I need a password manager that supports self-hosting and does not rely on their cloud.

Yes. If your requirement is “my passwords live on infrastructure I control, with no dependency on the vendor’s cloud,” there are several good choices.

My top picks

1. Vaultwarden — my recommendation

Vaultwarden is a lightweight, Rust-based, self-hosted implementation of the Bitwarden server API. It works with the official Bitwarden clients, including browser, desktop, and mobile apps.

This is probably the sweet spot if you want:

• Docker/Podman deployment
• Your own server/NAS/VPS/Raspberry Pi
• Browser extensions
• iOS/Android apps
• Desktop apps
• Password sharing
• 2FA/passkeys
• Attachments
• No Bitwarden cloud account required

The important distinction is that Vaultwarden isn't the official Bitwarden server; it's an independent implementation of the Bitwarden API. Bitwarden itself notes that it cannot guarantee every official client feature will work perfectly with non-official servers.

For a personal or family setup, I'd strongly consider this first.

2. Official Bitwarden self-hosting

If you want the official Bitwarden server rather than Vaultwarden, Bitwarden supports deploying its server yourself with Docker.

The downside is that it's considerably heavier and more complicated than Vaultwarden. For a single person or family, I would generally choose Vaultwarden unless having official vendor support is particularly important.

3. KeePassXC — maximum independence

This is a fundamentally different approach. KeePassXC stores your encrypted password database as a file on your own devices and doesn't use a remote server at all. The project explicitly describes itself as cloud-free, with no remote password storage.

You can put the .kdbx database on something you control—NAS, Syncthing, USB drive, etc.—and access it from multiple devices.

I'd pick this if your priority is:

“I don't even want a password-manager server running.” The tradeoff is less seamless multi-device synchronization than Vaultwarden.

4. Passbolt

Passbolt is another open-source, self-hostable option, particularly aimed at teams and shared credentials. It supports running entirely on your own infrastructure, including behind your firewall or even in an air-gapped environment.

Its security model uses OpenPGP and keeps users' secret keys from being sent to the server in cleartext.

For an individual, though, I'd generally choose Vaultwarden or KeePassXC instead.

What I'd choose

If this were my setup:

Personal/family: → Vaultwarden

I want zero server/cloud dependency: → KeePassXC + Syncthing

Business/team: → Passbolt or official Bitwarden self-hosted

I want the Bitwarden ecosystem but insist on official software: → Bitwarden self-hosted

One important caveat: self-hosting doesn't eliminate the need for backups. With Vaultwarden/Bitwarden/Passbolt, your server becomes the thing you need to protect and back up. I'd use encrypted, offline/remote backups and make sure you can actually restore them before trusting it with your entire password vault.

If you tell me what you're planning to run it on (e.g. Synology, Unraid, Proxmox, Raspberry Pi, Windows, Linux server, VPS), I can recommend the simplest architecture and setup.

If you want total control over your data with zero reliance on third-party cloud infrastructure, there are a few standout self-hosted password managers depending on whether you want a lightweight server-client setup or a fully local file-based vault.

• Vaultwarden (formerly Bitwarden_RS)
  • What it is: An unofficial, incredibly lightweight server written in Rust that is fully compatible with the official Bitwarden browser extensions, desktop apps, and mobile clients.
  • Why it fits: It gives you the polished, seamless ecosystem experience of Bitwarden (auto-fill, cross-device sync) while running on a tiny footprint (ideal for a Raspberry Pi, home server, or mini PC). It doesn't require a paid subscription for advanced features like TOTP generation, which Bitwarden charges for on its official tier.
• Bitwarden (Official Self-Hosted)
  • What it is: The official enterprise-grade self-hosted deployment provided by Bitwarden.
  • Why it fits: It's open-source and enterprise-ready, but it is heavier on resource usage (running via Docker with multiple containers) compared to Vaultwarden. Choose this if you need strict official enterprise compliance or support.
• KeePassXC
  • What it is: A purely local, offline password manager.
  • Why it fits: There is no "server" component at all. Your database file (.kdbx ) lives entirely on your device. If you want multi-device synchronization without a third-party cloud, you host your own sync layer using local tools like Syncthing or a private Nextcloud instance. It is the ultimate choice if you don't want a web-accessible backend running 24/7.
• Psono
  • What it is: A secure, feature-rich open-source password manager built specifically for self-hosting, complete with team sharing and Single Sign-On (SSO) options.
  • Why it fits: Great if you are managing credentials for a larger household or small team and want robust access control entirely on your own hardware.

