How to move from LastPass to Vaultwarden: a practical migration guide

Quick comparison

RAM figures are catalog estimates from our tests.

Before you start

• Vaultwarden is very light and runs fine in a small LXC container or in Docker. Our catalog lists about 128 MB RAM as an estimate for a family-sized vault.
• You need a domain name and HTTPS. The Bitwarden web vault and apps rely on browser cryptography that only works over a secure connection, so plain http on a local IP is only good for a quick test. A reverse proxy such as Nginx Proxy Manager with a Let's Encrypt certificate is the usual setup.
• Decide how you will reach it from outside your home: a public reverse proxy, or a VPN such as Tailscale. The VPN keeps the server off the internet entirely.
• Do not cancel LastPass or delete anything from it until the checks at the end are done.

Migration steps

1. Install Vaultwarden with the compose file on our Vaultwarden page as a starting point. Set DOMAIN to your real https address and put the reverse proxy in front of it.
2. Open the web vault and create your account with a long, unique master password. Then set SIGNUPS_ALLOWED to false and restart, so nobody else can register.
3. Enable two-step login on your account (an authenticator app, or a passkey or hardware key) and save the recovery code offline.
4. In LastPass, open the web vault and use Advanced Options, then Export, to download your data as a CSV file. Do this on a computer you trust.
5. In the Vaultwarden web vault go to Tools, then Import data, choose the LastPass (csv) format and select the file. Vaultwarden has no importer of its own, it uses the one built into the Bitwarden web vault.
6. Delete the CSV file right away, including from your trash folder. It contains all your passwords in plain text.
7. Install the Bitwarden browser extension and mobile app, and before logging in choose the self-hosted option and enter your server address.

Lock it down and back it up

• Keep the admin page off unless you need it. If you enable it, set ADMIN_TOKEN to a hashed value as the Vaultwarden documentation describes, not a plain password.
• Keep the server updated. Vaultwarden follows Bitwarden's API, so old versions can stop working with new clients.
• Back up the whole data folder, not only the database: it also holds the RSA keys, attachments and Sends. For the SQLite database use the sqlite3 .backup command or stop the container first, instead of copying a file that is being written.
• Keep the backup on a second disk and a copy somewhere else, encrypted. Test a restore once.
• Export an encrypted JSON copy of your vault from time to time and store it offline.

What to check before you cancel LastPass

• Compare the number of logins, notes and cards in Vaultwarden with LastPass.
• Log in to a few important sites using autofill on your computer and on your phone.
• Check that folders, notes and any attachments came across. Some LastPass fields, such as custom items, may arrive as plain notes.
• Make sure your authenticator codes are not stored only in LastPass, and move them first.
• Because you are leaving a service that has had a breach, consider changing the passwords of your most important accounts after the move.

Honest caveats

• Self-hosting a password manager means you are the sysadmin. If the server is down, the apps still work from their cached copy, but you cannot sync, and a lost backup can mean lost passwords.
• Vaultwarden is an unofficial, community project and is not the same as Bitwarden's own server. It has not had the formal security audits Bitwarden's official software has, so judge that risk for yourself. The paid Bitwarden cloud is a reasonable alternative if you do not want to run this yourself.
• If you expose it to the internet, you are responsible for updates, HTTPS and brute-force protection.
• Our catalog resource figure is an estimate, not our own measurement, and we did not re-benchmark Vaultwarden for this guide.
• Export formats and menu names in LastPass and Bitwarden change over time. If a screen does not match this guide, follow the current official documentation.