TL;DR: Vaultwarden is an open-source version of the Bitwarden server, usable with the official Bitwarden apps. Beyond tidying up passwords, it gives an SMB two things it rarely looks for in the right place: a report listing every reused, weak or compromised password across the team, and a vault to hold passkeys so they do not walk out with the phone of whoever created them. A twenty-person team pays roughly US$960 a year with Bitwarden for the equivalent.
Hey, this technical guide could be handy for our sysadmin!
​ ​ ​ ​ ​ ​- You, probably, right after downloading the guide
Your accounts payable lead leaves the company on a Friday. Monday morning, nobody knows exactly which accounts she had. The bank portal, the electricity supplier account, the payroll service, two online stores, the domain name registrar. The passwords were in her head, in her browser, and in an Excel file that three people have edited since 2022. Which ones do you change, exactly?
That is the precise moment a password manager stops being an abstract best practice. Either the list of accounts to change exists, or it does not.
The 2026 edition of the Verizon Data Breach Investigations Report also corrects a figure many people still quote wrong. For the first time in nineteen years, exploitation of software vulnerabilities (31%) overtook stolen credentials as the leading way in, and credential abuse as an initial access vector dropped from 22% to 13%. Credentials remain everywhere else in the chain: counting them wherever they appear in a breach rather than only at the first step, they show up in 39% of cases, and half of ransomware victims had suffered a credential leak within the 95 days before the attack.
Vaultwarden in one sentence
Bitwarden is a set of apps (browser extension, mobile, desktop) and a server they talk to. Bitwarden Inc. runs that server and sells access per user. Vaultwarden is a second implementation of that server, written by other people, speaking exactly the same language as the official apps. Your employees install the usual Bitwarden extension. It points at your machine instead of Bitwarden Inc.'s.
The project is not affiliated with Bitwarden Inc., and says so plainly in its own repository, while noting that one of its active maintainers works at Bitwarden and contributes in a personal capacity. It is published under the AGPLv3 open-source licence.
The rest of this article sets the installation aside, since that is an administrator's subject, and looks at what you and your employees get out of it day to day. If the technical side is what brought you here, our administration cheat sheet fits on a single page, as a PDF: day-one settings, files to back up, hardening and known limits. It is written in French.
The report that tells you where it hurts
Ask your team whether anyone reuses the same password across several services. You will get answers that are both sincere and wrong, because nobody actually remembers. That question gets answered with a list, not with a survey.
The vault produces that list. Five reports, each answering one precise question:
| Report | What it shows you |
|---|---|
| Reused passwords | Passwords used in more than one place. One compromised service puts all of them at risk |
| Weak passwords | The ones an automated tool guesses quickly, sorted by severity |
| Exposed passwords | The ones already appearing in public data leaks |
| Unsecured websites | Accounts saved on an address that does not encrypt the connection |
| Inactive two-factor | Services that offer two-factor authentication without you having switched it on |
The last one is often the most useful. Plenty of companies pay for tools that offer two-factor authentication without anyone ever enabling it, and nobody knows because nobody has the list.
Two caveats worth knowing. With Bitwarden, these reports are reserved for paid plans, whether individual or organizational. On a Vaultwarden server they come at no extra cost. And the part that checks whether your email addresses appear in known leaks relies on the Have I Been Pwned service, whose programmatic access requires a subscription to that service: a separate and modest expense to plan for if you want it.
Passkeys, and why they concern the business
A passkey replaces the password with a pair of cryptographic keys. The site keeps the public half, your device keeps the private half, and nothing reusable travels at sign-in time. There is no longer a password to guess, to resell after a leak, or to type into a fake site.
This is no longer a frontier topic. The FIDO Alliance counted five billion passkeys in use in May 2026, with 75% of people having enabled at least one and 68% of surveyed organizations having deployed or currently deploying them for employee sign-ins. The careful reading: that workforce survey covered organizations of 500 employees and up, so larger than the average Quebec SMB.
The trap for a business is not the technology, it is where the key gets stored. Created with the defaults, a passkey lives in the phone or computer of the person who created it, inside their personal Apple or Google account. The day that person leaves, the key to the business account leaves with them, and there is no password to change to take back control: you have to go through each service's recovery procedure, one at a time.
Storing passkeys in the team vault solves exactly that problem. They are created and used from the Bitwarden browser extension and mobile apps, they live in the company's vault, and they survive the departure of the person who made them. It is the same reasoning as for shared passwords, applied to what is gradually replacing them.
Three questions to ask before adopting passkeys in a company:
- Where do the keys your employees create today get stored: in their personal account, or in a vault the company owns?
- Which critical services already accept them? The bank and the cloud provider are worth the detour before the social networks.
- What happens if the device holding the key is lost? A key kept in the vault is found again, a key locked inside a phone is recovered service by service.
