passwords-security
1Password logo→

Should I self-host 1Password?

NOT REALLYkeep paying

Vaultwarden runs beautifully — we timed it — and the math still never breaks even: at $20/h your maintenance minutes cost more than the subscription. The stakes are every password you own; keep paying, or use Bitwarden's free tier.

The math (nothing hidden, including your time)

1Password (Individual)$3.99/mo
VPS share + storage−$0.50/mo
Your maintenance: 20 min/mo at $20/h−$6.67/mo
Net saving$-3.18/mo
Setup: 55 min measured (one-time)$18.33
Break-evennever
Markup Index (price ÷ real self-host cost)0.6×

Price: source, checked 2026-08-05. Inputs are stored in git; every number above is derived, never hand-written.

What you lose

  • Vendor-side recovery: self-hosted, a forgotten master password or a dead unbacked-up disk is game over, and nobody is awake at 3am for you
  • 1Password's audited infrastructure and Travel Mode
  • Someone else being legally on the hook for the sync layer

What you're paying 1Password for

  • password vault + autofill everywhere
  • cross-device sync
  • family/emergency sharing
  • account recovery when you forget the master password
  • breach monitoring (Watchtower)
Vaultwarden running from the boot-verified compose file
Vaultwarden, running from the compose file on this page — screenshot from our verified instance, not marketing material.

Ranked alternatives

1. Vaultwarden

A Bitwarden-compatible password server small enough to run on the cheapest VPS you can rent.

dani-garcia/vaultwarden · ★ 65,232 · last commit 4d ago · 314,921,945 pulls · AGPL-3.0

Hardware

Runs comfortably on Raspberry Pi.

The tested compose file (our evidence, CI-booted)

# Vaultwarden — Bitwarden-compatible password server (tested against 1Password's job list)
# Image ships its own HEALTHCHECK (/healthcheck.sh). Behind a reverse proxy with TLS in
# production; SIGNUPS_ALLOWED must be flipped to false after you create your account.
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      SIGNUPS_ALLOWED: "true" # create your account, then set false and re-up
      DOMAIN: "http://localhost:8081"
    ports:
      - "8081:80"
    volumes:
      - vw-data:/data

volumes:
  vw-data:

Want a guided install instead? caniselfhostit.com/1password has AI-agent prompts that assume a bare machine — that's their half of the stool, and it's good.

Verification

Protocol v1 · verified by zernonia on 2026-08-10 · setup measured at 55 min · AI assistant: claude-code (allowed & stated)

What broke

  • Nothing during setup — the danger is entirely in year two: unattended, unpatched, unbacked-up
  • SIGNUPS_ALLOWED defaults leave registration open; flip it off after creating your account or you're running a free vault for strangers
Full timed log
# Timed setup log: 1Password → Vaultwarden

**Protocol:** v1 · **Verified by:** zernonia · **Date:** 2026-08-10
**Assistant:** claude-code · **Environment:** containerized runner, 2 vCPU class, Docker 29.3 / Compose v5.1

> Yes, we fully verified the install for a NOT REALLY verdict. That's the point: the verdict
> isn't "it doesn't work" — it works beautifully. The verdict is that it isn't worth it.

## Timeline

| Step | Time |
|---|---|
| Draft compose (image ships its own HEALTHCHECK; DOMAIN + SIGNUPS_ALLOWED env) | 8 min |
| **Boot: healthy in 72 s (measured — image pull dominates; warm boot is ~5 s)** | 2 min |
| Core workflow: create account, add login item via web vault, confirm Bitwarden client compat | 25 min |
| Flip SIGNUPS_ALLOWED=false, re-up, confirm registration closed | 5 min |
| Re-run from clean volumes | 5 min |
| **Total: ~55 min** | |

## Measurements

- Boot to healthy: **72 s** cold / ~5 s warm · 1 container · idle RAM ~60 MB

## What broke

Nothing during setup. Both findings are about year two, not day one:

1. **Registration ships open.** Until you set `SIGNUPS_ALLOWED=false` after creating your
   account, anyone who finds the URL can register a vault on your server.
2. **The whole vault is one SQLite file in `/data`.** No copy of that directory off the box =
   a dead disk is every password you own, gone. 1Password's job list includes "recovery when
   you forget"; here, recovery is you, in advance, or nobody.

## Verdict-relevant notes

- Capability is genuinely high (Bitwarden clients everywhere, sharing, TOTP). The NOT REALLY
  comes from economics ($3.99/mo never breaks even against valued maintenance time) plus
  maximum-stakes failure modes. Bitwarden's free hosted tier escapes the invoice without
  inheriting the pager — that's the honest alternative.

Verdict history

  • 2026-08-10: unscored → NOT_REALLY — Initial verdict: never breaks even at any realistic hourly rate, and the stakes are every password you own.