Vaultwarden on NAS: Setup Guide

Vaultwarden is an open-source, self-hosted Bitwarden server. It runs on your NAS, is compatible with all official Bitwarden client apps, and stores your passwords on hardware you control with no subscription required. Bitwarden's official cloud service currently costs $19.80 USD/year for Premium features; Vaultwarden provides many Bitwarden-compatible premium features without a subscription, including TOTP, file attachments, and emergency access. The container is lightweight, but its RAM use varies with workload, configuration, database backend and platform., runs on any NAS with Docker support, and is one of the most reliable self-hosted apps in the homelab ecosystem. This guide covers the complete setup from Docker deployment to HTTPS configuration to client registration.

Why Self-Host a Password Manager?

Bitwarden's cloud service is excellent and audited. Self-hosting Vaultwarden is not about doubting Bitwarden's security. It is about:

• Cost: Bitwarden Premium is currently $19.80 USD/year; Bitwarden Families is $47.88 USD/year, excluding taxes. Vaultwarden is free, including the premium features (TOTP, file attachments, emergency access)
• Data sovereignty: Your passwords never leave your network (except for encrypted sync to client devices)
• No dependency on third-party availability: Your vault works even if Bitwarden's servers are down

The trade-off: you are responsible for keeping your Vaultwarden instance updated, backed up, and accessible. If your NAS is offline when you need a password remotely, you need local client caches. Bitwarden clients cache the vault locally, so offline access works for existing passwords. New entries require connectivity.

Step 1: Deploy Vaultwarden via Docker

Create a Docker Compose file at /volume1/docker/vaultwarden/docker-compose.yml (Synology) or /share/docker/vaultwarden/docker-compose.yml (QNAP):

version: '3.8'
services:
 vaultwarden:
 image: vaultwarden/server:latest
 container_name: vaultwarden
 restart: unless-stopped
 ports:
 - 8180:80
 environment:
 
 - SIGNUPS_ALLOWED=true # set to false after creating your accounts
 - DOMAIN=https://vault.yourdomain.com
 - ADMIN_TOKEN=your_secure_admin_token_here
 volumes:
 - ./data:/data

Deploy with docker compose up -d or via Portainer Stacks.

Generate an Argon2id PHC string for ADMIN_TOKEN with docker run --rm -it vaultwarden/server /vaultwarden hash, then follow Vaultwarden's Docker Compose instructions for storing the generated value. Store this securely. It gives full admin access to your Vaultwarden instance.

Step 2: Configure HTTPS (Required)

All Bitwarden clients require HTTPS. Plain HTTP connections are rejected. You must configure HTTPS before clients will connect.

Using NGINX Proxy Manager (recommended if already running for other containers):

1. Add a new Proxy Host in NPM
2. Domain: vault.yourdomain.com
3. Forward to: NAS IP, port 8180
4. Enable Websockets Support
5. SSL: Request Let's Encrypt certificate

After configuring DNS for the hostname and ensuring that the selected Let's Encrypt challenge can validate the domain, Vaultwarden should be accessible at https://vault.yourdomain.com . The DOMAIN environment variable in the Compose file must match this URL exactly. Set DOMAIN to the externally accessible Vaultwarden URL. WebSocket notifications require the reverse proxy to pass WebSocket upgrade headers, while mobile push notifications require separate Bitwarden push credentials.

Update the Compose file DOMAIN variable with your actual HTTPS URL and recreate the container with docker compose up -d .

Step 3: Create Accounts and Disable Open Registration

With SIGNUPS_ALLOWED=true, anyone who knows your Vaultwarden URL can create an account. Create all the accounts you need (yourself, family members), then disable open registration:

1. Navigate to https://vault.yourdomain.com and click Create Account
2. Register with your email and a strong master password
3. Repeat for any family members who will use this server
4. Once all accounts are created, edit the Compose file: change SIGNUPS_ALLOWED=true to SIGNUPS_ALLOWED=false
5. Recreate the container with docker compose up -d so the changed environment variable is applied. New account creation is then blocked. Existing accounts continue to function normally. The admin panel ( https://vault.yourdomain.com/admin ) using your ADMIN_TOKEN allows you to invite specific email addresses even with signups disabled; configure SMTP if invitation emails must actually be delivered.

