How a password manager syncs to a phone
A self-hosted password manager such as Vaultwarden stores your passwords on your server. The server cannot read them. This page explains why, and what follows from it.
The server holds a locked box
The apps follow the Bitwarden design. Your master password never leaves your device. The app uses it to derive an encryption key, then encrypts the vault on the device. Only the encrypted vault goes to the server.
The server stores and returns that encrypted data. Someone who steals a copy of the server data still needs your master password to read it.
What sync means
Sync is copying the encrypted vault between devices. Each device downloads the box, then opens it locally with the master password. The phone app keeps an encrypted copy, so it works with no network.
What follows from this design
- A second login in front adds little. The master password already protects the contents. A web login page in front of the server would also break the phone app, which cannot click through it. So the vault API stays outside single sign-on. Only the admin page sits behind it.
- The server is not the only copy. Every synced device holds a copy, but you cannot count on that. Back up the server data on a schedule.
- A backup needs a test. A backup that nobody opens is a hope. Mine checks the database, counts users and items, and checks that the key files exist.
- Sign-ups can close. For a personal server, one account is enough. After you register, turn sign-ups off.
What can still go wrong
The encryption protects the contents. It does not protect the server from being deleted, and it does not help if you forget the master password. Neither the server nor anyone else can reset it. Write the recovery plan down before you need it.
Where to go next
- Vaultwarden on a phone covers the two problems I met on Android.