Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust (opens in new tab)

Please please please do this. I have plenty of issues with their prioritisation but at the end of the day, Bitwarden is extremely cheap, and is a great product. There is little to no reason to not pay that $10 a year.

I use 1Password and still pay for a Bitwarden licence to support development of a viable open source alternative.

Just subscribed to Bitwarden. Was long overdue! Need to give back.

> The peace of mind in having all your sensitive data under your control is totally worth it.

I used to have some illusions that "if I self host, I am in control", and "if I don't connect my home infra to the internet, I am safe". Later I realized neither is true.

I can't trust all the consumer grade devices in my network, I don't trust a software just because it is open source. And I don't have time to keep up with all the security patches and do security auditing / vulnerability scan routinely...etc.

It is fine to self host hobby stuff for fun, but professionally managing sensitive data is a full time job.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

I mean at the end of the day your data is encrypted before it leaves your device and unless someone breaks encryption you can display it on a banner ad on Times Square and it doesn't make a difference.

Personally I think hosting the server locally doesn't give much benefit because I'm more likely to screw things up than Bitwarden is on that front.

If I'm not mistaken it should be mostly fine as long as you trust the desktop/phone versions of Bitwarden not to send off the (unhashed) key to the server

Edit: Noting that there have been discussions about the default number of iterations. https://github.com/bitwarden/jslib/issues/52

You are in control here. It's like every other bit of software you run yourself: it's your problem to do it properly.

1) if you worry about people replacing the docker image you are using, build your own. It's not hard. Alternatively, use a specific version of the docker image by specifying the version or the hash (if you are really paranoid). Of course after you review the Dockerfile. Minimum at least glance through the Dockerfile.

2) bitwarden has import/export functionality (client side) so if your server disappears for whatever reason, you can still export your passwords from the client side.

3) if you don't trust the OSS code, audit it or at least look through it. That's the whole point of OSS. Build it from source if you must. File bugs. Look at the issue tracker. You can choose not to but if something happens it's your problem; not somebody else's problem.

4) The vault is encrypted and the server never handles or sees the decrypted content (see 3 to verify this). Other people's ability to break that encryption depends on you using a secure master password.

5) Or just pay Bitwarden to host passwords for you and rely on their terms of use, SLAs, support, good reputation, and what not. That's probably the best option if you want ass coverage for professional usage. Their pricing is very reasonable for small setups. And probably sharing passwords with a large group of users is just a spectacularly bad idea to begin with. A couple of key users, should cost you max 20/month. Not really worth dedicating devops time for self hosting unless you have a really good reason to. If you do, see 1-4.

The same could be said of every docker image on dockerhub, or any open source project on github, or any distro of linux.. I could keep going.

Unless you review the source code of everything you use, and compile it yourself, there’s always that risk.

Same with basically any part of your infra.

What prevents Postgres mainteners to just still all your DB ? Nginx mainteners to redirect your web traffic ?

Ultimately, it boils down to a balance between trust in the author, the community or your own checking process.

Isn't this true for any service? We're just trusting that the bitwarden/server image or bitwarden.com won't do the same?

Also this is only a risk if you use the provided Web vault. If you use the desktop, mobile or browser extension clients, it would require both Bitwarden LLC and dani garcia to conspire against you as the server doesn't control code those clients run and the API only provides it data in encrypted format.

Finally, if you're that worried you can pin the container version by hash and only update when you are confident in the new version

Isn't the same thing true for every password manager? What's stopping LastPass from pushing an update that steals all my passwords? What's stopping Chrome from auto-updating to a version that sends every password I enter to Google?

It's not fair to single out just Bitwarden IMO.

Because of the way bitwarden works, I think as long as the client is secure, compromise of the server is not a major concern except for data loss. Your vault is encrypted client-side.

The real threat is that someone takes control of the bitwarden browser extension and pushes a malicious update.

You can avoid this by only storing part of your password in Bitwarden. The random part.

Then when you log into somewhere add another secret (which you keep in your head) to the end of the password you stored in Bitwarden.

Switch on 2FA everywhere you can.

Sleep at night.

