dani-garcia/vaultwarden
Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
How vaultwarden is put together
Vaultwarden is an alternative, lightweight server implementation of the Bitwarden Client API written in Rust, designed for self-hosted deployment. It is built on the Rocket web framework, exposes the Bitwarden REST API plus WebSocket notifications and an optional admin backend, and persists data via the Diesel ORM to SQLite, MySQL/MariaDB, or PostgreSQL (selected via Cargo features). Requests flow through Rocket route handlers in `src/api/*`, are authenticated with RS256 JWTs (keys generated/stored via OpenDAL), and manipulate domain models backed by SQL migrations; supporting subsystems handle SSO/OIDC, 2FA (TOTP/WebAuthn/Duo/YubiKey), email, favicons, push notifications, and file storage. Configuration is env/`.env`/`config.json` driven through a custom macro-generated Config, and the whole thing ships primarily as container images.
Languages
Frameworks
Datastores
Infrastructure
Major components
api
Rocket route handlers implementing the Bitwarden Client API (core, admin, identity, icons, notifications, push, web).
auth
JWT (RS256) issuance/validation, request guards, and Send/admin token authentication.
db
Diesel-based data models, schema, connection pooling, query logging, and multi-backend migrations.
config
Macro-generated configuration system loading settings from env, .env, and config.json.
sso
OpenID Connect single sign-on flows and SSO client handling.
Email construction and delivery (invites, verification, 2FA) via lettre with Handlebars templates.
storage
File/attachment and key access abstraction through Apache OpenDAL (filesystem or S3).
admin
Admin backend for user/org management, diagnostics, config editing, and DB backups.
A fix so password changes work correctly with the newest version of the web interface.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A fix so password changes work correctly with the newest version of the web interface.
Week of 2026-08-17
Two small compatibility and reliability fixes for client data and email sending.
Week of 2026-08-03
A mix of security-log improvements, general fixes, and build/testing tune-ups.
Week of 2026-07-27
A fix to make organization invite links more consistent.
Week of 2026-07-20
A busy week of security hardening, dependency updates, and removing outdated code.
Over the past several weeks, work on Vaultwarden (a self-hosted password manager) focused on keeping the server compatible with newer client apps, tightening up login security and logging, and improving reliability behind proxies and on different systems. The team steadily fixed compatibility glitches, updated dependencies, and cleaned up outdated code. The most recent weeks were mostly small, targeted fixes to keep everything working smoothly with the latest browser extension and web interface.
Week by week
2026-08-24A fix so password changes work correctly with the newest version of the web interface.latest1 change
Fix
Password changes work with the newer web app
Updated how the server handles a password change so it accepts the newer format sent by recent clients while still supporting older ones.
2026-08-17Two small compatibility and reliability fixes for client data and email sending.2 changes
Fix
Added a missing date field for policies
Included a placeholder revision date in policy data so newer clients that expect the field don't run into problems.
Fix
More reliable check for the email-sending program
Improved how the server verifies that the sendmail program is allowed to run, using a more dependable system check.
2026-08-03A mix of security-log improvements, general fixes, and build/testing tune-ups.4 changes
Feature
User email now shown in login logs
Successful and failed login log entries now record the user's email address, making it easier to trace account activity.
Fix
Miscellaneous fixes and updates
A collection of smaller corrections and improvements across the application.
Chore
Fixed a failing automated test
Repaired a Playwright browser test so the automated test suite passes reliably.
Fix
Fixed Debian build cross-compiling
Resolved a build problem when compiling the software for Debian across different processor types.
2026-07-27A fix to make organization invite links more consistent.1 change
Fix
More reliable organization invite links
The server now always includes the needed information in organization invitation links so they behave consistently for new and existing users.
2026-07-20A busy week of security hardening, dependency updates, and removing outdated code.5 changes
Feature
Trusted proxy support and rate limiting
Added support for running behind trusted proxies and introduced rate limiting on unauthenticated requests to improve security, plus other fixes.
Chore
Updated dependencies and tooling
Refreshed the API responses, third-party libraries, and automated build workflows.
Refactor
Removed unused and outdated code
Cleaned up unused data fields and old compatibility code that was no longer needed.
Fix
Fixed custom role dialog
Corrected the controls used in the custom role dialog so they work properly.
Fix
Fixed building with a newer toolchain
Resolved a compilation issue with a newer version of the rust-musl build tool.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required