Replace LastPass or 1Password

What you are actually giving up#

A hosted password manager is a company whose entire job is being reachable when you need to log in to something. Self-hosting one means you take that job, and no other service on this site has a downside this sharp. If your photo server is down you look at photos tomorrow. If your vault is down you cannot get into your bank, your email, or the DNS provider you need in order to fix the vault.

Specifically, you give up:

• Someone else's availability. Bitwarden clients cache an encrypted copy locally, so a dead server does not lock you out on the spot. It does stop you adding or rotating a credential and stop a new phone enrolling, so a lost laptop plus a dead server is a genuinely bad day.
• Someone else's backups. Bitwarden's own documentation puts vault backups on the user even for the hosted service. Self-hosted, that sentence is the entire deal.
• A compatibility guarantee, and anyone to call. Vaultwarden is an unofficial reimplementation of the Bitwarden server API, under AGPL-3.0, with no SLA and no support contract. Bitwarden's clients auto-update and nobody there is obliged to keep them working against it.

Why you are here: the 2022 breach, precisely#

In August 2022 an attacker took source code and technical information from a LastPass development environment. In November 2022, using information from that first intrusion, they reached a third-party cloud storage service and copied backup archives. The December 2022 update spelled out what was in them: account metadata in the clear (company names, end-user names, billing addresses, email addresses, telephone numbers and IP addresses), and customer vault data in a proprietary binary format containing both unencrypted fields, notably website URLs, and encrypted fields such as usernames and passwords.

Two things follow, and vendor-friendly articles tend to skip the second one.

First, the encrypted vaults are permanently in someone else's possession. No revocation, no expiry, no rate limit on an offline attack. LastPass's guidance rested on default settings: a 12 character master password minimum enforced since 2018, and 100,100 PBKDF2 iterations. Older accounts, never touched since, were configured with far lower iteration counts.

Second, switching password managers does not remediate this. It changes where your future passwords live; the copy taken in 2022 is unaffected. If you have not rotated the credentials that matter since then, do that before you spend a weekend on Docker: email first, then anything holding money, then your registrar and DNS.

Get your data out first#

LastPass exports a plaintext CSV. Every password you own, in the clear, written to disk. Treat that file as radioactive.

The lower-risk route avoids creating it: in the Bitwarden browser extension or desktop app, go to Settings, Vault, Import items, choose LastPass as the format and authenticate to LastPass directly. Nothing hits your filesystem.

If you must use the file, in the LastPass web vault it is Advanced Options, Export, which sends an email confirmation before producing the .csv. In the browser extension it is Account, "Fix a problem yourself", "Export vault items", "Export data for use anywhere".

# keep the plaintext export in RAM, never on disk
mkdir -p /dev/shm/lp && chmod 700 /dev/shm/lp
# save the export into /dev/shm/lp/lastpass.csv, import it, then:
shred -u /dev/shm/lp/lastpass.csv && rmdir /dev/shm/lp

Even then: your browser's download history records the path, a synced Downloads folder replicates the file everywhere before you notice, and shred is not a guarantee on an SSD with wear levelling. Full-disk encryption is what actually saves you.

Four things that do not come across cleanly:

1. File attachments and Sends. Bitwarden's import documentation says these must be added manually.
2. Duplicates. Import does not deduplicate. Run it twice and you get two of everything.
3. HTML-encoded characters. Bitwarden documents a LastPass bug that turns &, < and > in passwords into HTML entities. Search the CSV for & and fix it first, or a handful of logins fail for a reason you will blame on something else.
4. TOTP seeds from LastPass Authenticator. They do not export. You re-enroll two-factor per site, which you should be doing anyway given what was stolen.

Which one to pick#

Vaultwarden is one container idling around 40 MB on SQLite, and it unlocks every feature Bitwarden gates behind a paid plan, with no licence key and no seat count: unlimited organization members, groups and collections, emergency access, vault TOTP and file Sends. A genuinely good deal for a household, and still the wrong default.

If you do self-host: mount a host directory at /data, set DOMAIN to the exact external URL, and put TLS in front, because the web vault, WebAuthn and passkeys all require a secure context (Reverse proxy and TLS and Caddy are the shortest path). Register your account, then set SIGNUPS_ALLOWED=false and invite the household from the admin page. Old guides route a WebSocket port 3012: that listener was removed in 1.31.0 and live sync rides the main HTTP port now.

What the migration actually costs#

• Import to hosted Bitwarden: 30 minutes, including deleting the CSV properly.
• Standing up Vaultwarden: an evening. One container, one volume, a domain, a certificate, and the ADMIN_TOKEN hash with its doubled dollar signs.
• RAM and disk: about 40 MB idle, 150 MB in use, a database in the low megabytes. Not the expensive part.
• The recurring job, which is the actual cost: a nightly encrypted backup off the box and a restore rehearsal every quarter, so one hour a quarter, forever. Plus tracking releases, because Bitwarden's clients update themselves and a client major bump becomes a scheduled server upgrade.

# nightly: consistent dump, then ship it somewhere else
docker exec vaultwarden /vaultwarden backup
restic -r "$REPO" backup /srv/vaultwarden/data \
  --exclude '/srv/vaultwarden/data/icon_cache'

Back up db.sqlite3, attachments/, config.json if you ever saved settings on the admin page, and the rsa_key* files that sign auth tokens. Exclude icon_cache/. Do not copy the live SQLite file with cp: in WAL mode you get a torn write and a vault that restores broken. Ship it to a second location with restic or BorgBackup, and read Backups that actually restore and An update strategy that does not lose data before you trust any of it.

What breaks and how to tell early#

Silent staleness. The dangerous failure is not a crash. It is a browser extension that stops syncing while still autofilling from its cache, so a password you rotated on your phone does not exist on your laptop. Check the "last sync" line in the extension weekly for the first month.

config.json outranks your environment. Save anything on the admin page and Vaultwarden writes config.json into /data, where for most settings it beats environment variables. People then edit compose, restart, and nothing changes. Manage settings in one place.

Certificate expiry. WebAuthn and passkeys need a valid certificate on the exact DOMAIN you configured. An expired one does not degrade gracefully, it stops logins. Alert on 14 days remaining, not on expiry.

The point of no return#

Do not delete the LastPass account until all four are done:

1. Every device you own has logged in to the new vault and synced successfully.
2. You have restored a backup into a scratch container on another machine and logged into it. If you skip one step on this page, do not let it be this one.
3. You have rotated the credentials that matter: email, money, DNS. The 2022 archives are still out there.
4. Your master password and recovery material exist on paper, in a safe, where a trusted person can reach them. A vault only you can open is a vault your family loses.

Then delete the LastPass account rather than abandoning it, so the stored copy stops being retained. And put a recurring entry in your calendar, twice a year: "restore the vault backup and log in". The day you stop doing that is the day self-hosting stopped being the right choice.

Next: score the setup honestly with the Resilience scorecard, harden the host with A security baseline for a home server, and browse the rest of Identity.