Deploy Vaultwarden
Your own password manager server, invite only
Deploy Vaultwarden with managed PostgreSQL, invitation emails that send, and a public HTTPS URL. Sign-up is closed from the first second: you open the admin panel with a token generated at deploy and invite the people who should have an account. Vaults are encrypted on each device before they reach the server.
What you get with Vaultwarden
- End-to-end encryptedLogins, notes, cards and files are encrypted on your device with a key derived from your master password. The server only ever stores ciphertext.
- Organizations and collectionsCreate an organization for your team, share items through collections and invite members by email. Each member keeps a private vault too.
- Works with the official appsUse the built-in web vault, or the browser extensions, desktop and mobile apps: choose self-hosted and enter your app URL.
- Live syncChanges push to open apps over WebSocket notifications through the StackBlaze edge, so an edit on one device shows up on the others.
- Generator, attachments and SendGenerate passwords and passphrases, attach encrypted files to items, and share a secret with anyone through an expiring Send link.
- Invite only from day onePublic sign-up is off. Accounts come from invitations you send in the admin panel or from an organization, so nobody can claim your server.
After you deploy Vaultwarden
- 1Open the admin panelGo to /admin on your app URL and sign in with ADMIN_PANEL_TOKEN from the app’s Variables in the dashboard. It is hashed with Argon2id when the server starts.
- 2Invite yourselfUnder Users, invite your own email address. The invitation arrives through the Email add-on; its link lets you choose your master password and create the account.
- 3Connect your appsSign in to the web vault at your app URL, or pick self-hosted in a browser extension, desktop or mobile app and enter the same URL. Then invite your team.
How Vaultwarden is wired
Vaultwarden, PostgreSQL and the Email add-on ship together. The public hostname serves the web vault, the API the apps use and live sync. Encrypted vault data lives in PostgreSQL.
- PostgreSQL holds the vault
- Accounts, organizations and encrypted items live in the attached PostgreSQL database, with passwords generated at deploy. Redeploys keep every item.
- Keys and files on the volume
- The server’s signing key, encrypted attachments, Send files and website icons live on a 2 GB volume at /data, so sessions and files survive a redeploy.
- Mail goes through the Email add-on
- Invitations and account emails send through the platform relay from your project’s sending address. There is no mail server to set up.
- Rate limited sign-in
- Admin and account logins are rate limited per visitor, and the StackBlaze edge passes the real client address, so one visitor can’t lock out the rest.
Why run Vaultwarden on StackBlaze
- Scale your appChange CPU, RAM, and replicas without a rebuild, or let autoscaling add replicas when CPU climbs.
- Git-based CI/CDPush to GitHub and it builds and ships. Pull requests get their own preview URL on Pro and Business.
- One-click rollbackA deploy went wrong? Go back to any previous successful deploy.
- Environments built inProduction, staging, and dev as separate environments in one project, each with its own URL.
- Built-in observabilityCPU, memory, and response time per app, live logs with search, and alerts to Slack, Discord, or a webhook.
- Developer-first toolsA CLI and Stack MCP: deploy, read logs, and wire services from your terminal or your AI assistant.
- Built for teamsInvite teammates with roles. An audit log records who changed what.
- Managed Postgres with HAPostgres is run for you. Turn on high availability for a three-node cluster when the app needs it.
Common questions about Vaultwarden
How do I create the first account?
Open /admin on your app URL, sign in with ADMIN_PANEL_TOKEN from the app’s Variables, and invite your own email address under Users. The invitation email lets you set your master password. Sign-up is closed, so this is the only way in until you invite others.
Can StackBlaze or the server reset my master password?
No. Your master password never leaves your device and your vault is encrypted with it, so nobody can recover it. Write it down somewhere safe, or set up emergency access for someone you trust.
Which apps can I use?
The web vault at your app URL, plus the Bitwarden browser extensions, desktop and mobile apps. On their login screen choose self-hosted and enter your app URL.
Does mobile push work?
Apps sync when they open and the web vault and desktop apps get live updates. Instant push to phones needs a free installation id and key from bitwarden.com/host, set as PUSH_ENABLED, PUSH_INSTALLATION_ID and PUSH_INSTALLATION_KEY.
Where is my data stored?
Encrypted vault items, accounts and organizations are in PostgreSQL. The signing key, attachments and Send files are on the app volume. Both stay when you redeploy.
Can I use my own domain?
Yes. Attach a custom domain from the dashboard, for example vault.example.com, and set DOMAIN to the new https address so invitation links and apps use it. Custom domains
What does it cost?
You pay for the compute, storage and bandwidth Vaultwarden and PostgreSQL use, and for the emails it sends, not per user. Pricing
