Vaultwarden

Every password your company has, on a server someone else runs?

Password managers hold the keys to everything else, which makes the choice of where that vault lives a security decision, not a procurement detail. 1Password and LastPass charge per user per month to hold your credentials in their cloud, and LastPass has shown what a breach of a hosted vault service looks like. Vaultwarden is the open source alternative: a lightweight server compatible with the official Bitwarden apps, self-hosted so your encrypted vaults stay on UK infrastructure you control. Node runs it for you as a managed service.

What Vaultwarden is

Vaultwarden is an open source implementation of the Bitwarden server, written in Rust and light enough to serve a whole company from modest hardware. Because it implements the Bitwarden APIs, your staff use the official Bitwarden clients they may already know: browser extensions with autofill, desktop apps, and mobile apps with biometric unlock, all simply pointed at your own server instead of Bitwarden's cloud.

The security model is end-to-end encryption. Vaults are encrypted and decrypted on the user's device with keys derived from their master password, so the server only ever stores ciphertext. Neither Node nor anyone with access to the infrastructure can read a single credential.

For teams, Vaultwarden supports Bitwarden's organisation model: shared collections with per-team access, so the marketing logins, the finance credentials and the infrastructure secrets each reach exactly the people who should have them. It also supports two-factor authentication, TOTP storage and secure sharing, covering what most organisations buy a commercial password manager for.

Why self-hosted Vaultwarden instead of 1Password or LastPass

No per-user pricing: commercial password managers charge per user per month, at the time of writing typically several pounds per seat for business tiers, so protecting more staff costs more every month, forever. Vaultwarden managed by Node is a flat cost across the whole organisation.

Your vault server, not a shared target: hosted password services concentrate millions of companies' vaults behind one vendor's perimeter, which is precisely why they attract sophisticated attacks. A self-hosted Vaultwarden instance is yours alone: a dramatically smaller and quieter target.

UK data residency: encrypted vault data stays on UK infrastructure with an Article 28 data processing agreement in place, a clean answer for security questionnaires and regulated environments.

The clients people already know: because Vaultwarden works with the official Bitwarden apps and browser extensions, staff get first-class autofill and mobile access with nothing unfamiliar to learn, and adoption is the easy part.

No lock-in: vaults export in standard Bitwarden formats, and the server is open source. If circumstances change you can move to another Bitwarden-compatible setup without ransoming your own credentials.

Password management your staff will actually use

Security tools fail when people route around them, and password managers live or die on convenience. The Bitwarden extensions autofill credentials in the browser, generate strong unique passwords at signup, and sync across desktop and mobile, so the secure path is also the easy path. Shared collections end the spreadsheet of team logins, admins can enforce two-factor authentication, and when someone leaves, their access to shared credentials is revoked in one action rather than a frantic audit of what they knew.

Keycloak and single sign-on

Every application in a Node tenant joins your organisation's own Keycloak realm on our platform, so admin and tenant access is governed by your corporate identity, with MFA and central revocation. Staff vaults themselves are unlocked in the standard Bitwarden apps with each user's master password, which is what keeps the encryption genuinely end-to-end. Vaultwarden sits naturally alongside the rest of our security and identity services.

How Node runs Vaultwarden for you

Deployment: we deploy Vaultwarden in a hardened production configuration with TLS, your domain, admin controls and organisation structure set up, ready for staff to connect their Bitwarden apps.

Upgrades and maintenance: we track Vaultwarden and Bitwarden client compatibility, test and apply server upgrades, and keep the instance patched without interrupting access to vaults.

Monitoring and support: we monitor availability and take encrypted backups of the vault database on a schedule, because a password manager that is down locks your business out of everything else. Our UK team supports your administrators.

Your infrastructure or ours: hosted on Node's UK infrastructure or deployed into your own environment, on-premises or in your cloud accounts, with the same managed service either way.