Every few months someone in a dev Slack asks the same thing: is it actually worth running your own password vault, or should you just pay for the hosted one? I have run three of these in production and I keep coming back to the same short answer. For one person, no. For a family, a small team, or anyone with a rule about where credentials are allowed to live, yes, and the gap is bigger than people expect.
This is a comparison of the four self-hosted password managers that are actually maintained in 2026, with the numbers checked on 16 September 2026.
The short version
| Tool | Licence | GitHub stars | RAM it wants | Uses official Bitwarden apps? | Best for |
|---|---|---|---|---|---|
| Vaultwarden | AGPL-3.0 | 67,708 | Tens of MB | Yes | Families and small teams who want the Bitwarden experience on their own server |
| Bitwarden (self-hosted) | Source-available under Bitwarden’s own licence | 20,147 | 2 GB minimum, 4 GB recommended | Yes | Companies that need the vendor, the audits and a support contract |
| Passbolt | AGPL-3.0 | 6,123 | ~2 GB for the standard Docker install | No, its own apps | Teams that want per-secret sharing built on OpenPGP |
| Psono | Source-available, mixed per component | 107 (server repo) | ~1 GB | No, its own apps | Teams that want fine-grained enterprise features without a per-seat bill |
Star counts and licences read from the GitHub API on 16 September 2026. Bitwarden’s server source is published on GitHub, but GitHub does not resolve it to a standard SPDX licence, so I am not going to call it open source or not open source. Read the licence file and decide for yourself.
Vaultwarden: the one most people actually want
Vaultwarden is the reason this category is interesting. It is an unofficial server, written in Rust, that speaks the Bitwarden API. That one sentence is the whole pitch: you run Vaultwarden, and you keep using the official Bitwarden browser extension, iOS app, Android app, desktop app and CLI, pointed at your server URL instead of bitwarden.com. The vault format and the end-to-end, zero-knowledge encryption model are identical either way.
The weight difference is the part that surprises people. Vaultwarden is a single Rust binary with a SQLite database. Bitwarden’s own self-hosting docs ask for 2 GB of RAM as a minimum and recommend 4 GB, with 12 GB of storage minimum and 25 GB recommended, because the standard deployment runs several services with a SQL database behind them. Vaultwarden running a real vault sits in tens of megabytes. That is not a small optimisation, it is a different class of machine.
There is a fuller breakdown of exactly what you give up and what you keep in this Vaultwarden vs Bitwarden comparison, including the security-certification question, which is the honest weak point.
The money, which is the only reason most people look
Bitwarden’s hosted pricing, checked on 16 September 2026:
| Plan | Price | Annual cost |
|---|---|---|
| Free | $0 | $0, unlimited passwords on unlimited devices |
| Premium | $1.65/month | $19.80, billed annually, 1 account |
| Families | $3.99/month | $47.88, billed annually, up to 6 users |
| Teams | $4/user/month | $480 for 10 users |
| Enterprise | $6/user/month | $720 for 10 users |
Now do the same sum for a self-hosted server. A small server that comfortably runs Vaultwarden costs about $3/month flat, and that price does not move when you add the fifth person or the fiftieth. Ten people on Bitwarden Teams is $480 a year. Ten people on one Vaultwarden server is $36 a year, with the premium and organization features unlocked.
That is where the honesty matters, though. For a single person, Bitwarden Free already covers unlimited passwords on unlimited devices, and Premium is $19.80 a year. A $3/month server costs you more, not less, and you also inherit backups, updates and uptime. Self-hosting a vault for one person is a preference, not a saving. The arithmetic only flips at a family plan or a team.
Passbolt: built for sharing, not for you
Passbolt (AGPL-3.0, 6,123 stars) is the one people reach for when the problem is not “where do my passwords live” but “who in this company can see which credential”. It is built on OpenPGP, every secret is encrypted to the recipients who are allowed to read it, and the sharing model is per-secret rather than per-folder. The admin side has real access-control depth.
The cost is that it does not ride on Bitwarden’s client apps. You use Passbolt’s own browser extension and mobile apps, and they are fine, but they are not the polished thing your non-technical relatives already have installed. Passbolt is a team tool. If your use case is a household, it is the wrong shape.
Psono: capable, and almost nobody runs it
Psono gives you a lot for a self-hosted install, including things normally gated behind an enterprise tier: shared folders, granular rights, an API key system, SSH and GPG key storage. The catch is the ecosystem. 107 stars on the server repo is not a knock on the code, it is a statement about how many people you will find who have hit your problem before. When something breaks at 1am, that number is what you are actually buying.
What running one actually costs you in time
The part comparison posts skip. A password vault you host is the one service where “I will fix it this weekend” is not an acceptable plan, so the real checklist is:
- HTTPS from day one. A vault without TLS is not usable. The Bitwarden clients will refuse it and they are right to.
- Backups you have restored at least once. Not backups you have configured. Restored.
- Updates. Vaultwarden ships often. Its repo was last pushed on 13 September 2026.
- A recovery story. Zero-knowledge means nobody can reset it for you. Write down what happens if the server dies and you are the only admin.
None of that is hard. It is just real, and it is the difference between the $36 a year and the $480 a year.
So which one
Vaultwarden, for almost everyone reading this. It keeps the client apps people already know, it runs on the cheapest server you can rent, and the flat price is the entire argument for self-hosting in the first place. Pick official Bitwarden self-hosted instead when you need the vendor relationship, the ISO 27001 and SOC 2 paperwork, and someone to call. Pick Passbolt if the requirement is per-secret sharing across a team. Pick Psono if you have read its docs and the feature list specifically matches something the others cannot do.
If you want the longer list, including the ones I left out here, there is a fuller guide to self-hosted password managers that goes wider. And if you just want Vaultwarden running with HTTPS, a domain and daily backups without doing the Docker and reverse-proxy work yourself, InstaPods runs it as a one-click app on a $3/mo plan.