Vaultwarden-Plus

A community-maintained downstream fork of Vaultwarden for self-hosted operators who need additional mail, recovery, passkey, and client-compatibility features while staying compatible with official Bitwarden clients.

---

Important

Report Vaultwarden-Plus bugs or feature requests in the Vaultwarden-Plus issue tracker. Do not use official Bitwarden support for Plus-specific behavior, and do not report Plus-only issues to upstream Vaultwarden.

Overview

Vaultwarden-Plus keeps the Vaultwarden deployment model: one lightweight server, a bundled Web Vault, official Bitwarden clients, and operator-controlled storage. It adds carefully scoped downstream features for homelab and self-hosted environments, with release gates for security-sensitive auth, mail, passkey, and recovery behavior.

The current stable line is v1.36.11, bundling Web Vault 2026.6.4 with validated Plus compatibility layers.

Features

Bitwarden-compatible features

These features originate from Bitwarden product behavior and should be read together with the official Bitwarden Help Center. Vaultwarden-Plus support depends on the local implementation status documented under docs/.

Feature	Bitwarden documentation	Vaultwarden-Plus status
Personal vault and items	Vault Items	Inherited from Vaultwarden
Organizations	Organizations Quick Start	Inherited plus recovery-specific work
Collections and sharing	Share Items	Inherited from Vaultwarden
Send	About Send	Inherited plus Send Email Verification extension
Emergency Access	Emergency Access	Inherited from Vaultwarden where supported
Account Recovery	About Account Recovery, Recover a Member Account, Account Recovery Enrollment	Implemented for Web Vault 2026.6.4, including admin recovery, selective 2FA reset, and forced password reset
Device Login	Log In with Device	Native Web Vault flow with atomic single-use AuthRequest token redemption
Authentication Requests	Log In with Device	Durable official-client flow plus Plus lifecycle hardening
Trusted Devices	About Trusted Devices, Add a Trusted Device	Server-side hardening and preview flows documented
Passwordless sign-in	Log In with Device, Log In and Unlock with Passkeys	Experimental passkey login support
Passkey Login	Log In and Unlock with Passkeys	Experimental Plus implementation; see project docs for limits
Two-Step Login	Two-Step Login Methods and Passkey Two-Step Login	Inherited from Vaultwarden plus recovery reset support
New-device verification	New Device Login Protection	Client compatibility tracked
Secrets Manager	Secrets Manager Overview	Not a current Vaultwarden-Plus runtime feature

Vaultwarden-Plus extensions

These are downstream extensions. Use the project documentation, not Bitwarden support, for operating them:

• Organization Account Recovery: admin recovery, enrollment-dependent Web Vault menus, forced PUT /accounts/update-temp-password, legacy and V2 payload compatibility, and 2FA-only recovery support. See features, limitations, and the v1.36.9 release notes.
• Send Email Verification: recipient email OTP verification for protected Sends. See features.
• DKIM signing: outbound mail signing for better deliverability. See features.
• AWS SES mail transport: SES-backed outbound mail option. See features.
• Mail Preview and Authentication Request Preview: operator-facing preview flows for mail/auth-request behavior. See features.
• Passkey Login extensions: experimental server support, official-client origin handling, and PRF compatibility work. See Passkey operator guide, MVP validation, and future track.
• Mail Dispatch Hardening: detached non-critical account notifications while critical OTP/security mail remains fail-closed. See Mail Dispatch Hardening.
• Operator and CI improvements: image build cache durability, release validation, and publish-surface governance. See Maintainer Guide.

Installation

Important

The Web Vault requires HTTPS and a secure browser context for the Web Crypto API. Terminate TLS at a reverse proxy such as Traefik, Nginx, HAProxy, or Caddy and run the container over HTTP behind that proxy.

Note

Vaultwarden-Plus does not recommend Rocket's built-in TLS for production. See the security baseline and the upstream Vaultwarden proxy examples.

Docker images

Stable images are published to the Forgejo package registry:

forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.3
forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

Release image exports and checksums are attached to Forgejo releases. Operators may use the registry image, load a release artifact, or build locally from this repository.

Docker / Podman

docker run --detach --name vaultwarden \
  --env DOMAIN="https://vw.domain.tld" \
  --volume /vw-data/:/data/ \
  --restart unless-stopped \
  --publish 127.0.0.1:8000:80 \
  forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.3

Docker Compose

services:
  vaultwarden:
    image: forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.3
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vw.domain.tld"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 127.0.0.1:8000:80

For general Vaultwarden configuration patterns, use the upstream Vaultwarden Wiki and replace image names with Vaultwarden-Plus images where needed.

Documentation

The repository has one canonical documentation structure:

• Changelog: release history.
• Documentation index: full project documentation map.
• Project state: current release posture and governance summary.
• Product overview: product scope and support boundaries.
• Feature matrix: upstream parity and Plus-specific feature status.
• Features: implemented feature details.
• Known limitations: current support boundaries and watch items.
• Roadmap: planned and deferred work.
• Maintainer guide: release and validation rules.
• Security baseline: security model and release gates.
• Forgejo Wiki strategy: assessment for future administrator guide publication.

Root-level product-document duplicates are intentionally avoided. Product documentation belongs under docs/; the repository root contains only entry documents such as this README, the changelog, license, security disclosure policy, and governance files.

Releases

Current release: v1.36.11

• Release notes: docs/releases/2026-07-v1.36.11/RELEASE_NOTES.md
• Forgejo releases: vaultwarden-plus releases
• Container registry image: forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.11

Contributing

Contributions are welcome through Forgejo pull requests. Before proposing behavior changes, read the Maintainer Guide, Security Baseline, and Known Limitations.

Use the Vaultwarden-Plus issue tracker for Plus-specific bugs. If a bug reproduces on unmodified upstream Vaultwarden, report it to upstream Vaultwarden.

For general Vaultwarden questions, the upstream community remains the best place to ask: Matrix, GitHub Discussions, and the Discourse forums.

Credits

Vaultwarden-Plus exists because of the upstream Vaultwarden project by @dani-garcia and its contributors.

License

Vaultwarden-Plus is licensed under the AGPL-3.0, the same license as upstream Vaultwarden. See LICENSE.txt.

Disclaimer

Vaultwarden-Plus is not associated with Bitwarden or Bitwarden, Inc., and it is not an official Vaultwarden release. It is an independent, community-maintained fork.

Caution

We cannot be held liable for data loss while using Vaultwarden-Plus. Back up files and databases regularly.