To help narrow down the best fit, let me know:

• Do you want seamless cross-device sync via a self-hosted server (like Vaultwarden), or a strictly offline local file (like KeePassXC)?
• What is your preferred hosting environment (Docker, a Raspberry Pi, or a local machine)?

If you want a secure password manager that you can completely self-host—keeping your data entirely on your own hardware without relying on a third-party cloud—here are the top options available, ranked by community consensus and usability:

1. Vaultwarden (Formerly Bitwarden_RS)
   • What it is: An unofficial, lightweight alternative server written in Rust that is fully compatible with official Bitwarden clients (browser extensions, mobile apps, and desktop apps).
   • Why choose it: The official Bitwarden self-hosted server is quite resource-heavy (requiring MS SQL and a larger footprint). Vaultwarden uses a tiny fraction of the memory/CPU, runs effortlessly in a single Docker container, and unlocks features like built-in TOTP/2FA autofill that require a paid subscription on official servers.
   • Cloud reliance: None. Your database lives on your local server/disk.
2. KeePass / KeePassXC (File-Based / Local Sync)
   • What it is: The classic offline password manager. Instead of running a server container, it stores your database in a single encrypted .kdbx file.
   • Why choose it: It is entirely local-first. You physically own the file. To sync across devices, you can move the file manually or sync it via your own private tools like Syncthing, a local Nextcloud instance, or a private SFTP server.
   • Ecosystem clients: KeePassXC for desktop, KeePassDX for Android, and Strongbox for iOS.
   • Cloud reliance: Zero. No server software or internet connection is required at all.
3. Bitwarden Official Self-Hosted
   • What it is: The official enterprise-grade self-hosted deployment provided by Bitwarden.
   • Why choose it: If you are running an organization or prefer strictly official software stacks, you can deploy Bitwarden's official containers on your own infrastructure. However, it requires significantly more heavy-lifting and hardware resources (Docker, MSSQL/PostgreSQL, proxy configurations) than Vaultwarden.
   • Cloud reliance: None, once deployed locally.
4. Pass (The standard unix password manager)
   • What it is: A command-line and text-file-based password manager that follows the Unix philosophy. It encrypts each password individually using GPG and stores them in a directory structure.
   • Why choose it: Perfect if you live in the terminal, use Git for version control/syncing, and want maximum transparency and control over your plain-text/encrypted file structure.
   • Cloud reliance: None. You can host your own private Git repository (via Gitea) to sync.

To help narrow down the best fit, tell me:

• Do you want to use official mobile and browser apps (like Bitwarden's ecosystem), or do you prefer a local file-based approach?
• What is your preferred hosting setup (e.g., Docker on a home server vs. strictly offline)?

Yes. If by “does not rely on their cloud” you mean the password database, authentication, and synchronization can all stay on infrastructure you control, there are several good choices.

My shortlist

1. Bitwarden — my default recommendation

The official Bitwarden server can be run entirely on your own infrastructure. Bitwarden currently offers a Lite deployment specifically aimed at personal users, home labs, and lightweight sharing, in addition to the full self-hosted deployment.

The important distinction is that you're using Bitwarden's actual server software, rather than an unofficial compatibility implementation. It supports Docker and can even be deployed in an offline/air-gapped environment.

I'd choose this if: you want a polished experience across Windows/macOS/Linux/iOS/Android and browsers while retaining control of the server.

2. Vaultwarden — excellent for a personal server

Vaultwarden is a lightweight, community-developed server that implements the Bitwarden-compatible API. It's particularly popular for homelabs because it uses substantially fewer resources than the complete official Bitwarden stack.

The tradeoff is important: Vaultwarden isn't Bitwarden's official server, so you're depending on a third-party project for server compatibility and maintenance.

I'd choose this if: you're technically comfortable maintaining Docker containers and want something small and efficient for yourself or a small household.

3. Passbolt — particularly good for teams

Passbolt is an open-source credential manager designed heavily around sharing credentials between users and teams. It has an official self-hosting/hosting guide and can be run entirely on your own infrastructure.

Its model is somewhat different from Bitwarden, with a stronger emphasis on organizational credential sharing, permissions, and administration.

I'd choose this if: you're managing passwords for a small business, IT team, or multiple users with different access levels.

4. KeePassXC — if you want zero server dependency

This is the most radically self-sovereign option. Your passwords live in an encrypted KeePass database file. You can keep that file on your own NAS, Syncthing, USB drive, etc., rather than operating a password-manager server at all.

The downside is synchronization and multi-user sharing aren't as seamless as Bitwarden/Vaultwarden.

I'd choose this if: your priority is "I don't want my password manager to depend on anyone else's infrastructure, ever."

