Vaultwarden on a phone
I moved my passwords from Google Password Manager to Vaultwarden, a self-hosted server that speaks the Bitwarden API. The server part was easy. The phone part had two surprises.
Surprise 1: the app cannot create an account
The Bitwarden Android app (version 2026.9) failed to register a new account against Vaultwarden 1.37.3. The server answered HTTP 422.
My reading: the app sends a newer register payload than this server version expects. I did not dig into the exact field.
Workaround: register in the web vault in a browser. Then log in from the app. Login works fine. Only registration fails.
After that, I closed sign-ups on the server. One account is all it needs.
Surprise 2: the web vault does not load on mobile data
The web vault loads a WebAssembly file of about 7 MB. On Wi-Fi it loaded. On mobile data it failed.
I did not find out exactly why the uncompressed transfer failed. Compression fixed it. Caddy does not compress by default, so one line in the site block turned it on:
vault.example.com {
encode zstd gzip
reverse_proxy vaultwarden:80
}After that change, the web vault loaded over mobile data.
Where the login page goes
My other services sit behind a single sign-on page. Vaultwarden does not, because the master password encrypts the vault. A second login in front of it adds nothing, and the Bitwarden apps cannot pass a web login page anyway.
Only /admin sits behind single sign-on:
vault.example.com {
encode zstd gzip
handle /admin* {
import sso
reverse_proxy vaultwarden:80
}
handle {
reverse_proxy vaultwarden:80
}
}Backups
A password vault without backups is a liability. A nightly timer on my laptop copies the Vaultwarden data off the VPS. Each run checks the database integrity, counts users and items, and checks that the key files exist. It keeps 30 days.
A backup that nobody checks is a hope, not a backup.