登录

vaultwarden

dani-garciaAGPL-3.0活跃维护 有专家点评

用 Rust 写的 Bitwarden 兼容密码管理服务端，资源占用低，可自建替代官方服务，支持 Docker 部署。

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

1.37.5发布于 2026-11-01 22:16 UTC70,547star +184 / 7 天3,441fork同步于 2026-11-11 05:18 UTC
密码管理自建服务RustDockerBitwarden兼容
对比 GitHubbitwardenbitwarden-rsdockerrocketrust

专家点评

上手难度：进阶更新于 2026-11-11

自托管密码库的服务端，用 Rust 重写后顶替官方 Bitwarden 那套需要 SQL Server 和多个容器的部署

适用场景

  • 家庭或小团队自建密码库：一台 1C1G 的 VPS 加反向代理就能跑，官方服务端在这个规格上基本起不来，省下的是整台机器的成本
  • 需要 Bitwarden 客户端生态但不想付订阅：官方 App、浏览器扩展、CLI 全部直连，用户端零改动，迁移成本只在服务端
  • 组织内共享密码：集合、成员角色、Send 这些官方付费档的功能在这里是默认开的，适合十几人规模的小团队
  • 已有 Docker 编排体系：单镜像加一个 /data 卷，接进现有 compose 或 k8s 比官方那套多容器方案省事得多

踩坑

  • 客户端版本兼容是反复被报的问题类型：issue 里能看到 Bitwarden 客户端某次大版本更新后连不上、条目显示为空、编辑异常这类标题，且往往集中在客户端刚发版的窗口期。如果你的用户群会自动升级官方客户端，就得接受「某天早上突然有人登不上」的运维节奏，升级前先在测试实例上验证客户端版本
  • HTTPS 是硬前提，不是建议：Web Vault 依赖安全上下文，README 明说没有 HTTPS 就用不了。示例命令只把 80 端口映射到 127.0.0.1，意味着反向代理和证书必须自己配，这一步漏了会表现为「页面能开但登录不了」而不是明确报错
  • 组织邀请流程在版本升级中出过回归（issue 里有 invite link 无法接受、web-vault 缺 initOrganization 的记录）。用到组织功能的部署，升级前要单独验证邀请链路，别只测个人登录

同类对比

官方 Bitwarden 自托管（需要合规背书或官方支持合同）、Passbolt（团队场景更偏 PGP 体系）、KeePassXC 加同步盘（完全不想跑服务端时）

怎么上手

由 README 提炼，执行前请确认
原文 
docker pull vaultwarden/server:latest
docker run --detach --name vaultwarden --env DOMAIN="https://vw.domain.tld" --volume /vw-data/:/data/ --restart unless-stopped --publish 127.0.0.1:8000:80 vaultwarden/server:latest
硬件要求按 README 说明

README 未说明具体硬件要求；推荐以容器镜像方式部署，资源占用比官方服务端轻。

有 Docker 镜像
下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼

用 Rust 写的 Bitwarden 兼容服务端，让自托管密码库不必跑官方那套重资源服务

用 Rust 写的 Bitwarden 兼容密码管理服务端，资源占用低，可自建替代官方服务，支持 Docker 部署。

核心能力

  • 实现 Bitwarden 客户端 API 的绝大部分功能
  • 支持个人保险库、Send、附件与网站图标
  • 支持组织、集合、密码共享与成员角色
  • 支持 TOTP、邮件、FIDO2、YubiKey、Duo 两步验证
  • 内置修改版 Web Vault 与管理后台

容易踩的坑

Web Vault 依赖 HTTPS 和安全上下文，不启用 HTTPS 就无法使用；容器默认监听 80 端口，示例只映射到本机 127.0.0.1:8000，需自行配反向代理对外；数据持久化依赖挂载 /data 卷，不挂载会丢数据。

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

最近发版

5 个版本1.37.5
全部 release
  1. 1.37.5最新正式版2026-11-01 · 2026-11-01 22:16 UTC

    Security Fixes

    This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.

    These are private for now, pending CVE assignment and publishing at a later date.