The math, for a team of twenty
Bitwarden's free account covers one person, with no sharing. The free organization lets two people share, across two collections. Beyond that it is paid. Nothing unusual there: team sharing and the health reports are exactly what an SMB comes looking for.
| Option | Annual cost, 20 people | What you manage |
|---|---|---|
| Bitwarden, free organization | $0 | Nothing, but capped at 2 people and 2 collections, with no reports |
| Bitwarden Teams | US$960 | Nothing |
| Bitwarden Enterprise | US$1,440 | Nothing. Adds single sign-on and enterprise policies |
| Self-hosted Vaultwarden | $0 in licensing | The server, the backups, the updates |
Bitwarden's prices are listed in US dollars and billed annually: US$4 per person per month for Teams, US$6 for Enterprise. For a Quebec SMB, add the conversion and the way it moves from one year to the next.
Nine hundred and sixty dollars a year for twenty people is not a painful number. And the right-hand column of that table is not free either. A server holding the company's passwords needs a machine, applied updates, and a backup whose restore someone actually verifies. That last point is not a formality: the vault is end-to-end encrypted, so a stolen backup is not a stolen vault, but a lost backup is a lost vault that nobody can decrypt on your behalf.
When the subscription is still the right call
If you have no server and nobody to apply patches, pay for the subscription. A self-hosted vault that stops being updated is a more expensive problem than $960 a year.
If you already run something (a Nextcloud, an Odoo, a website) and someone tends those machines every month, Vaultwarden slots into a routine that already exists. The saving is not even the main argument. The vault lives on infrastructure you control, in the country of your choosing.
And if your security policy calls for custom roles, single sign-on enforced on everyone, or synchronisation with your corporate directory, the official Enterprise plan does things Vaultwarden does not.
The Friday somebody leaves
Back to the opening scenario. With a team vault, the sequence takes about ten minutes: you revoke the account, you open the list of collections the person had access to, and you change the shared passwords sitting in them. The list is finite and it is on screen.
What the vault does not do, however, is erase what someone memorised. Revoking access does not undo memory. What settles the question is rotating the shared passwords, not the revocation. That is what the vault is for: it turns "we are not quite sure what she knew" into a precise list of twelve entries to change. That is exactly the gap described in our onboarding and offboarding checklist.
What Vaultwarden does not do
The project maintains its own list of what is missing compared to the official server. Few commercial vendors go that far.
On passkeys, one nuance is worth understanding: storing them in the vault and using them to open your accounts works, but opening the vault itself with a passkey is not possible yet. A master password is still required, along with a second factor.
Also absent are new device login protection and full synchronisation with a corporate directory. And unlikely to arrive: custom roles, along with certain enterprise policies such as requiring single sign-on, forcing a vault timeout, or preventing an employee from exporting their personal vault. That last one surprises people. If your internal policy says nobody may export their vault, Vaultwarden will not enforce it for you.
Can you trust a community project
Handing the company's passwords to software written by volunteers raises a legitimate question. Two public answers exist.
Germany's federal office for information security put Vaultwarden through a code analysis under its open-source audit programme, with reports published in 2024 in German and in English translation. In October 2024, the firm ERNW ran a penetration test and found three vulnerabilities, including an authentication bypass, responsibly disclosed and fixed a few versions later.
Submitting to a federal agency's audit, fixing the flaw and letting the details be published makes for a more transparent record than plenty of commercial software can show. The server itself remains your responsibility.
Where the vault should live
A password vault is the single most rewarding target in your infrastructure. It holds the keys to the systems handling your payroll, your client files and your bank accounts. Where it is hosted is not a housekeeping detail.
Quebec's Law 25 governs the communication of personal information outside the province, and a company vault holds, at a minimum, the named credentials of your employees. The jurisdiction question comes up before the install, not after the first incident.
We set up Vaultwarden vaults for teams: access structured by department, mandatory two-factor, verified backups. Let's sort out your access.
Where to start this week
Before even choosing between the subscription and self-hosting, one hour of work. Write down the list of the company's shared accounts: the bank portal, the domain registrar, the social networks, the cloud provider, the group insurance. For each one, note how many people know it, and how many of them still work for you.
That list is the real deliverable. The vault, afterwards, is just where it lives, and the reports will tell you which of those passwords were already due for a change.
If your passwords are still scattered between a spreadsheet and a few people's memory, drop us a line.
Sources
- Vaultwarden on GitHub: code, AGPLv3 licence and the list of missing features
- Vaultwarden releases: 1.37.1 is dated 29 July 2026
- Vaultwarden audits: summary of the BSI and ERNW work
- BSI code analysis of Vaultwarden: reports from the CAOS programme (page in German, reports also in English)
- ERNW authentication bypass disclosure: three vulnerabilities, fixed in 1.32.5
- Bitwarden vault health reports: the five reports, the plans required and the Have I Been Pwned dependency
- Storing passkeys in Bitwarden: creation and use from the browser extension and mobile apps
- Bitwarden business pricing: Teams at US$4 and Enterprise at US$6 per person per month, billed annually
- Bitwarden plan comparison: limits of the free organization, two people and two collections
- FIDO Alliance, World Passkey Day 2026: five billion passkeys in use and enterprise adoption rates
- Verizon DBIR 2026: vulnerability exploitation taking first place and where credentials sit in breaches