Set Up Your Password Vault

Set Up Your Password Vault

Of all the apps in this playbook, Vaultwarden may be the most important.

Your passwords are the keys to your entire digital life — your bank, your email, your healthcare records, your social accounts. Right now, if you use a password manager, those keys are stored on someone else’s server. If you don’t use a password manager, you’re probably reusing passwords — which is the most common cause of account compromises.

Vaultwarden is a self-hosted implementation of the Bitwarden protocol. That means it works with all official Bitwarden apps — browser extensions, iOS, Android, desktop — but stores your encrypted passwords on your server, not Bitwarden’s cloud.

The encryption is end-to-end. Your passwords are encrypted on your device before being sent to your server. Even if someone gained access to your server, they couldn’t read your passwords without your master password.

A Note on Access

Unlike the other apps in this playbook, your password vault needs to be accessible even when you’re away from home — otherwise you can’t autofill passwords on your phone when you’re out.

For this weekend, we’ll set it up for local access only. The What’s Next chapter covers secure remote access options. If you want Vaultwarden working outside your home network before then, you’ll need to set up either a VPN or a reverse proxy with a real domain and HTTPS. We’ll get there.

Install Vaultwarden

cd ~/docker/vaultwarden
nano docker-compose.yml

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    volumes:
      - vaultwarden_data:/data
    environment:
      - DOMAIN=http://vault.home
      - SIGNUPS_ALLOWED=true   # set to false after creating your accounts
      - TZ=America/Phoenix   # ← change to your timezone
    networks:
      - proxy
    restart: unless-stopped

volumes:
  vaultwarden_data:

networks:
  proxy:
    external: true

Start Vaultwarden:

docker compose up -d

Open your browser and go to http://vault.home.

Create Your Account

Click “Create account” and register with your email address and a strong master password.

Your master password is the only password you need to remember. It cannot be recovered if lost. Choose something long, memorable, and unique — a passphrase of four or five random words works well. Write it down and store it somewhere physically secure, like a safe or locked drawer.

After creating your account, immediately go back to your docker-compose.yml and change SIGNUPS_ALLOWED=true to SIGNUPS_ALLOWED=false. This prevents anyone else from creating accounts on your vault. Restart the container:

docker compose restart vaultwarden

To create accounts for family members, you’ll temporarily re-enable signups, have them create their account, then disable again. Or use the admin panel — see below.

Install the Browser Extension

Go to the Bitwarden website (bitwarden.com) and install the browser extension for Chrome, Firefox, Safari, or Edge — whichever browser you use. The official Bitwarden extension works with Vaultwarden.

After installing, click the extension icon and select “Self-hosted” when prompted for server URL. Enter http://vault.home.

Log in with your Vaultwarden credentials. The extension will now autofill passwords on websites automatically — just like 1Password or LastPass.

Install the Mobile App

Download the official Bitwarden app from the App Store or Google Play (free).

Open the app, tap the region selector at the top of the login screen, and choose “Self-hosted.” Enter http://vault.home as your server URL.

Log in with your credentials. Your vault is now available on your phone.

Import Your Existing Passwords

If you’re coming from LastPass, 1Password, Dashlane, or another password manager, you can import all your existing passwords directly into Vaultwarden.

In the Vaultwarden web interface, go to Tools → Import data. Select your old password manager from the dropdown, export your passwords from that service (each has an export feature in their settings), and upload the file.

Your passwords will import within seconds.

If your passwords are currently saved only in your browser (Chrome or Safari), you can export them from the browser’s password settings and import in the same way.

Enable the Admin Panel

Vaultwarden has a built-in admin panel for managing users and settings. To enable it, add an admin token to your environment:

# Generate a secure token
openssl rand -base64 48

Copy the output. Edit your docker-compose.yml and add this to the environment section:

- ADMIN_TOKEN=paste_your_generated_token_here

Restart Vaultwarden:

docker compose restart vaultwarden

Access the admin panel at http://vault.home/admin — use your token as the password. From here you can invite users, manage organizations, and configure server settings.

Two-Factor Authentication

Enable two-factor authentication on your Vaultwarden account immediately after setup. Go to Account Settings → Security → Two-step login and enable TOTP (authenticator app).

Use any TOTP app — Aegis (Android), Raivo (iOS), or even Vaultwarden itself once you’ve stored the secret.

This means even if someone knows your master password, they still can’t access your vault without the second factor.

Next: Set Up Your Document Archive →