SHSelfHostIndex

Password Managers

Keep credentials private with self-hosted password managers that you fully control.

40 self-hosted apps · 361 comparisons

All password managers apps

Last reviewed Aug 26, 2026 · 449 words

Half of this category will never autofill a login for you. HashiCorp Vault, OpenBao, Infisical, SOPS, and git-crypt are secrets managers for infrastructure — API keys, certificates, CI credentials — aimed at machines and the developers who feed them. They rank high by stars because developers star things, but if you arrived here to replace LastPass, only a handful of these 40 apps are candidates, and the choice between them comes down to two questions.

How to choose a password manager

Server or file. Vaultwarden and Bitwarden run a sync server that the official Bitwarden apps and browser extensions talk to: one vault, every device, shared collections for the household. KeePassXC instead keeps an encrypted KeePass database file on disk with no server at all — sync is your problem (Syncthing does it well, and KeePassDX covers Android), but the attack surface is a file, not a listening web service. The full head-to-head is in KeePassXC vs Vaultwarden.

Official or community. Bitwarden's own server is the audited, vendor-supported path and it wants 2 GB of RAM as a multi-container stack. Vaultwarden is an unofficial Rust reimplementation that speaks the same client API in 128 MB, includes the premium-tier features free, and has a 66,256-star community around it — but no vendor, and self-hosting security lands entirely on you.

Where to start

Vaultwarden fits most households: Easy difficulty, one container, all the official clients. Its deploy gotchas are non-negotiable, and worth repeating because each one is a foot-gun: clients refuse plain HTTP, so HTTPS goes in front before the first request; DOMAIN must match the exact public URL or WebAuthn breaks; and once your accounts exist, set SIGNUPS_ALLOWED=false. KeePassXC fits the person who wants zero server-side risk and no ops duty — nothing to patch, nothing exposed, mature since 2017. Bitwarden's official server fits a team that wants the audited vendor stack and can spare the resources.

The one rule that outranks the choice

Whatever you pick, the backup is the product. A password server with no tested restore is a time bomb; for Vaultwarden that means nightly copies of /data (SQLite database plus attachments) shipped off the machine, and one rehearsed restore into a scratch container. Losing every credential you own is not a recoverable category of mistake.

My default for a first-timer: Vaultwarden behind a reverse proxy, signups closed after day one, backups automated in the same session you deploy it. Pick KeePassXC instead only if you'd honestly rather sync a file than run a service — both are good answers; an unbacked-up server is not.

Curated picks

Easiest Password Managers to self-hostBest API Password ManagersBest Cross-Platform Password ManagersBest Docker Password ManagersBest Encrypted Password ManagersBest Free Password ManagersBest Kubernetes Password ManagersBest LDAP Password ManagersBest Lightweight Password ManagersBest Multi-User Password ManagersBest No-Database Password ManagersBest Offline-First Password ManagersBest Single-User Password Managers

Password Managers comparisons

361 head-to-head comparisons in this category.

See all comparisons →