What I'd pick

For a personal homelab, I'd rank them:

1. Bitwarden Lite — best combination of official support, clients, and self-hosting.
2. Vaultwarden — best if you want a very lightweight Docker deployment.
3. KeePassXC — best if you want the fewest moving parts and don't need a server-based system.
4. Passbolt — move this to #1 if you're primarily managing credentials for a team.

One caveat: self-hosting doesn't automatically mean “no Internet dependency.” For example, Bitwarden's self-hosted deployment has specific networking requirements, although Bitwarden also documents an offline/air-gapped deployment.

If you tell me whether this is just for you, a family, or a team, and whether you have Docker/NAS/home server, I can narrow it down to one and compare the security model, mobile apps, backups, 2FA, and maintenance burden.

The official Bitwarden server can be run entirely on your own infrastructure. Bitwarden currently offers a Lite deployment specifically aimed at personal users, home labs, and lightweight sharing, in addition to the full self-hosted deployment.

The important distinction is that you're using Bitwarden's actual server software, rather than an unofficial compatibility implementation. It supports Docker and can even be deployed in an offline/air-gapped environment.

I'd choose this if: you want a polished experience across Windows/macOS/Linux/iOS/Android and browsers while retaining control of the server.

2. Vaultwarden — excellent for a personal server

Vaultwarden is a lightweight, community-developed server that implements the Bitwarden-compatible API. It's particularly popular for homelabs because it uses substantially fewer resources than the complete official Bitwarden stack.

The tradeoff is important: Vaultwarden isn't Bitwarden's official server, so you're depending on a third-party project for server compatibility and maintenance.

I'd choose this if: you're technically comfortable maintaining Docker containers and want something small and efficient for yourself or a small household.

3. Passbolt — particularly good for teams

Passbolt is an open-source credential manager designed heavily around sharing credentials between users and teams. It has an official self-hosting/hosting guide and can be run entirely on your own infrastructure.

Its model is somewhat different from Bitwarden, with a stronger emphasis on organizational credential sharing, permissions, and administration.

I'd choose this if: you're managing passwords for a small business, IT team, or multiple users with different access levels.

4. KeePassXC — if you want zero server dependency

This is the most radically self-sovereign option. Your passwords live in an encrypted KeePass database file. You can keep that file on your own NAS, Syncthing, USB drive, etc., rather than operating a password-manager server at all.

The downside is synchronization and multi-user sharing aren't as seamless as Bitwarden/Vaultwarden.

I'd choose this if: your priority is "I don't want my password manager to depend on anyone else's infrastructure, ever."

What I'd pick

For a personal homelab, I'd rank them:

1. Bitwarden Lite — best combination of official support, clients, and self-hosting.
2. Vaultwarden — best if you want a very lightweight Docker deployment.
3. KeePassXC — best if you want the fewest moving parts and don't need a server-based system.
4. Passbolt — move this to #1 if you're primarily managing credentials for a team.

One caveat: self-hosting doesn't automatically mean “no Internet dependency.” For example, Bitwarden's self-hosted deployment has specific networking requirements, although Bitwarden also documents an offline/air-gapped deployment.

• Bitwarden (Self-Hosted via Vaultwarden) is an ultra-lightweight, Rust-based unofficial server implementation of the Bitwarden API. It uses a fraction of the resources of the official Bitwarden backend, runs easily in a Docker container, and works seamlessly with all official Bitwarden client apps and browser extensions while keeping everything 100% on your local infrastructure.
• KeePassXC is a purely local, offline password manager. It doesn't even have a "cloud" option by design; your database (.kdbx) lives entirely on your device. If you want to sync it across devices, you have to manage your own file sync (using tools like Nextcloud, Syncthing, or a local network share), meaning absolute privacy without third-party servers.
• Vaultwarden (listed separately for emphasis) is the gold standard for self-hosted Bitwarden alternatives. It supports full multi-user setups, browser extensions, mobile apps, and WebAuthn/passkeys, all while refusing to phone home to any corporate cloud.
• Pass (The standard unix password manager) stores each password inside a GPG-encrypted file. It follows Unix philosophy, works heavily via the command line (with GUI and mobile wrappers available), and lets you sync your encrypted password store using your own Git server or local storage.
• Pangolin or Googles style lightweight tools aside, Heptabase is for notes, but for passwords, Outline or Authentik handle auth—sticking strictly to password vaults, Auditt or others pale compared to the top three. Let's stick to the heavy hitters.

To help narrow down the best fit for your setup, let me know:

• Do you plan to access your passwords on mobile devices (iOS/Android), or strictly on desktop/laptops?
• Are you comfortable using Docker for self-hosting, or do you prefer a standalone local file database?