    Note

    This update is required for web vault 2026.7.1+ to turn two-step login methods on or off, and for 2026.9.0+ to take over an account through emergency access. Please update before reporting any issues with them.

    Upgrade notes

    • Web vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues.
    • Configuration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT, or above 255 for EMAIL_ATTEMPTS_LIMIT. The rate limit *_SECONDS and *_MAX_BURST options, DATABASE_TIMEOUT and DATABASE_IDLE_TIMEOUT must be at least 1, DATABASE_MIN_CONNS can't be larger than DATABASE_MAX_CONNS, and DUO_CONTEXT_PURGE_SCHEDULE and PURGE_INCOMPLETE_SSO_AUTH must be empty or a valid cron expression.

    What's Changed

  2. 1.37.42026-10-05 · 2026-10-05 23:40 UTC
    查看更新说明

    Security Fixes

    This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.

    These are private for now, pending CVE assignment and publishing at a later date.

    [!NOTE] If an organization has Admins you don't fully trust, consider rotating its API key after updating (Admin Console → Settings → Rotate API key). Before this release, Admins could also view the key.

    Upgrade notes

    • Reverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address that isn't in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you have several proxies in a row, for example a CDN in front of nginx, add all of them to IP_HEADER_TRUSTED_PROXIES. Otherwise the address of the proxy in front is used for rate limiting and logs.
    • Sends: bw send receive on CLI 2026.4.2 and older no longer works, the same as against Bitwarden's own servers since v2026.8.0. Creating and managing Sends works on all clients.
    • Feature flags: these flags were removed because no client reads them anymore: ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile and cxp-export-mobile. If EXPERIMENTAL_CLIENT_FEATURE_FLAGS still lists one of them, startup logs a warning and saving settings in the admin panel fails until it's removed.
    • Duo: DUO_USE_IFRAME (the deprecated Traditional Prompt) is removed and ignored if set.
    • Custom templates: there's a new email template, email/recover_twofactor, sent after a login with a two-step recovery code.
    • The legacy POST /identity/accounts/register and POST /api/accounts/prelogin endpoints are removed. No current client uses them.
    • When using a MariaDB or MySQL server which does not support native TLS/SSL encrypted connections, using the Alpine image of Vaultwarden might fail to connect. Add MARIADB_TLS_DISABLE_PEER_VERIFICATION=1 as an environment variable to your Vaultwarden server environment, and it will start running again.

    What's Changed

  3. 1.37.32026-09-13 · 2026-09-13 15:03 UTC
    查看更新说明

    What's Changed

    New Contributors

    Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.2...1.37.3

  4. 1.37.22026-08-22 · 2026-08-22 12:29 UTC
    查看更新说明

    Note

    This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them.

    [!IMPORTANT] Also read #7615 for more details if you still have client issues!

    What's Changed

    New Contributors

    Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.1...1.37.2

  5. 1.37.12026-07-29 · 2026-07-29 13:40 UTC
    查看更新说明

    Note

    This patch release resolves the issues with invites. If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues.

    I'm sorry that it took some time to check and validate this fix.

    Also, this release fixes an issue (#7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/. An issue with the build image OpenSSL compilation is resolved and those are used to build the new alpine tagged containers.

    What's Changed

    New Contributors

    Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.0...1.37.1

用户点评

登录用户的真实使用记录，可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译
    在 GitHub 打开

    Vaultwarden Logo

    An alternative server implementation of the Bitwarden Client API, written in Rust and compatible with official Bitwarden clients [disclaimer], perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.

    GitHub Release ghcr.io Pulls Docker Pulls Quay.io Contributors Forks Stars Issues Open Issues Closed AGPL-3.0 Licensed Dependency Status GHA Release GHA Build Matrix Chat GitHub Discussions Discourse Discussions

    [!IMPORTANT] When using this server, please report any bugs or suggestions directly to us (see Get in touch), regardless of whatever clients you are using (mobile, desktop, browser...). DO NOT use the official Bitwarden support channels.

    Features

    A nearly complete implementation of the Bitwarden Client API is provided, including:

    Usage

    [!IMPORTANT] The web-vault requires the use of HTTPS and a secure context for the Web Crypto API. That means it will only work if you enable HTTPS. We also suggest to use a reverse proxy.

