Padloc

Last reviewed Sep 13, 2026 · 739 words

Padloc is the best-looking password manager you can self-host, and for most people I would still tell them to run Vaultwarden instead. The interface is the reason to want Padloc: one consistent, uncluttered design across the web app, desktop, iOS, Android and the browser extension, with end-to-end encryption and organizations built in. The reason to hesitate is everything around the interface: a smaller ecosystem, a slower release cadence, and a server that needs an SMTP account before a single user can log in.

Where Padloc is actually better

Three things. First, the vault model is simpler than Bitwarden's: personal vault, organization vaults, groups, and item-level tags, with none of the collection/folder overlap that confuses families. Second, the apps are all one codebase, so behaviour is identical everywhere; nothing is "available on desktop but not mobile yet". Third, the design is calm. Non-technical family members who bounced off Bitwarden's density have stayed on Padloc.

It also has the features you would check for: TOTP generation, attachments, secure notes, a security audit that flags weak and reused passwords, and passkey-style login on supported platforms. The AGPL-3.0 licence covers the whole stack, server included.

Three services and an SMTP account

The server (padloc/server), the web app (padloc/pwa), and optionally an admin portal. The trap is email: Padloc verifies sign-ups and new-device logins with a code sent by email, so without working SMTP nobody can register, including you. Set that up first.

services:
  server:
    image: padloc/server
    environment:
      - PL_SERVER_URL=https://vault.example.com/server
      - PL_PWA_URL=https://vault.example.com
      - PL_EMAIL_SERVER=smtp.example.com
      - PL_EMAIL_PORT=587
      - [email protected]
      - PL_EMAIL_PASSWORD=app-password
      - [email protected]
    volumes:
      - ./padloc-data:/data
    restart: unless-stopped
  pwa:
    image: padloc/pwa
    environment:
      - PL_SERVER_URL=https://vault.example.com/server
    restart: unless-stopped

Route /server to the API container and everything else to the PWA behind one TLS hostname; the two URLs must match what the browser sees or logins fail after the email step. The Padloc self-hosting docs list the remaining variables. The catalogue's Medium difficulty rating is about right: none of this is hard, but there are more moving parts than a single-container vault.

Storage backend: LevelDB is fine, until it isn't

By default the server writes to an embedded LevelDB directory, which is a single folder to back up and adequate for a household. Postgres and MongoDB backends exist for teams that want proper database tooling. For under 20 users I would keep LevelDB and back up the data volume nightly with the container stopped, then do a test restore once, because the encryption keys derive from users' master passwords and the server holds only ciphertext: a restored data directory is a fully working vault, and a lost one is unrecoverable by anyone.

The ecosystem gap is the real cost

Bitwarden-compatible servers get the entire Bitwarden client ecosystem for free: every platform, every integration, a CLI, and a security-research community watching the protocol. Padloc's clients are Padloc's alone. In practice that means slower fixes when a browser update breaks the extension, no third-party tooling, and a long wait for any feature the small team has not prioritised. The catalogue lists "slower development pace" as a con and that matches what I have seen: solid, maintained, not fast.

Import and export cover CSV plus Padloc's own encrypted format, and the importer handles the common exports from 1Password, LastPass and Bitwarden, so trying it costs nothing and leaving is not painful. If your reason for self-hosting is escaping 1Password's subscription, either Padloc or Vaultwarden gets you there; the KeePassXC vs Vaultwarden comparison covers the third path of no server at all.

What I'd do

Run Padloc when the people using it care more about the interface than the ecosystem: a family, a small studio, anyone who tried Bitwarden and found it cluttered. Deploy the two containers above behind one hostname, set up SMTP before creating the first account, back up the data directory nightly, and pin image versions so an update never lands unannounced. For anyone else, and for anyone who wants a CLI or third-party tooling, Vaultwarden is the safer default and the one I run myself.