How to set up Vaultwarden on Saplo (password manager for teams)

A paid Bitwarden team account costs per person per month, growing with each new employee. With a dozen people, the annual bill can exceed the cost of an entire Box, which could host the rest of your company's infrastructure. Vaultwarden is an open-source implementation of the Bitwarden server, compatible with the same official applications (browser, desktop, phone), but hosted on your own Box. Zero user fees, and your password data stays with you. Below is a step-by-step guide on how to set up Vaultwarden on Saplo, how to connect your team, and how to back up your encrypted password database.

Why Vaultwarden instead of paid Bitwarden

Bitwarden as a SaaS product is good, but the team plan costs money for each account every month, and your company's passwords are on someone else's servers, outside your control. Vaultwarden is an independent implementation of the same API protocol, written in Rust, which official Bitwarden clients support without any modification. You just need to change the server address to your own domain in the client settings. The difference in practice:

• No per-user fees - add any number of team accounts without a rising monthly bill.
• Data on your Box - the password database (encrypted end-to-end on the client side, just like in the original Bitwarden) never leaves your infrastructure.
• The same applications - browser, desktop, phone, all official Bitwarden clients work without changes. You only change the server address.
• The source code is public - it's an open-source project developed publicly on GitHub, so if needed, you can check exactly how authentication and encrypted data storage work, instead of taking a closed SaaS's word for it.

Requirements

To set up Vaultwarden on Saplo, you need:

• A Box with Docker running (the engine automatically enables it during installation from the catalog, container nesting is required, which Saplo has by default),
• A minimum of 256 MB of free RAM on the Box, the smallest Box S plan is sufficient, this plan costs $29 per year,
• A domain or subdomain *.saploapp.pl included in the price of each plan, where the login panel will be located.

Vaultwarden, unlike many other applications from the App catalog, does not require a separate database. It keeps its own SQLite database in the container's data volume, so installation is faster and lighter than with applications using shared MySQL or dedicated Postgres.

Step-by-step installation

1. In the Saplo panel, go to the App catalog and select Vaultwarden (under "Business" category).
2. Specify the Box plan on which it'll run, and the domain or subdomain where the panel will be available.
3. Confirm the installation. The engine deploys a Docker container with the official vaultwarden/server image, prepares a volume for the SQLite database, and exposes it under the specified domain via nginx with a free SSL certificate.
4. After a few dozen seconds, the domain will display the Vaultwarden login page. New account registration is enabled by default, so you can create your first account directly on the page without additional configuration.
5. The admin panel at /admin is disabled by default (no admin token set), which is a secure initial state before you configure your own access.

Connect Bitwarden clients

Vaultwarden speaks the same API protocol as Bitwarden, so any official client will work without any modification:

1. In the Bitwarden app (browser, desktop, or phone), go to settings and find the Self-hosted environment / Server address field.
2. Enter the address of your installation on Saplo, e.g., https://vault.yourdomain.com.
3. Log in with the account you created in step 4 of the installation above.

From this moment on, password synchronization, password generator, and autofill work exactly as in the original Bitwarden, except your Box stores the data, not Bitwarden's servers.

Organizations and sharing passwords within a team

Each person logging into a shared server is not yet password sharing. Organizations are used for this, just like in Bitwarden's paid team plan:

1. In the Bitwarden client connected to your installation, go to New organization and create a company organization (e.g., "Team").
2. Invite other people by the email address they used to create an account in the "Adding a team" step above.
3. Create collections, which are thematic password groups, e.g., "Hosting", "Social media", "Invoices", and assign access to them only for selected people or groups.
4. Move existing personal passwords to the organization using the Move to organization button so that the team can see them immediately, instead of sending them by email or messenger.

Thanks to collections, each person sees only the passwords they actually have access to, not the entire company database, which is important when employees rotate or when collaborating with external contractors. If, after adding the team, you want to close registration to outsiders, it is worth disabling the SIGNUPS_ALLOWED variable on the container side or restricting access to a specific company email domain, but this is already manual configuration in the container's environment variables, beyond the scope of the installation wizard itself.

Backup and security

Backups depend on your chosen plan: Box L and higher include backups in the price (7 days back for L, 14 days for XL, 30 days plus offsite backup for XXL), while daily backup can be purchased as an add-on for Box S and M. For Vaultwarden, the backup includes the entire container data volume, i.e., the SQLite database file with encrypted content of all passwords, so it's worth enabling it before the database grows to a size whose loss would genuinely impact your entire company. The Saplo panel shows the SSL certificate status and renews it automatically, and access to the administrative panel at /admin should only be enabled once you have set a strong, random administrator token in the container's environment variables, as this panel allows you to manage all accounts on the installation.

Migrating from Bitwarden, LastPass, or 1Password

Moving an existing password database to your own Vaultwarden installation doesn't require manually retyping each password separately:

• From Bitwarden, you export the database in .json format (encrypted or plaintext) from Account settings -> Export vault, then import the same file into a client already connected to your Vaultwarden installation, via Tools -> Import data.
• From LastPass, you export passwords to a CSV file from the browser panel, and Vaultwarden has a ready-made import format "LastPass (csv)" in the same Import data window.
• From 1Password, you export data in 1PUX format from the desktop application, which Vaultwarden also recognizes as a ready-made import format.

After importing, it's worth reviewing the list immediately for duplicates and passwords flagged by Vaultwarden's built-in security audit (Tools -> Vault health reports) as weak or reused across multiple sites, before you grant access to the entire team.

Paid Bitwarden vs. Vaultwarden on Saplo

FAQ

Is Vaultwarden as secure as the paid Bitwarden? Vaultwarden uses the same client-side end-to-end encryption mechanism as the original Bitwarden, so passwords are encrypted before they leave the device. The difference lies in who hosts the encrypted database, not in the encryption itself.

Can I import passwords from an existing Bitwarden, LastPass, or 1Password account? Yes, all three have ready-made import formats in Vaultwarden, described in the migration section above, so moving the entire database takes only a few minutes.

How many people can Box S support? Vaultwarden is very lightweight; the container itself uses less than 100 MB of RAM, so Box S is sufficient for most small and medium teams. For a larger number of people, you can add RAM to your Box as needed, without moving data.

What if I forget my master password? Just like in the original Bitwarden, the master password is not known to the server (end-to-end encryption), so Vaultwarden cannot recover it. It's a good idea to set up a password hint when creating an account and keep a backup export of your database in a secure location.

Can I disable new account registration after adding my team? Yes, you set the environment variable SIGNUPS_ALLOWED to false on the container side, after which you can only create new accounts manually from the admin panel at /admin.

Can all team members see passwords within the organization? No, access depends on collections: each person only sees the password collections they have been assigned to, so you can separate, for example, hosting passwords from accounting passwords.

Passwords are one layer; access to company services is another. If you want panels and servers to be accessible only from your team's private network, see how to set up Headscale on Saplo, your own coordinating server for Tailscale clients.

If you have questions about setting up Vaultwarden on your own Box or migrating your team from paid Bitwarden, write to us, and we'll help you configure your organization and backup step-by-step.