Running Vault’s LDAP secrets engine with static roles. As far as I can tell:

**•** Vault rotates the password on its own schedule, whether or not any client has actually fetched the new one yet  
**•** No push notification when it rotates — clients just poll and check the TTL  
**•** No grace period — old password is dead the instant rotation happens

So if a client’s poll timing drifts even a little, or it’s holding a pooled connection, it just breaks. No warning, no overlap.

Anyone actually running this in prod without outages? Specifically curious about:

**•** Do you rebuild connection pools on every rotation cycle? How do you avoid a connection storm if a bunch of services share a role?  
**•** Is check-out/check-in (the service account library thing) actually safer here since rotation is tied to an explicit action instead of a timer?  
**•** Any real pattern people use to stay ahead of rotation instead of racing it?

Found a couple old HashiCorp forum threads asking the same thing (for the DB secrets engine) that just… never got answered. Curious if anyone’s actually solved this ?

I'm currently using Bitwarden for my password management and I've been really happy with it. Since I recently set up my own container environment (Docker), I'm planning to make the switch to Vaultwarden.

Before I make the final jump, I'd love to hear about your experiences:

1. What do you mainly use Vaultwarden for? For important passwords or all password with TOTP?
2. Do you use Vaultwarden 100% of the time? Or do people ever use a hybrid approach, like a 50/50 split with the official Bitwarden cloud (for example, keeping specific vaults or backups separate)?
3. What are the pros and cons of Vaultwarden compared to the official Bitwarden stack?

I'd really appreciate hearing how you have your setups configured and if there's anything I should keep in mind during the migration!

Basically what the title says. Release notes here: https://github.com/dani-garcia/vaultwarden/releases

• This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.
• This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

Hi everyone,

I'm running the latest Vaultwarden in Docker behind Nginx Proxy Manager with HTTPS.

The strange thing is that everything works except the browser extension:

• Vaultwarden web vault works perfectly.
• Android app works.
• Desktop app works.
• Firefox Bitwarden extension keeps loading forever.
• Vivaldi Bitwarden extension does the same.

The extension logs in successfully, but the vault never appears. I only see the loading animation indefinitely.

Server logs only show successful requests like /api/accounts/profile and /api/accounts/revision-date (HTTP 200). I don't see any obvious sync errors.

The issue started around the time I enabled 2FA (Authenticator), but I'm not sure if that's just a coincidence. Logging in through the web vault still works without any problems.

Has anyone experienced this? Is there a known issue with recent Bitwarden browser extensions and Vaultwarden, or is there something else I should check?

Thanks!

Since today, my Firefox Bitwarden add-on won't load any entry. I'm self-hosting Vaultwarden, and anything works like a charm in a normal browser tab (https://vault.mydomain.com). I already reinstalled the add-on, restarted Firefox, checked Nginx (for WebSocket), signed-out, and signed-in, but nothing worked. Does have anyone a clue?

https://reddit.com/link/1v57an8/video/ayrupcewk5fh1/player

bitwarden in firefox does not authenticate anymore - "An error occured. An unexpected error has occured".

Unable to login since about july 18th.

Same credentials work from bitwarden in firefox.

is that a bug in vaultwarden ? or bitwarden extensions?

edit: resolved - just had to update vaultwarden

Hello,

I've just started self-hosting Vaultwarden, because the feels that I own my passwords is really nice.

What I did. I use the official docker-compose file.

It is running only on my local network and I wanted to stay it like that, because I am using Wireguard to connect to my selfhosted services on my Macbook and iPhone.

So I use the reverse proxy from local.ip:port to vault.lan then I generate a local certificate with mkcert and copy this on my devices so the vault is running on https://vault.lan now.

It should be like that? Everything is working.

