Should I self-host 1Password?
Vaultwarden is the strongest self-hosted alternative we have tested in any category — a faithful, Bitwarden-compatible server that boots in under a minute on hardware you already own. It is not the server that fails this rating.
It is the stakes. A password manager is the one service where downtime is not an inconvenience but a lockout, and where a botched restore is unrecoverable. Priced honestly — 20 minutes a month of patching, backups and restore drills at the $20/h reference rate — the all-in run rate is $7.17 against a $3.99 subscription. The math never breaks even, and that is before anything goes wrong at 3am.
1Password raising the individual plan above ~$7/mo. At today's premium the maintenance minutes alone keep this NOT REALLY; past the all-in run rate the rating flips on price.
The maintenance burden collapsing — a turnkey Vaultwarden appliance with tested, automatic off-site restore would remove most of the 20 min/mo that decides this rating.
Per-seat pricing pressure. The subscription multiplies with seats; the self-host cost does not. A per-seat move on the family tier reopens the math.
Vendor-side recovery: self-hosted, a forgotten master password or a dead unbacked-up disk is game over, and nobody is awake at 3am for you
1Password's audited infrastructure and Travel Mode
Someone else being legally on the hook for the sync layer
password vault + autofill everywhere · cross-device sync · family/emergency sharing · account recovery when you forget the master password · breach monitoring (Watchtower)
* Percent of the subscription price. Your time is priced at the slider's rate — $0/h ("my homelab time is free and I love it") is a legitimate position. Every number is derived from the record, never hand-written. Price source, checked 2026-08-05.
Runs comfortably on a Raspberry Pi.
Nothing during setup — the danger is entirely in year two: unattended, unpatched, unbacked-up
SIGNUPS_ALLOWED defaults leave registration open; flip it off after creating your account or you're running a free vault for strangers
# Vaultwarden — Bitwarden-compatible password server (tested against 1Password's job list)
# Image ships its own HEALTHCHECK (/healthcheck.sh). Behind a reverse proxy with TLS in
# production; SIGNUPS_ALLOWED must be flipped to false after you create your account.
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
SIGNUPS_ALLOWED: "true" # create your account, then set false and re-up
DOMAIN: "http://localhost:8081"
ports:
- "8081:80"
volumes:
- vw-data:/data
volumes:
vw-data:
Want a guided install instead? caniselfhostit.com/1password has AI-agent prompts that assume a bare machine — that's their half of the stool, and it's good.
FULL TIMED LOG
# Timed setup log: 1Password → Vaultwarden **Protocol:** v1 · **Verified by:** zernonia · **Date:** 2026-08-10 **Assistant:** claude-code · **Environment:** containerized runner, 2 vCPU class, Docker 29.3 / Compose v5.1 > Yes, we fully verified the install for a NOT REALLY verdict. That's the point: the verdict > isn't "it doesn't work" — it works beautifully. The verdict is that it isn't worth it. ## Timeline | Step | Time | |---|---| | Draft compose (image ships its own HEALTHCHECK; DOMAIN + SIGNUPS_ALLOWED env) | 8 min | | **Boot: healthy in 72 s (measured — image pull dominates; warm boot is ~5 s)** | 2 min | | Core workflow: create account, add login item via web vault, confirm Bitwarden client compat | 25 min | | Flip SIGNUPS_ALLOWED=false, re-up, confirm registration closed | 5 min | | Re-run from clean volumes | 5 min | | **Total: ~55 min** | | ## Measurements - Boot to healthy: **72 s** cold / ~5 s warm · 1 container · idle RAM ~60 MB ## What broke Nothing during setup. Both findings are about year two, not day one: 1. **Registration ships open.** Until you set `SIGNUPS_ALLOWED=false` after creating your account, anyone who finds the URL can register a vault on your server. 2. **The whole vault is one SQLite file in `/data`.** No copy of that directory off the box = a dead disk is every password you own, gone. 1Password's job list includes "recovery when you forget"; here, recovery is you, in advance, or nobody. ## Verdict-relevant notes - Capability is genuinely high (Bitwarden clients everywhere, sharing, TOTP). The NOT REALLY comes from economics ($3.99/mo never breaks even against valued maintenance time) plus maximum-stakes failure modes. Bitwarden's free hosted tier escapes the invoice without inheriting the pager — that's the honest alternative.