Why I Self-Hosted My Password Manager and Immediately Regretted It (And What I Did Instead)

I have been self-hosting services for about a decade. I run my own email, my own file sync, my own git server, my own calendar. The pitch for self-hosting is familiar: control over your data, no monthly fees, no vendor lock-in. For most of the services I run, the trade-offs favor self-hosting. I pay $5 a month for a VPS, and I get the same functionality as a $100/month SaaS subscription.

Password management was the one category where the trade-offs did not favor self-hosting. I tried it for three months, and I have strong feelings about the experience. I tried Vaultwarden (a community-built server for the Bitwarden password manager), I tried KeePassXC with a synced file, and I tried Passbolt (a self-hosted team password manager). All three had the same fundamental problem: the cost of a mistake is too high, and self-hosting introduces too many ways to make a mistake.

This is the article I wish I had read before I started. I am going to walk through the experience, the trade-offs, and the decision I made. If you are thinking about self-hosting your password manager, read this first.

The pitch that sold me

The pitch for self-hosting your password manager is the same pitch that sold me on self-hosting email, calendar, and file sync: you own your data, you control the keys, and you do not depend on a company to keep the service running. For email, this pitch is true. For files, it is true. For passwords, the math is different.

The reason is asymmetry. If your email server goes down, you lose access to email until you fix it. Annoying, but recoverable. If your file sync goes down, you lose access to your synced files. Annoying, but recoverable. If your password manager goes down, you lose access to every account that requires a password. That is not recoverable in the same way. You are locked out of your bank, your email (which is the recovery mechanism for most other accounts), your cloud storage, and your social media. Cost of a password manager outage is the cost of being locked out of your digital life.

Asymmetry is not theoretical. It happened to me.

What I tried and what happened

I started with Vaultwarden, the community-built server for the Bitwarden client. Setup was a single Docker container, a Postgres database, and a reverse proxy with HTTPS. The whole thing took me about 30 minutes to get running, and the Bitwarden clients (mobile, desktop, browser extension) connected immediately. I migrated my password database from 1Password using the import tool, and within an hour, I was using my self-hosted Vaultwarden as my primary password manager.

For the first month, it worked perfectly. I added new passwords, generated new accounts, used the autofill, and the experience was identical to 1Password. I was happy. I told my partner I had found the right solution, and I started to plan the migration of her accounts.

Then I did a routine maintenance task: I upgraded the Vaultwarden container to the latest version. Upgrade was a one-line command. The container restarted. Clients lost connection. I checked the logs. There was a database migration that had failed silently. The Vaultwarden container was running, but the database was in a broken state, and the clients were getting authentication errors. The key warning signs were:

• Container status said “running” but clients got authentication errors
• Database logs showed a migration that had been interrupted
• A 12-hour-old backup was the most recent good state
• The new accounts added in that window needed manual password resets

I spent the next four hours debugging. I rolled back the container, but the database was already in the broken state. I restored the database from a backup, but the backup was 12 hours old, and I had added four new accounts in that window. I had to manually reset the passwords for those four accounts, which meant logging into each service, generating a new password, and saving the new password in the new database.

I survived. But the asymmetry I had dismissed became real. Cost of a four-hour outage was not just the time to fix the system. The cost was the cognitive load of wondering, every time I did maintenance, whether this was the time the upgrade would fail and I would lose access to my accounts.

The other self-hosted options had the same problem. KeePassXC with a synced file required me to keep the file in sync across devices, and the sync was the failure point (a network blip, a Dropbox conflict, a missed sync). Passbolt had a more polished interface, but the server still needed to be running for the clients to work, and the server still had to be upgraded, and the upgrades still had breaking changes.

Why the asymmetry breaks the trade-off

The trade-off for self-hosting email is: I get control and I avoid the monthly fee, in exchange for spending some time on maintenance. Cost of an email outage is bounded: I lose access to email, but I can still log into the services I need, and I can read the emails later. Asymmetry is small.

The trade-off for self-hosting a password manager is: I get control and I avoid the monthly fee, in exchange for spending time on maintenance. Cost of a password manager outage is unbounded: I lose access to everything, and the recovery is manual and painful. Asymmetry is large.

For a service where the asymmetry is small, self-hosting is a good trade. For a service where the asymmetry is large, self-hosting is a bad trade. The asymmetry is a function of how much depends on the service. Email is critical, but most services have a fallback. Files are critical, but most files have another copy somewhere. Passwords are critical, and there is no fallback. Losing your password manager is losing the keys to everything.

The other issue is the security model. A commercial password manager invests heavily in security: end-to-end encryption, zero-knowledge architecture (a design where the company cannot read your data even if they wanted to), independent security audits, bug bounty programs, and a team that responds to vulnerabilities in hours. A self-hosted password manager inherits the security of the underlying software, but the operational security (the part where the server is configured correctly, the database is encrypted at rest, the backups are secure, the upgrade path is clean) is the user’s responsibility.

A user with strong operational security can match the commercial offerings. A user without it is at greater risk. Asymmetry of risk (the downside of a security failure is much larger than the upside of a successful self-hosting setup) means that the trade-off favors the commercial option for most users.

What I did instead

I went back to a commercial password manager. I chose 1Password because I had used it before and the family plan covers my partner and me for $60 a year. Cost is real, but the cost is bounded: $60 a year is less than the value of my time, and the value of not having to debug a Vaultwarden upgrade on a Saturday afternoon is hard to quantify.

The other thing I did was audit my other self-hosted services for the same asymmetry. The audit found two more services with the same problem: my self-hosted git server and my self-hosted VPN. I had been treating both as low-risk, but the git server outage would lock me out of my code, and the VPN outage would lock me out of my home network. I migrated both to commercial options (GitHub for code, Tailscale for VPN) and the time savings have been significant.

Services I still self-host are the ones where the asymmetry is small. I still self-host my email, because the cost of an email outage is bounded and the cost of a commercial email service is high. I still self-host my file sync, because the cost of a file sync outage is bounded and I have other copies. I still self-host my photo library, because the cost of a photo library outage is bounded (I can still use the camera) and the cost of a commercial photo service is high.

The honest summary

The self-hosting pitch is real, but it is not universal. The pitch is strongest for services where the asymmetry is small and the cost of the commercial alternative is high. The pitch is weakest for services where the asymmetry is large and the cost of a mistake is unbounded. Password management is in the second category.

If you are considering self-hosting your password manager, my advice is this: do not. Cost of the commercial option is real, but the cost of a self-hosted outage is much higher. The time you save on the monthly fee is less than the time you will spend on maintenance, and the time you spend on maintenance will be the kind of time you do not have (a Saturday afternoon, a workday, a holiday).

Self-host the services where the math works. Use a commercial password manager for the service where the math does not. The split is not a defeat. It is the right design.