Self-Hosted vs Cloud Password Managers: Which to Choose

Password reuse is still the single most common cause of account takeovers, and it happens because remembering 100 unique 20-character passwords is impossible for a human brain. A password manager solves that. But once you decide to use one, you hit a fork in the road that trips up a surprising number of technical and non-technical users alike: do you trust a cloud provider like Bitwarden or 1Password to hold your encrypted vault, or do you run your own self-hosted password manager on hardware you control?

Here is a stat worth sitting with. LastPass, one of the largest cloud password managers, suffered a breach in 2022 in which attackers exfiltrated encrypted vaults belonging to millions of customers. The encryption held for users with strong master passwords, but weaker vaults were reportedly cracked offline over the following months. That single incident pushed a wave of privacy-conscious users toward self-hosting. It also proved a subtler point: the model you choose changes your threat surface, not whether you have one.

I have run both. I kept a cloud vault synced across five devices for years, then migrated a family setup to a self-hosted Vaultwarden instance, and I still keep a hybrid arrangement today. This article walks through the real tradeoffs, a worked migration example with numbers, a side-by-side comparison table, and a step-by-step self-hosting walkthrough you could follow tonight.

Key Takeaways

• Cloud managers win on convenience: zero maintenance, near-perfect uptime, and polished mobile apps. Best for most individuals and small teams.
• Self-hosted managers win on control: your encrypted vault never touches a third-party server, which shrinks your legal and breach exposure.
• Both use zero-knowledge, client-side encryption, so a breach of the server does not automatically expose plaintext passwords.
• Self-hosting shifts the burden onto you: backups, updates, TLS certificates, and uptime become your responsibility.
• A weak master password is your biggest risk in either model. Use a 5+ word passphrase and hardware 2FA.
• Hybrid setups (self-hosted vault plus offline encrypted backups) give the best of both for advanced users.

What Is a Self-Hosted Password Manager?

A self-hosted password manager is software you install and run on infrastructure you control. That might be a $5/month VPS, a home server, a Raspberry Pi in a drawer, or a Docker container on your NAS. Your encrypted vault lives there instead of on a vendor's cloud.

The most popular options are:

• Vaultwarden — a lightweight, unofficial server implementation compatible with all official Bitwarden client apps. Written in Rust, runs comfortably on 512MB of RAM.
• Bitwarden self-hosted — the official server, more resource-hungry (Docker stack with multiple containers), aimed at organizations.
• KeePassXC + a synced file — technically self-hosting if you store the .kdbx database on your own Nextcloud or Syncthing.
• Passbolt — team-focused, self-hosted, with granular sharing controls popular in engineering orgs.

The critical thing to understand: in all reputable password managers, cloud or self-hosted, encryption happens on your device before anything is transmitted. This is called zero-knowledge architecture. The server, whether it belongs to a vendor or to you, only ever sees a blob of ciphertext. Self-hosting does not make the encryption stronger. It changes who holds the ciphertext and who is a target.

Cloud vs Self-Hosted: The Core Tradeoff

Cloud password managers are a managed service. You pay a subscription, and the vendor handles servers, backups, uptime, security patches, and compliance. Your job is to pick a strong master password and enable two-factor authentication.

Self-hosting flips that. You get sovereignty over your data and, often, lower long-term cost. In exchange, you inherit the operational responsibilities that a vendor used to absorb. If your server goes down at 2 a.m. before a flight, that is your problem to fix.

Here is how I frame it: cloud is renting a secure apartment with a doorman. Self-hosting is owning a house with your own locks. The house can be more secure, but only if you actually maintain it. Neglect it, and it becomes less secure than the apartment.

The uncomfortable truth about "control"

Many people move to self-hosting for security and end up worse off because they skip backups or expose an unpatched server to the internet. If you would not enjoy running a proper 3-2-1 backup strategy and keeping a service patched, a reputable cloud provider is genuinely the safer choice for you. Honesty beats ideology here.

Head-to-Head Comparison

Below is how the main options stack up across the criteria that actually matter day to day. Ratings reflect my hands-on experience, not marketing pages.

