Bitwarden
Credentials, TOTP codes and secure notes in an end-to-end encrypted vault you can host yourself.
Mac App Store Homebrew cask Homebrew formula Direct download
What it does
Bitwarden stores passwords, passkeys, TOTP secrets, cards, identities and notes in a vault encrypted client-side — the server never sees plaintext or the master password. Clients exist for every platform, with browser extensions and CLI included.
For a homelab the significant part is that the server is open source and self-hostable: the official server, or Vaultwarden, a lightweight Rust reimplementation that runs comfortably in a container on a Raspberry Pi. Self-hosting means the vault’s availability is your problem — and so is its backup.
Notes
- The Mac app supports unlocking with Touch ID and autofill through the system Passwords integration.
bw(the CLI, available viabrew install bitwarden-cli) makes secrets scriptable, including in CI.- Whatever else changes, the master password and the two-factor method are the whole security model. An offline copy of the recovery code matters more than any other setting.
Alternative to
| Alternative | Type | Trade-off |
|---|---|---|
| 1Password | Freemium | The most polished of the group on Apple platforms |
| Passwords and Keychain Access | Built in | Already there, syncs through iCloud, and never leaves Apple’s platforms |
| KeePassXC | Open source | A local database file, no sync service at all |
| Proton Pass | Freemium | Audited, bundled with Proton’s other services |
| pass | Open source | GPG files in a Git repository, for people who want exactly that |
| Vaultwarden | Open source | A lightweight self-hosted server for these same clients |