Open Source LastPass Alternative You Can Self-Host at Home
Run Vaultwarden if you are leaving LastPass for open source at home, since it needs about 100MB of RAM where the official Bitwarden server recommends 2GB or more. Hosting it on a Raspberry Pi gives a household TOTP codes, emergency access, organizations and file attachments at no cost.
Passebo's own comparison data, last checked in October 2026, prices Enpass at £0.97 a month on its 12-month plan.
Vaultwarden works with Bitwarden's apps
Vaultwarden, once named bitwarden_rs, is an unofficial Rust implementation that your official Bitwarden phone, desktop and browser apps connect to unchanged.
Vaultwarden uses Bitwarden's AES-256 encryption. Your device derives the key, so the server holds only ciphertext and your master password never crosses the network in plain text.
Premium features in Vaultwarden cost nothing
A Yahoo Tech comparison lists Bitwarden's individual plan at $20 a year and its family plan at $50 a year for up to six people. Bitwarden's own self-hosted server still asks for a premium member license before Premium features work, plus an enterprise license for an organization that shares.
Vaultwarden, by contrast, brings an authenticator for TOTP codes, attachments, a trusted contact for emergencies, shared organizations, Bitwarden Send and health reports on your vault for free. Its admin panel and two-factor sign-in with a hardware security key need no subscription either.
Bitwarden's official server suits a business
Bitwarden built its official server on .NET, with several services running at once in an enterprise-grade design. Bitwarden publishes its code under GPLv3, which lets you change it as long as your changes go out under GPLv3 too. Its containers are built from source and published on GitHub Container Registry.
Installs are supported on Windows, Linux, Docker and Kubernetes. Bitwarden supplies Bash and PowerShell scripts to speed up deployment. Before you start, you fetch an installation ID and key from bitwarden.com/host. An air-gapped Linux server gets its own offline deployment. Every Bitwarden client works with it, from the mobile and desktop apps to the browser extensions.
Without an SSL certificate you cannot create an account or use several features. An SMTP server has to be set in the global.override.env file under ~/bitwarden/env/. Each deployment except the unified one comes with an MSSQL Express image by default. Unified deployment packs everything into one Docker container for personal users and home labs, though it is still in beta.
Self-hosting comes free with Bitwarden's Enterprise plan. Bitwarden also says it is audited by third parties and complies with SOC 2, GDPR, CCPA and HIPAA.
Locking down a self-hosted vault
Vaultwarden's SIGNUPS_ALLOWED setting starts as true for the first account and goes to false once the admin account exists. Its ADMIN_TOKEN can be stored as an Argon2id hash made with the server image's own hash command. One Yahoo Tech writer also enforces 2FA and adds Fail2Ban after that first account. Their backup plan is a nightly cron job that archives the ./data folder to a second machine or an external drive, with a restore tested beforehand.
MakeUseOf describes three routes to a home vault: your local network, a VPN through Tailscale, or the open internet. Exposing the vault to the open internet is riskiest. Only that route needs a domain name, because valid HTTPS depends on one there. Bitwarden clients refuse plain HTTP, so every route needs an HTTPS address. Tailscale gives you a free HTTPS subdomain, though it has to stay running for your devices to sync. The MakeUseOf setup puts Caddy in front as a reverse proxy because it handles TLS certificates by itself.
KeePassXC keeps one offline file
KeePassXC saves your vault as an encrypted file on your own machine and keeps nothing on remote servers. It is free under GPLv3, with its source on GitHub. France's National Cybersecurity Agency, ANSSI, gave version 2.7.9 a security Visa after it passed the CSPN first-level certification.
KeePassXC runs on Windows, macOS and Linux. Its databases use KDBX and open in KeePass as KDBX4 or KDBX3. Twofish and ChaCha20 sit alongside the default cipher. A YubiKey or OnlyKey can answer a challenge-response. Browser integration covers Chrome, Firefox, Edge, Chromium, Vivaldi, Brave and Tor Browser. Imports come from CSV, 1Password, Bitwarden, Proton Pass and KeePass1. Its reports flag weak passwords, run Have I Been Pwned checks and show statistics. Anyone happy in a terminal gets keepassxc-cli as well. Since nothing sits on a remote server, getting that one file onto each machine you use falls to you.
Enpass, a paid route without a server
A year of Enpass on that plan costs £11.64. Passebo rates Enpass 3.8 stars and gives it 9 out of 10 for security. It has disclosed no breaches in the last five years. Its apps are closed source.
Vaultwarden for families, KeePassXC for one laptop
Families who want shared vaults on cheap hardware should run Vaultwarden, because sharing and emergency access come with it free, unofficial as it is. Choose KeePassXC if you work alone on Windows, macOS or Linux and would rather keep one encrypted file than run a server, with the ANSSI certification behind it. Businesses that answer to auditors should run Bitwarden's official server and budget the RAM for it. Choose Enpass if you would rather pay for an app than run a server, accepting that its apps are closed source.
