Why self-host your password vault
Password managers sit at the center of your digital life. When that vault lives only on someone else’s cloud, outages, policy changes, and breaches become your risk. Self-hosting flips the default: you choose the machine, the backups, and who can reach the API.
What you control
| You own | The server never gets |
|---|---|
| Where ciphertext is stored | Master password |
| When upgrades and backups run | Plaintext vault keys |
Which clients may connect (CORS_ORIGINS, HTTPS) | Readable entry names or passwords |
| Whether sync is on at all | Decrypted attachments or shares |
The OpenKey app works offline with a local encrypted database. Point Settings → Data → Self-hosted server at your instance when you want multi-device sync — same zero-knowledge rules either way. Prefer keeping at least one encrypted local backup; the server cannot recover a forgotten master password.
A practical shape
Many people start with Docker on a home NAS or a small VPS:
cd openkey_server
cp .env.example .env
openssl rand -hex 32 # JWT_SECRET (min 32 characters; placeholders are rejected)
docker compose up --build -dPut TLS in front (Caddy, Traefik, or your reverse proxy), set a long unique JWT_SECRET, and restrict CORS_ORIGINS to your app and extension origins — never *. Then Register from the first device and Login from the rest, and use Sync now when you want an explicit pull/push.
LAN without a server
If you only need devices on the same Wi‑Fi, Nearby vault sync (Pro) can pair and link vaults on the LAN without PostgreSQL. Use it for convenience; still keep offline backups for disaster recovery.
Who this is for
- Individuals who want sync without a SaaS vault
- Teams that need shared collections but keep crypto on clients
- Developers already running PostgreSQL and comfortable with Compose
You do not need to self-host to use OpenKey locally. You self-host when you want your sync plane — with ciphertext-only storage as the hard rule.
Next steps
- Self-hosted password manager — the operational side: hardening, backups, and when it is not worth it
- Server setup — install, configure, and link clients
- Using the app — vault workflows, Nearby, import/export
- Security — hardening checklist and threat model
- Overview — packages and the zero-knowledge model