With any password manager, encryption happens client-side. A malicious or compromised host could make off with your encrypted vault, but that would not by itself compromise passwords.

I had the same concern. There's also the matter of supporting upstream development, which the maintainer does address in his readme. I ended up paying for a premium subscription of vanilla Bitwarden, which I self host. Sure it's overkill on resources and number of containers, but it's still insignificant. It seems slightly more safe to trust a company that depends on the software for revenue, if I'm going to use it without auditing the source. I've also e-mailed their support quite a few times, and they're great. It just doesn't feel right to me to do that while using a free custom backend to avoid the cost...

This is the use case that something like sandstorm.io tries to solve, by locking down system calls on the backend and (slowly but surely) CSP on the frontend. I don’t think BitWarden has been ported yet, though.

Especially since bitwarden itself is already open source. This is a great learning project probably but not great for use

You could restrict its network access to only your LAN. Though in that case you could only sync within your LAN.

You could always write your own password manager if you are that paranoid.

You self-host it. The data is going to your own server.

Even their CSV import worked flawlessly and my CSV export from Lastpass looked like a train wreck to parse but everything is present and correct in bitwarden.

Same here. I switched from LastPass and I really like the UX more than LastPass. It is less intrusive and feels more polished and snappier.

I switched over when I realised the Lastpass browser integration was chewing up CPU and significantly slowing down my browsing experience.

Did you consider KeePass or one of the variants?

You give in trust your company’s passwords to a random dude’s open source project that was never audited professionally. Seems a very risky thing to do.

You don’t even need docker if you build from source

SQL isn't as portable as people would like. Especially when you're trying to stay high performance as you're dealing with millions of customers. Once you start building for a specific SQL server, it hard to switch to another variant.

> It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road.

It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years.

The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given the areas I'm concerned with, it's going back to KeePass + Syncthing.

I think the reticence to provide the group features in bitwarden_rs may come from being unwilling to too blatantly step on the toes of Bitwarden LLC by producing a $0 drop in alternative to their paid service. bitwarden_rs is open source and bitwarden/server is _mostly_ open source (Some SSO related features are not), so it seems worthwhile to get along and not need to fork the ecosystem.

I run bitwarden_rs for exactly the reason you stated, for personal passwords.

It took a few seconds to add to my portainer (docker) server and now I host my vault and keep it safe within my LAN.

I run bitwarden_rs for my own passwords because I want to run my own stuff for anything like passwords. (Previously I used KeePassX, and my biggest issue with it was that it was mostly tied to one device, depending on whatever file-based sync you might set up, and I never did—barring backups—so it was only ever on my main laptop, not on any secondary laptop or phone unless I jumped through some hoops to use one of the backups.)

I don’t run the official Bitwarden server because its system requirements are much too high for my liking.

Meanwhile, bitwarden_rs uses ~24MB disk space, ~24MB RAM, and <0.03% CPU on my single-core Vultr box.

Oh yeah, one other practical reason I couldn’t/wouldn’t go with bitwarden.com’s free plan: I’ve got a few TOTP things in my vault, gotta pay for that.

I chose to use bitwarden_rs because the official server is huge, and deploying it seemed like a massive pain.

Before installing the rust version I actually went through the code to check that it wasn't doing anything untoward; it wasn't a very thorough review, but it took a couple hours. Given the fact that you don't actually need to trust a Bitwarden server, I'm not too concerned about using an "unofficial" implementation.

I ran bitwarden_rs for a bit on a digital ocean node, but ultimately decided to buy a premium membership because it was less than $5/mo and I think that they will do a better job securing the system and keeping things up to date than I would in my spare time.

Why not just get down to the basics write it yourself, like use rsync | pgp/openssl aes | rg/grep, isn't that what you want basically?

Bitwarden has a CLI tool which is pretty good.

The desktop[1] and mobile clients have a local database, so if the server is offline, you still have all of your data, you just can't sync.

[1]: Note that the Bitwarden desktop client has a major remote code execution vulnerability that the developer has closed WONTFIX, so I don't recommend running the stock one without patching that out (as well as the spyware they embed in it).