Vaultwarden

Overview

Vaultwarden is a lightweight Rust server that speaks the Bitwarden client API, so the official Bitwarden apps (browser extensions, desktop, mobile, and the CLI) sync against your malmo instead of Bitwarden's cloud. It holds your logins, secure notes, cards, identities, TOTP codes, passkeys, and file attachments in an end-to-end encrypted vault that only your master password unlocks; the server only ever stores ciphertext it cannot read.

Features

• End-to-end encrypted vault for logins, secure notes, cards, identities, TOTP codes, passkeys, and file attachments
• Syncs with the official Bitwarden browser extensions, desktop, mobile, and CLI apps
• TOTP and email two-factor authentication, plus passkey (WebAuthn) sign-in where supported
• Runs on a small SQLite database stored with the app, so there is no separate database to set up

Setting up

Open the web vault on first visit and create your account; no default login is seeded. Then point your Bitwarden apps at this server's address to sync. New-account signups stay open after that so you can add your household; close them once everyone's in from the admin page:

• Admin token: shown on this app's page in malmo

Good to know

Email features (email two-factor authentication, new-device alerts, password hints, and invitations) are currently off: malmo's outgoing-mail settings don't yet line up with the values Vaultwarden expects. TOTP two-factor and the core vault are unaffected. Passkey (WebAuthn) sign-in and second-factor need a secure browser connection, so they work on the hosted address but not the appliance's local address; use TOTP there instead. The vault also reaches the internet to fetch website icons and run breach checks; storing, syncing, and unlocking your vault all work fully offline.