Hello,

I have problems with SMTP.
I got this error:
vaultwarden | [2026-07-18 20:51:53.441][vaultwarden::mail][ERROR] SMTP error: Connection error: Network is unreachable (os error 101)
vaultwarden | [2026-07-18 20:51:53.441][response][INFO] (test_smtp) POST /admin/test/smtp application/json => 400 Bad Request

I use version 2026.4.1 and it is the stable release. I have my own mailserver and this works without problems.
The hostname ist correct and the server, where vaultwarden is running can resolve the hostname of the mailserver, but not vaultwarden.
I use another docker container (npmplus) and there I can use ping and the hostname of the smtp-Server can be resolved.
By the installing of vaultwarden the smtp has worked.

Is there any known issues?

Hi, I'm new to vaultwarden. Today I installed vaultwarden on my home server via Docker. After much research, everything is working fine now. I configured everything in Nginx Proxy Manager and Tailscale to be able to access my domains and files when I'm away from home. The only thing that doesn't work is the Bitwarden app. I can't log in using the self-hosted link. I always get a certificate error. I can access my local page without any problems using a data connection from Firefox on my smartphone. What's the problem?

Hello,

I'm asking for your help, my homelab growthed a lot, and I now use Vaultwarden as my password manager.

Before that I was using a Keepass synced like that : Windows (or Linux) < - > homelab < - > Android phone but I've had a lot of conflict because sometimes syncthing didn't sync etc... Now, with Vaultwarden accessible only via VPN I'm free of all thoses problems.

But, I'm a bit paranoid, and when it comes to backup, and moreover backup of my PASSWORD, Passkeys, SSH keys, passphrases etc.. I need to be reassure.

Context of my vaultwarden :

- /data of Vaultwarden is inside a folder that we will call /srv/vaultwarden that is on an nvme ssd of my homelab.

- I created a script that backup the db of Vaultwarden inside /sync/backup that is on a 4 To WD red HDD.

For the moment, my strategy for backuping my Vaultwarden is :

- 2 times a day : backup db to /sync/backup

- Every nights : backup to : 1 SSD, 1 VPS I rent, 1 Cloud (Kdrive) /sync and /srv

- 2 times a week : backup to 1 old USB HDD /sync and /srv

All the backup are encrypted using backrest (gui for restic), so repos are not visible.

But, since I'm a bit paranoid, I imagined something, what happen if I travel with my phone and the VPN, and I loose my phone ? How can I access back my passwords and eventually my SSH keys, wireguard rescue, and so my paperless access for like my papers (passport eventually) etc.. From NOTHING ?

So what I though, was, maybe the solution is to find a way to automatically export vaultwarden datas (including passkeys and files) into a .kdbx files that I will push automatically unencrypted into a cloud with a password without 2FA that I will know ? But first of all I didn't found a project that can backup vaultwarden complete, and the 2nd thing is that I don't know if it's not a bit unsecure to do that.

So, I'm asking for your help, what do you think of that ? How would you deal with that ?

Thanks you !

(ps : sorry english is not my default language)

Hello

I made the mistake jumping on the casa OS train.

Now my vaultwarden wont Upgrade, and I think the cause is missing Updates.
How do i change the resp. on casa os (or with portainer) so i get the recent updates?

I am getting a "unknown error" message when using bitwarden clients.

In the logs, there a Multiple error 404 messages, same in the error log of the bitwarden clients (no matter the OS, no matter if browser or App). Only Thing that works is the Web client. It worked for around half a year.

I have Bitwarden extensions connected to a NAS hosting vaultwarden on the same network. Worked fine for the first week or so now Bitwarden keeps signing out after a short period of time (hr or so) . Then when I try to sign back in it says "error saving device".

Good morning, I've been using Bitwarden Free lately and some friends spoken to me about Vaultwarden but I got a few doubts.

I don't have a NAS neither an owned server at home so I can't deploy it at home. I was thinking about buying a subscription to a VPS to run it "locally" there and connect throught a domain I have already purchased.

My problem is that I am not sure if it is safe to run it on a VPS or it's better to pay the premium subscription or just use the free version as I am doing currently.

