self-hosting choice for Bitwarden's clients. By stargazer count, Vaultwarden has roughly three times the GitHub stars of the official Bitwarden server, which is unusual given that it's a third-party reimplementation of the product. In response, Bitwarden hired Vaultwarden's main developer in 2024 — and then shipped a separate "Bitwarden lite" stack rather than adopting Vaultwarden upstream.

## What it is

- API-compatible with the standard Bitwarden clients (web, browser extensions, desktop, mobile, CLI). Users point any official client at a Vaultwarden instance and the client treats it like Bitwarden's own backend.
- Single Rust binary, plus the choice of a SQLite / MySQL / PostgreSQL database. No MSSQL, no Docker-required dependencies (though Docker images are official).
- Maintained as a community project; not endorsed by Bitwarden, Inc.

## What it is not

- Not a fork of the Bitwarden client. The client applications, including their bugs and update-protocol breakage, are still Bitwarden's code. A user running Vaultwarden as a backend still inherits client issues — see [[marius-bitwarden-not-recommended]] for examples like an F-Droid auto-update locking the user out of their vault even with a Vaultwarden backend.
- Not a security boundary against client-side flaws. The 2023 cross-origin iframe autofill, the 2025 DOM-clickjacking, and the 2026 Shai-Hulud CLI compromise are client / distribution issues that Vaultwarden cannot mitigate.

## See also

- [[bitwarden]] — the official product
- [[marius-bitwarden-not-recommended]] — the post that motivated this page