Bitwarden vs Vaultwarden

The short answer

• Vaultwarden is "an unofficial, community-driven Bitwarden-compatible server", written in Rust, free under AGPL-3.0, and works with the official Bitwarden apps.
• Bitwarden (cloud or official self-hosted) is the supported product, with every feature, audits and certifications, and support.
• Vaultwarden suits personal and small self-hosted setups; companies usually want the official server. For outside handoffs, add CredenShare to either.

Who this page is for: self-hosters deciding between Vaultwarden and Bitwarden.

Bitwarden vs Vaultwarden at a glance

Checked on October 23, 2026 against each vendor's own pages; see the sources below.

What is Vaultwarden?

Vaultwarden is an "alternative server implementation of the Bitwarden Client API", formerly called bitwarden_rs. It's "not associated with, endorsed by, or affiliated with Bitwarden, Inc.", and its README says: "We cannot be held liable for any data loss". Because it speaks the same API, the official Bitwarden apps and extensions work with it.

What does Vaultwarden support, and what does it lack?

Supported: the personal vault, Send, attachments, organizations (collections, groups, event logs, policies, directory connector), emergency access, an admin backend, two-factor (TOTP, email, WebAuthn, YubiKey, Duo), and SSO via OpenID Connect (still with a master password).

Missing: the full public and organization API, "Login with Passkeys", "New Device Login Protection", custom roles, and the policies "Require single sign-on authentication", "Vault timeout" and "Remove individual vault export".

Is Vaultwarden secure?

Encryption happens in the official Bitwarden clients either way, so your vault data reaches the server encrypted. The server itself differs: Vaultwarden lists a BSI audit of version 1.30.3 and a partial ERNW penetration test; Bitwarden runs annual audits and holds SOC 2 Type II and ISO 27001. You're also responsible for patching and backing up your Vaultwarden server.

Which should a company use?

A company usually wants the official server: support, certifications, and every policy, including requiring SSO and vault timeouts. Note that Bitwarden's pages say only Families and Enterprise organizations can be imported to self-hosted servers.

Which should you pick? Scenarios

What neither Bitwarden nor Vaultwarden does

Both are built around your vault. How each reaches people outside it:

• Bitwarden: Bitwarden Send, text or files, up to 31 days.
• Vaultwarden: Send, through the same Bitwarden apps.

At the edge of the vault, three needs keep coming up that neither covers on its own pages:

1. Collecting a credential from someone outside. A client's hosting login or a vendor's API key: there's no request form, so it usually arrives by email or chat.
2. Proof that an outside handoff arrived. Their logs track your organization; a per-link record of who opened a share, when and from where, isn't described.
3. Handoffs on the recipient's schedule. Links that last longer, or start counting at the first open.

CredenShare is built for that edge, and works with either:

• Secure Requests (Business and Enterprise): send a form with the fields you need; each answer is encrypted in the sender's browser.
• Access logs for every share: views, times and IP addresses, kept 3 to 180 days by plan.
• Expiry from 1 hour to 3 months, optionally from the first open, plus passcodes and view limits.
• Slack, a browser extension, a REST API, SDKs and an MCP server for AI agents.

Shares made in the web app, API and SDKs are encrypted in your browser or client; Slack-created shares are encrypted on our servers. Only the people who create shares and requests need a CredenShare seat.

Before you share a credential: a checklist

These apply whichever tool you use.

1. Send the link and the passcode through different channels. For example, the link by email and the passcode by text message.
2. Watch out for link scanners. Some email security filters and chat apps open links automatically, which can use up a one-view link. Send the link as plain text through a channel that doesn't pre-open links, or allow a second view with a short expiry.
3. Don't open the link to test it. On a one-view link, your test is the view.
4. Pick the shortest expiry that works. If you don't know when the recipient will act, a link that starts counting at the first open is safer than a long fixed window.
5. Rotate after the handoff when you can. The link expires, but the credential is still valid.
6. Keep the original in your password manager. A sharing link is a delivery method, not storage.

Verdict: Bitwarden or Vaultwarden?

• Pick Bitwarden for supported, certified, complete self-hosting or cloud.
• Pick Vaultwarden for a free, lightweight server for personal or family use.

Whichever you choose, cover the outside handoffs neither is built for.

Related: Bitwarden vs KeePass · CredenShare vs Bitwarden · All comparisons

Sources (checked October 23, 2026):

• Bitwarden: pricing, security white paper, KDF, compliance, self-hosting, SSO, Send
• Vaultwarden: README, wiki, audits, SSO

Bitwarden, Vaultwarden are trademarks of their respective owners. CredenShare is not affiliated with any of them.