A self-hosted password manager is the smallest useful server most people will ever run. Vaultwarden — the lightweight server implementation compatible with the Bitwarden clients — is a single Rust binary with a SQLite database, and it will run on the cheapest virtual machine we sell with room to spare. The hard part is not capacity. The hard part is that you have just made yourself responsible for the availability and the backups of the one thing you cannot afford to lose.
This post covers both halves: the hosting, which is easy and cheap, and the operational discipline, which is the actual price of admission.
What it needs, in real numbers
Vaultwarden is genuinely small. A family or small-team instance idles in tens of megabytes of RAM, and the database is measured in megabytes unless you store file attachments. That means:
| Use case | Shape | RAM / vCPU / disk | Bucharest | Frankfurt · Vienna |
|---|---|---|---|---|
| Family or solo, few attachments | VPS I KVM | 2 GB / 1 / 20 GB | €4.00 | €5.50 |
| Small company, 10–50 users, attachments, other services on the same box | VPS II KVM | 4 GB / 2 / 40 GB | €6.00 | €9.00 |
You will not outgrow a VPS I on vault data. What pushes people to the 4 GB shape is wanting the same machine to also run a reverse proxy for other sites, a backup agent and perhaps a small monitoring stack. If the vault is the only thing on the machine — which is a defensible security decision — the €4 plan is the honest answer, and on hourly billing it is €0.0056 an hour.
The five rules that matter more than the shape
1. Back up the database, off the machine, every day
SQLite means your vault is a file. Copy it somewhere else on a schedule — and copy the attachments directory and the RSA keys alongside it, because a database without them restores into a vault you cannot unlock properly. A daily encrypted copy to a second machine or an object store is the minimum.
2. Keep an offline export as the last resort
Backups protect you from losing the server. An offline encrypted export protects you from losing everything, including the backup automation you set up and forgot. Export from the client, encrypt it, store it away from your infrastructure. Refresh it quarterly.
3. Lock the front door properly
- TLS via ACME, with automatic renewal. A password manager on plain HTTP is not a password manager.
- Disable open registration once your accounts exist, or restrict it to your own domain.
- Keep the admin panel disabled unless you are actively using it, and never leave a weak admin token in place.
- Put the whole thing behind a firewall that exposes only 80 and 443, and keep SSH on keys.
- Enable two-factor authentication on every account, starting with yours.
4. Patch it like it matters
This is an internet-facing service holding your credentials. Subscribe to the release notes, apply updates promptly, and keep the base OS on a current LTS — we ship Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04 LTS, and the enterprise Linux family, so there is no reason to run something ancient.
5. Decide what happens when the server is down
The clients cache your vault, so a short outage is survivable — you keep read access to what you already synced and lose sync until it returns. That is a genuinely acceptable failure mode for most households and small teams, but you should know it before it happens rather than during it.
Where to host it
Two sensible criteria:
- Close to the people using it. Sync is small and frequent; the closest location to your team is the right one. Our five live locations are Bucharest, Warsaw, Amsterdam, Frankfurt and Vienna.
- Inside a jurisdiction you are comfortable with. All five are EU member states. For a European team, the vault staying in the EU is usually the whole conversation — see our EU-only hosting note.
The difference in price between the cheapest and the most expensive location is €1.50 a month on the VPS I plan; full table in the per-location price list. For a service this small, pick on geography, not price.
Cost against the hosted version
A VPS I in Bucharest is €4.00 a month, or €43.20 a year on the annual price, which is 10% off the plan price. That is the whole hosting bill for a vault serving a family or a small team, and the machine has room left over to run other small services.
The honest comparison, though, is not price against the commercial product — it is price plus your attention. The commercial service comes with a team whose job is availability, breach response and client updates. Self-hosting trades a small subscription for a small amount of ongoing responsibility. If you already run servers, that trade is obviously worth it. If this would be the first server you own, think about whether you want the vault to be the thing you learn on.
A sensible build order
- Order a VPS I in the location nearest your team. On hourly billing you can trial the whole build for pennies — five hours of a VPS I in Bucharest is about three cents — and an hourly service needs €5 of account credit to start.
- Point a subdomain at the machine, get a certificate, and confirm HTTPS works before touching anything else.
- Install Vaultwarden, create your accounts, then close registration.
- Enable two-factor authentication on every account.
- Set up the daily off-machine backup, and restore it once onto a throwaway hourly VPS to prove it works.
- Take an offline encrypted export and put it somewhere physically separate.
- Only then move your passwords in, and only then delete them from wherever they were.
Step 5 is the one people skip. A backup you have never restored is a hope, not a plan, and it costs about a cent to test on an hourly machine.
What about attachments?
File attachments are the only thing that meaningfully grows the disk footprint. A vault full of scanned documents and recovery kits can reach a few gigabytes, which is nothing against the 20 GB on the entry plan — and if you do fill it, extra storage is €4 a month per 50 GB increment, up to three increments, rather than a shape change.
How Noded Can Help
A VPS I from the hourly VPS page, in whichever of our five EU locations sits closest to your team, is the whole shopping list. Take it hourly while you build and test the restore, then switch to the monthly or annual price once the vault is real. If you would like a second pair of eyes on the firewall and backup plan before you move your credentials across, open a ticket — we would rather answer that question before the migration than after.
FAQ
How much RAM does Vaultwarden need?
Far less than the smallest plan we sell. A family or small-team instance runs in tens of megabytes; the 2 GB shape is chosen for the reverse proxy, the OS and headroom, not for the vault itself.
Can I run a password manager on a €4 VPS?
Yes, and for a household or small team that is the right size. Move up to the 4 GB shape only if you want the same machine to run other services as well.
What is the biggest risk of self-hosting my passwords?
Losing the data, not being hacked — an unrestored backup or a lost encryption key breaks more vaults than attackers do. Keep a daily off-machine backup, an occasional offline export, and test a restore.
Where should the server be?
Closest to the people syncing against it. All five of our locations are in the EU, so residency is covered everywhere, and the price gap between the cheapest and dearest is €1.50 a month at this shape.
What happens if the VPS goes offline?
Clients keep the vault they have already synced, so you retain access to existing entries and lose sync until the server returns. Plan for it, and keep the offline export for the case where the server does not come back.