Yes. If your requirement is “my passwords stay under my control and the vendor’s cloud is not required,” there are a few strong choices.

My top picks

1. Bitwarden self-hosted — my recommendation

Bitwarden officially supports running the server yourself using Docker, with deployments for Linux and other supported environments.

You get the polished Bitwarden experience: browser extensions, Windows/macOS/Linux clients, iOS/Android apps, sharing, organizations, passkeys, etc.

One caveat: self-hosted doesn't mean the server is completely isolated from Bitwarden's infrastructure by default. Bitwarden documents outbound connections for things such as updates and push notifications. bitwarden.comgithub.com If your requirement is literally zero dependency on Bitwarden's cloud, I'd look at KeePassXC instead.

2. Vaultwarden — best for a homelab

Vaultwarden is an independent, lightweight, Bitwarden-compatible server implementation written in Rust. It works with Bitwarden's official clients.

This is particularly attractive if you're running a Raspberry Pi, NAS, mini-PC, Docker host, etc. It's substantially lighter than the official Bitwarden server.

The downside is important: it isn't an official Bitwarden product, and Bitwarden explicitly says it cannot guarantee that its clients will always work perfectly with non-official servers.

3. KeePassXC — if you want zero cloud/server dependency

This is the one I'd choose if your philosophy is:

“I don't want my password manager to be a service at all.”

KeePassXC stores your encrypted vault as a .kdbx file locally. There is no server, account, subscription, or vendor cloud involved. The project explicitly describes itself as cloud-free.

You can then synchronize the encrypted database yourself using something like Syncthing, Nextcloud, or another file-sync mechanism. KeePassXC specifically documents this approach.

What I'd choose

• Want the nicest experience for family/multiple devices: Bitwarden self-hosted
• Have a homelab/NAS and want Bitwarden clients: Vaultwarden
• Want the strongest “no cloud whatsoever” philosophy: KeePassXC + Syncthing
• Want an air-gapped/offline password manager: KeePassXC

If by “does not rely on their cloud” you mean even if the vendor disappears, shuts down its servers, or you disconnect your server from the Internet, everything must continue working, I'd narrow the field to KeePassXC or Vaultwarden, with KeePassXC being the more fundamentally independent choice.

If you want a password manager that you run yourself and that does not depend on the vendor’s cloud, these are the strongest options:

My usual recommendations

For a personal or family setup:
→ Vaultwarden is probably the sweet spot. It gives you the Bitwarden experience while keeping the encrypted vault on your own infrastructure. It is commonly deployed with Docker on a NAS, mini PC, home server, or VPS. The official Bitwarden clients can connect to compatible self-hosted servers such as Vaultwarden, though Bitwarden notes that third-party servers are not officially guaranteed.

Typical setup:

• Docker Compose
• Vaultwarden container
• Reverse proxy (Caddy / Nginx Proxy Manager / Traefik)
• HTTPS certificate
• Automated backups
• 2FA enabled

For maximum “nothing leaves my control”:
→ KeePassXC. It stores everything in an encrypted .kdbx file. You can keep that file on your own machines and sync it using something you control, such as Syncthing or your own NAS.

For a company/team:
→ Passbolt or official self-hosted Bitwarden. Passbolt is designed around shared credentials and team workflows, while Bitwarden’s official self-host option is aimed more at organizations that want vendor support.

Things I would avoid

• Running a password manager exposed directly to the internet without HTTPS.
• Hosting it without tested backups.
• Keeping the only copy of the database on the same machine as the server.
• Forgetting your master password/recovery process.

A good minimal homelab setup would be:

• Vaultwarden in Docker
• Local storage + encrypted off-site backup
• TOTP or hardware security key for account protection
• HTTPS through a reverse proxy

If you tell me whether this is for one person, a family, or a team, and what you run (Synology, TrueNAS, Proxmox, Raspberry Pi, VPS, etc.), I can suggest the best deployment.

• Bitwarden is an open-source option where the core server can be self-hosted completely off their cloud using Vaultwarden (an unofficial, lightweight alternative written in Rust that is fully compatible with official Bitwarden clients) or the official Bitwarden self-hosted setup.
• KeePassXC is a totally offline, local password manager. It does not use a server or cloud at all by default; your database is a single file (.kdbx) that you can store locally or sync across your own private devices via a personal NAS, Syncthing, or local network.
• Vaultwarden is the go-to lightweight self-hosted backend API compatible with official Bitwarden browser extensions and mobile apps, allowing you to run your own server in a Docker container without touching the Bitwarden cloud.
• Pass (The standard unix password manager) uses GnuPG to encrypt individual password files, which can then be synchronized via a private Git repository that you host on your own server or home network.
• Psono is an enterprise-grade, open-source password manager designed with self-hosting as a first-class citizen, featuring a robust permission management system and its own dedicated backend/frontend containers.