Criteria	Bitwarden (Cloud)	1Password (Cloud)	Vaultwarden (Self-Hosted)	KeePassXC + Sync
Setup difficulty	Very easy	Very easy	Moderate (Docker)	Moderate
Ongoing maintenance	None	None	You handle updates & backups	You handle sync & backups
Data control	Vendor-held	Vendor-held	Full	Full
Typical annual cost	$0–$10	~$36	~$60 (VPS) or $0 (home server)	$0
Mobile/browser polish	Excellent	Excellent	Excellent (Bitwarden apps)	Good
Uptime responsibility	Vendor (99.9%+)	Vendor (99.9%+)	You	You

Notice that Vaultwarden scores excellently on app polish. That is its secret weapon: it reuses the official Bitwarden clients, so you self-host the server without sacrificing the user experience. That combination is why it dominates the self-hosted conversation.

A Worked Example: Migrating 143 Passwords for a Family of Four

Let me make this concrete. A friend asked me to move his household off a mix of "written in a notebook" and "saved in Chrome." Between four people we counted 143 credentials across 61 services, including 12 shared logins (streaming, utilities, the family bank alert account).

Here is the before/after and the numbers that decided the approach.

The options we priced

• Cloud (Bitwarden Families): $40/year, unlimited sharing, zero maintenance.
• Self-hosted (Vaultwarden on a $5/month VPS): $60/year, full control, ~2 hours setup, ~30 min/quarter maintenance.

On pure cost, cloud won. But he already ran a Nextcloud server for photos and wanted the family passwords to stay on the same box for privacy reasons. So we went self-hosted. The migration took one evening:

1. Export existing data. We exported Chrome passwords to CSV (23 minutes to clean up duplicates and dead entries, dropping 143 raw entries to 118 real ones).
2. Stand up Vaultwarden. A single Docker container behind an existing reverse proxy (35 minutes including TLS).
3. Import the CSV using the Bitwarden web vault import tool (under 5 minutes).
4. Delete the CSV securely. Plaintext credential files are a classic leak vector; we shredded it immediately.
5. Set up shared collections for the 12 household logins so everyone saw the same streaming password (10 minutes).
6. Enforce strong master passwords and enable 2FA on each of the four accounts (15 minutes).

Total hands-on time: about 90 minutes. Six months later he has spent roughly 45 minutes on updates and one backup test. For a technically comfortable person who already ran a server, self-hosting was the right call. For his neighbor who calls me when the printer is offline, I recommended Bitwarden cloud without hesitation.

How to Set Up a Self-Hosted Password Manager (Vaultwarden Walkthrough)

If you want to try self-hosting, here is a walkthrough complete enough to follow without another tab open. This assumes a fresh Ubuntu VPS or home server with Docker installed.

1. Point a subdomain at your server. Create an A record like vault.yourdomain.com pointing to your server's IP.
2. Create a data directory. Run mkdir -p /opt/vaultwarden/data to hold your persistent vault data.
3. Launch the container. A minimal run command: docker run -d --name vaultwarden -v /opt/vaultwarden/data:/data -p 8080:80 vaultwarden/server:latest.
4. Put it behind a reverse proxy with TLS. Use Caddy or Nginx to terminate HTTPS. This is non-negotiable. A password manager on plain HTTP is a liability, not an asset.
5. Disable open signups after creating your accounts. Set the SIGNUPS_ALLOWED=false environment variable so strangers cannot register on your instance.
6. Enable the admin panel with a token via ADMIN_TOKEN, then use it to configure SMTP for email 2FA and invitations.
7. Install the Bitwarden apps on each device and, on the login screen, tap the gear icon to set your self-hosted server URL to https://vault.yourdomain.com before entering credentials.
8. Configure automated backups. Back up the /opt/vaultwarden/data directory nightly to a second location. This directory contains your SQLite database, attachments, and keys.

9. Cover image: craft drawers by EvelynGiggles, licensed under BY 2.0 via Openverse.