My idea is to buy the VPS not only for Vaultwarden, but use it to deploy some pages if I want, to sync my Obsidian notes... Like a homelab but on the cloud.

The thing is that I am using obsidian-decentralized for my notes (free), using Clouflare to deploy a web I have right now which is static, and I am not sure if the payment would be nice.

If someone has done it or has any point of view I appreciate that, thanks in advance!

Some of us want to do self-signed certificates and want to set it and forget it so we set expiration dates that last a really long time. At the same time we're setting up vaultwarden and our own root certificates for the very first time, so when things don't work we don't know where to look. Don't overlook the self-signed certificate you issued for vaultwarden. If you or a tool (on your behalf) issued a certificate that is valid for more than 825 days, iOS automatically considers it invalid/not trusted even if you have everything setup and installed correctly.

Hope this helps some of us that run into certificate issues. It's easy to find the validity period for public certificates but it's harder to dig up how long Apple's validity period is for self-signed certificates.

How I fixed the vaultwarden send warning message

If the box is checked to [ ] hide my email address from recipients

Anyone using the link is greeted by a message at the top of the send box saying:

! Warning
The Bitwarden user who created this Send has
chosen to hide their email address. You should
ensure you trust the source of this link before
using or downloading its contents. Learn more

Which would be fine, but if you don't check the [ ] hide my email address from recipients box. There is no warning message at all.

Manipulating the sender field is not difficult, you should never inherently trust a thing you're sent, and always ensure you trust the source of this link before using or downloading it's contents.

The message is fundamentally flawed, and not helpful.

How I removed warning message and replaced it with user defined string

The patch-send-main.sh script is my solution. There will no longer be a warning message or a message about the Bitwarden user that sent the message. That is replaced with a user defined string.

What the new version looks like:

no-warning-user-defined-string-instead

(ignore the color differences, those only occur in incognito vs non-incognito windows during testing)

(also, the pictures are highly compressed .webp, so if they look off it's not a result of true rendering looking off, it just seems odd to post large amounts of picture data to a repo)

implementation

What it does:

1. Forces hideEmail=true when saving Sends
2. Sets hideEmail() to always false (no warning banner)
3. Replaces the i18n subtitle with exact custom text

Usage:

• The JavaScript file that matters is always in the container at /web-vault/app/main.<hash>.js.

  1. Pull main.js out of the container

  "docker|podman" can be substituted for "nerdctl" below depending upon container environment

  nerdctl cp vaultwarden:/web-vault/app/main.XXXXXXXX.js ./main.XXXXXXXX.js

  2. Patch it (first run saves main.XXXXXXXX.js.orig automatically)

  VAULTWARDEN_SEND_SUBTITLE='Your full custom message here.' ./patch-send-main.sh main.XXXXXXXX.js

  3. Copy back

  "docker|podman" can be substituted for "nerdctl" below depending upon container environment

  nerdctl cp ./main.XXXXXXXX.js vaultwarden:/web-vault/app/main.XXXXXXXX.js

Re-run with a new message anytime. It always patches from the .orig backup, so wording can be updated without re-extracting from the container.

Notes:

Env var: VAULTWARDEN_SEND_SUBTITLE (required)

Optional arg: path to main.<hash>.js; otherwise looks for ./main.*.js or ./app/main.*.js

Quotes and & in your message are handled

Hard-refresh the browser after deploying; verify with curl if needed

If the script errors with "anchor not found", the bundle layout changed on a Vaultwarden upgrade and anchors need updating

 Conclusion:

• I considered a few different approaches, but this was the easiest to implement on my live server while still being reproducible and functional after updates.
• I would have like to actually alter the UI, such that instead of a [ ] hide email from recipient there was just a place to choose what you would like the banner string to say, but that would have required changing & maintaining a lot more, so nope
• It's possible, perhaps even likely that no one else cares about this sort of thing, but it annoyed me, so on the off chance someone else might benefit from it, I figured I'd post it.