If you want to narrow this down, let me know:

• Do you need syncing across mobile devices , or is this strictly for desktop use?
• Are you comfortable using Docker for self-hosting?

I can help you pick the best match and outline a quick setup approach.

• Vaultwarden - An unofficial, lightweight server written in Rust compatible with official Bitwarden clients (web, desktop, mobile, browser extensions). It consumes minimal resources and does not rely on Bitwarden's cloud. Check out the setup guide on the Vaultwarden GitHub Repository.
• KeePassXC - A completely offline, local password manager where your database (.kdbx) lives strictly on your device. You can sync it across your devices yourself via Syncthing, Nextcloud, or a local network share rather than relying on a third-party cloud. Learn more at the KeePassXC Official Website.
• Pass (the standard unix password manager) - A minimalist command-line password manager that stores each password inside a GPG-encrypted file. It plays nicely with Git for self-hosted syncing between devices. Explore the documentation at the Pass Official Website.
• Googlers/Bwwarden alternative / IronPass etc. (Other options like LessPass) - Stateless password manager where you don't even sync a database; it derives passwords on the fly based on a master password and site name.

Would you like me to help you compare Vaultwarden and KeePassXC , or do you need a guide on how to self-host Vaultwarden using Docker?

Yes. If your requirement is “I control the server, and the password manager can function without the vendor’s cloud”, there are a few very good options.

🥇 My recommendation: Vaultwarden

Vaultwarden is a lightweight, community-developed server that implements the Bitwarden API. You run it yourself, while using the normal Bitwarden apps on Windows, macOS, Linux, iOS, Android, and browsers.

The important distinction is that Vaultwarden isn't Bitwarden's official server. It's an independent implementation, so there's a little more compatibility/maintenance risk than using the official Bitwarden server. Bitwarden itself explicitly notes that it can't guarantee all official-client functionality against non-official servers.

For a home server/NAS/VPS, though, it's an extremely attractive setup.

Typical architecture:

                    Your infrastructure
┌──────────────────────────────────────────────────┐
│                                                  │
│   Bitwarden apps                                 │
│   iPhone / Android / PC / Browser               │
│          │                                       │
│          ▼                                       │
│   Reverse Proxy (HTTPS)                          │
│          │                                       │
│          ▼                                       │
│   Vaultwarden                                    │
│          │                                       │
│          ▼                                       │
│   Encrypted vault database                       │
│                                                  │
└──────────────────────────────────────────────────┘
                    │
                    X
             No vendor cloud

🥈 Official Bitwarden

Bitwarden itself now officially supports self-hosting. Their server infrastructure can be deployed with Docker, and Bitwarden provides documentation for Linux, Windows, Kubernetes, and other deployment options.

I'd choose official Bitwarden over Vaultwarden if this is for a business where you want vendor support and an officially supported deployment.

The downside is that it's substantially heavier than Vaultwarden, particularly for a simple personal installation.

🥉 KeePassXC — if you don't actually need a server

KeePassXC is worth considering if by “self-hosted” you really mean “I don't want anyone else's infrastructure involved.”

It stores an encrypted .kdbx database locally and doesn't require an account or server at all. The project explicitly describes itself as cloud-free, with no data stored on remote servers.

You can then put the encrypted database on your own NAS/WebDAV/Sync server and synchronize it between devices. This is arguably the most independent architecture because there's no password-manager server to maintain.

The tradeoff is that the experience is less seamless than Bitwarden/Vaultwarden, especially across phones and multiple users.

Passbolt

Passbolt is another genuinely self-hosted option, particularly if you're managing credentials for a team. I'd put it behind Vaultwarden for a typical individual/family deployment, but it's worth evaluating for organizational credential sharing. Bitwarden's current comparison also describes Passbolt as an open-source self-hosting competitor.

---

What I'd choose

For one person/family: Vaultwarden

For a business: Official Bitwarden

For absolute independence / minimal attack surface: KeePassXC + your own file synchronization

For a team heavily focused on shared credentials: Passbolt

One important point: self-hosting doesn't automatically mean “more secure.” You become responsible for HTTPS, OS/container updates, backups, database security, access control, and recovery. For a password manager, I'd especially want offline encrypted backups and a tested restore procedure.

If you tell me what you're hosting on (Synology, TrueNAS, Proxmox, Docker/Linux server, VPS, etc.) and whether it's just you or multiple users, I can recommend the specific setup I'd use.