    The recommended way to install and use Vaultwarden is via our container images which are published to ghcr.io, docker.io and quay.io. See which container image to use for an explanation of the provided tags.

    There are also community driven packages which can be used, but those might be lagging behind the latest version or might deviate in the way Vaultwarden is configured, as described in our Wiki.

    Alternatively, you can also build Vaultwarden yourself.

    While Vaultwarden is based upon the Rocket web framework which has built-in support for TLS our recommendation would be that you setup a reverse proxy (see proxy examples).

    [!TIP] For more detailed examples on how to install, use and configure Vaultwarden you can check our Wiki.

    Docker/Podman CLI

    Pull the container image and mount a volume from the host for persistent storage. You can replace docker with podman if you prefer to use podman.

    docker pull vaultwarden/server:latest
docker run --detach --name vaultwarden \
  --env DOMAIN="https://vw.domain.tld" \
  --volume /vw-data/:/data/ \
  --restart unless-stopped \
  --publish 127.0.0.1:8000:80 \
  vaultwarden/server:latest

    This will preserve any persistent data under /vw-data/, you can adapt the path to whatever suits you.

    Docker Compose

    To use Docker compose you need to create a compose.yaml which will hold the configuration to run the Vaultwarden container.

    services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vw.domain.tld"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 127.0.0.1:8000:80

    Get in touch

    Have a question, suggestion or need help? Join our community on Matrix, GitHub Discussions or Discourse Forums.

    Encountered a bug or crash? Please search our issue tracker and discussions to see if it's already been reported. If not, please start a new discussion or create a new issue. Ensure you're using the latest version of Vaultwarden and there aren't any similar issues open or closed!

    Contributors

    Thanks for your contribution to the project!

    Contributors Count Contributors Avatars

    Disclaimer

    This project is not associated with Bitwarden or Bitwarden, Inc.

    However, one of the active maintainers for Vaultwarden is employed by Bitwarden and is allowed to contribute to the project on their own time. These contributions are independent of Bitwarden and are reviewed by other maintainers.

    The maintainers work together to set the direction for the project, focusing on serving the self-hosting community, including individuals, families, and small organizations, while ensuring the project's sustainability.

    Please note: We cannot be held liable for any data loss that may occur while using Vaultwarden. This includes passwords, attachments, and other information handled by the application. We highly recommend performing regular backups of your files and database. However, should you experience data loss, we encourage you to contact us immediately.

    Bitwarden_RS

    This project was known as Bitwarden_RS and has been renamed to separate itself from the official Bitwarden server in the hopes of avoiding confusion and trademark/branding issues. Please see #1642 - v1.21.0 release and project rename to Vaultwarden for more explanation.

    相关项目

    同分类里 star 最高的项目
    对比全部 →
    kubernetes
    kubernetes·Go

    生产级的容器编排与调度平台，用来自动化部署、扩缩容和管理跨主机的容器化应用。

    容器编排+4容器 / Kubernetes硬核
    129003+10645kv1.37.22026-11-10 23:27 UTC
    uptime-kuma
    louislam·JavaScript

    自托管的网站与服务可用性监控面板，支持 HTTP、TCP、Ping 等多种探活方式，通过实时图表和告警通知掌握服务宕机情况。

    可用性监控+4容器 / Kubernetes入门
    93480+1328.7k2.5.92026-11-11 03:51 UTC
    mall
    macrozheng·Java

    基于 Spring Boot + MyBatis 的完整电商系统，含前台商城和后台管理，覆盖商品、订单、会员、促销等模块，用 Docker 容器化部署。

    电商系统+4容器 / Kubernetes进阶
    85031+1930kv1.0.32026-09-15 02:34 UTC
    moby
    moby·Go

    构建容器化系统的开源协作项目，提供可拼装的组件，用来搭建和定制自己的容器平台，也是 Docker 的上游基础。

    容器引擎+3容器 / Kubernetes硬核
    72367+1219kdocker-v29.9.32026-11-10 23:19 UTC