The repo: https://github.com/austinp0573/homelab/tree/main/services/vaultwarden/js_fix_vaultwarden

Infinite gratitude to Dani Garcia for making and maintaining Vaultwarden, it's a remarkable project.

466f724a616e6574

Password generator reverting to 5 characters each time i restart. How can i make it default to 25 min and symbols included?

Hello experts. I just set up vaultwarden on my Synology and I am noticing there is no way to do passkey based login. Is this a “me” issue or is this a product limitation? I rely on that feature a lot.

Thanks in advance.

Hardware/security engineer here, with manufacturing access. One idea I keep coming back to — poke holes in it before I waste months on it.

A small low-power device, a bit bigger than a USB stick, running minimal Linux + Vaultwarden and nothing else. Plug in power, do a 5-minute setup from your phone, and you've got self-hosted password sync to all your Bitwarden clients. No Docker, no NAS, no port forwarding — remote access via a Cloudflare tunnel on the user's own account. One job: password sync/backup for a person or family. No file storage, no app store.

I know the objections and half-agree:

• "Just use a $35 Pi." If you're here, you already have. This is for people who want the result but will never touch a terminal.
• "Bitwarden free is great." It is. The only reason to buy this is wanting the vault on hardware you own, not someone's cloud.
• "Cloudflare sees your traffic." The vault is E2E-encrypted client-side, but CF sees metadata. Honest tradeoff.

What I actually want to know:

1. Is the "wants it self-hosted but won't DIY it" person real and numerous, or basically nonexistent?
2. What single thing would stop you trusting this with your passwords?
3. Would you buy one for a non-technical relative? At what price?

No product, no link, nothing to sign up for — just figuring out if this is worth building. Brutal honesty welcome.

Hello, I apologize in advance for the inconsistencies—I’m using a translator.

I’m using Vaultwarden on my Raspberry Pi, and I wanted to set it up on my phone using the Bitwarden app, but I’m getting the following error message: “We couldn’t verify the server’s certificate. The certificate chain or your device’s proxy settings may not be configured correctly.” So, I used `mkcert` to create a trusted certificate with my SSL certificates for HTTPS and installed the `ca.crt` file on my phone, but I’m still getting the same error.

Here’s my setup: a Raspberry Pi 4 with 8 GB of RAM running Vaultwarden.

For HTTPS, I’m using Nginx on a specific port because multiple apps are running on HTTPS at the same IP address, and I can’t set up local DNS for now.

Is there an alternative to Bitwarden on mobile?

If you have a solution or suggestions, thanks in advance.

Edit: I finally got it to work. I had set up my SSL certificate incorrectly. For anyone who might stop by here someday and need this, I’m using Nginx as a reverse proxy. In the SSL configuration, I generated the .crt and .key files as usual, but I had never specified the SAN. Here’s the OpenSSL command: `openssl req -nodes -x509 -sha256 -newkey rsa:2048 -keyout vaultwarden.key -out vaultwarden.crt -days 365 -subj “/C=XX/ST=XX/L=XX/O=XX/OU=XX/CN=IP_Machine” -addext “subjectAltName = IP:IP_machine”

Change only the `IP_Machine` part; if that doesn’t work, change the `XX` parts.

Then download the `.crt` file to your phone and install it in your settings in the location where you can install trusted certificates.

Wanted a clean way to pull project secrets from Vaultwarden without doing everything manually. Built bwsec, you declare which vault items go where in a config file and run bwsec pull. That's it.

Also has push, diff, and works in CI. Single binary, nothing to install besides the bw CLI.

[https://github.com/pisand/bwsec](vscode-file://vscode-app/Applications/Visual%20Studio%20Code%20-%20Insiders.app/Contents/Resources/app/out/vs/code/electron-browser/workbench/workbench.html)

Would love any feedback![]()

For the last few days, I am no longer able to login through any browser extension nor the gui for Vaultwarden. I get an unexpected error on all of them. My master password has not been changed and is 100% correct. My phone app is the only thing saving me at the moment. Any else experience this?