   Step 4: Connect Bitwarden Clients

   Vaultwarden is compatible with all official Bitwarden client apps. No third-party clients required. In any Bitwarden client, change the server URL before logging in:

   Browser extension (Chrome, Firefox, Edge, Safari):

   1. Install the official Bitwarden extension from your browser's extension store
   2. Click the extension icon, click the gear/settings icon at the top left
   3. Under Self-Hosted Environment, enter your Vaultwarden URL: https://vault.yourdomain.com
   4. Save and log in with your Vaultwarden account credentials

   Mobile app (iOS and Android):

   1. Install the official Bitwarden app
   2. On the login screen, tap the gear icon
   3. Enter your server URL and save
   4. Log in with your credentials

   The Bitwarden desktop app follows the same pattern. All clients sync to your Vaultwarden instance once the server URL is set correctly.

   Backups: Critical for a Password Manager

   Your password database is in the ./data folder defined in the Compose volume mount. Back this up regularly. Losing your Vaultwarden data means losing access to all stored passwords.

   Backup strategy:

   • Back up the entire data directory, but create a consistent SQLite backup with docker exec -it vaultwarden /vaultwarden backup, or stop Vaultwarden before copying its SQLite files.
   • The db.sqlite3 file stores almost all Vaultwarden state, but attachments are stored separately; back up the complete data directory as well as a consistent copy of the database.
   • Test restoration by restoring the backup to a test instance before relying on it
   • Additionally, periodically create a password-protected encrypted JSON export; account-restricted exports are tied to the originating account and encryption key.

   🇦🇺 Australian Users: Remote Access Notes

   Vaultwarden works fine for local-only use, but most users want password sync when away from home. Options:

   • Cloudflare Tunnel (free): Expose Vaultwarden via Cloudflare without opening ports or a static IP. Supports CGNAT. The Cloudflare Tunnel daemon runs as a Docker container alongside Vaultwarden. This is the simplest option for most Australian residential connections
   • Port forward + DuckDNS: On a connection with a publicly routable address and permitted inbound ports, dynamic DNS plus port forwarding can provide direct remote access without relay overhead. Check your RSP's CGNAT and port-blocking policies first.
   • VPN: Route all remote access through a WireGuard VPN. Means Vaultwarden does not need to be internet-exposed at all. More complex but highest security for a password manager

   Given that Vaultwarden holds your passwords, restricting remote access to a VPN is the most security-conscious option. Cloudflare Tunnel is the pragmatic middle ground. Encrypted transit, no open ports, no static IP needed.

   Related reading: our NAS buyer's guide and our NAS explainer.

   Is Vaultwarden secure?

   Vaultwarden is well-audited community software The core vault encryption is identical to Bitwarden's. AES-256-CBC with HMAC authentication; Bitwarden supports PBKDF2-SHA256 or Argon2id for password-based key derivation. Your passwords are encrypted client-side before leaving your device; the server stores only ciphertext. Vaultwarden itself never sees your master password. The main security responsibility you take on: keeping the Vaultwarden container updated and securing the HTTPS endpoint. If your NAS is compromised at the OS level, all bets are off. Use a strong master password and keep NAS admin access locked down.

   Can I migrate from Bitwarden cloud to Vaultwarden?

   Yes. Export your vault from Bitwarden cloud as a password-protected encrypted JSON file; do not use the account-restricted encrypted export for migration to a different server. Set up Vaultwarden and create your account. Import the exported file in the Bitwarden client connected to your Vaultwarden server (Settings → Import Data). All passwords, notes, and card entries transfer. Verify the import before deactivating your Bitwarden account. TOTP seeds in Bitwarden Premium export correctly; attachments require manual re-upload.

   How much storage does Vaultwarden use?

   Minimal. The Vaultwarden container image is approximately 100MB. File attachments (if enabled) add to storage proportionally.

   Does Vaultwarden support TOTP (two-factor authentication codes)?

   Yes. Vaultwarden supports storing and generating TOTP codes (the six-digit codes used by authenticator apps). This is a Bitwarden Premium feature that Vaultwarden provides for free. Store your TOTP secrets in Vaultwarden entries, and the Bitwarden client apps will display the current TOTP code alongside the password. This consolidates password + TOTP management in one place. Though for critical accounts, keeping TOTP separate from your password manager is a valid security approach.

   Can my family use the same Vaultwarden instance?

   Yes. Create individual accounts for each family member. Each person gets their own vault. Shared credentials can be organised using Vaultwarden's Organisation feature: create an Organisation, invite family members, and share specific vault collections with them. This provides similar organization-and-collection sharing for family members, but it is not a Bitwarden Families subscription or support entitlement., which currently costs $47.88 USD/year in the cloud, excluding taxes. On Vaultwarden it is free.

   Running Vaultwarden alongside other Docker containers? The NAS Sizing Wizard estimates how much RAM your full container stack needs.

   NAS Sizing Wizard →