Self-hosted password manager
Your passwords, on your server.
DreyVault is a password manager you run yourself, at home or on a small cloud server. One command sets it up with HTTPS, backups run on their own, and your vault stays safe even if the server is ever compromised.
Firefox (desktop and Android), Chrome, Edge and an Android app, plus a web vault for any browser.
Why host it yourself
Easy to install
One command asks a few questions, picks secure defaults, sets up HTTPS (Cloudflare Tunnel, Tailscale, Let's Encrypt or home-network only) and starts the server. Also on Umbrel, CasaOS, Unraid and TrueNAS.
Backups built in
Nightly encrypted backups to the server's disk, S3/R2, WebDAV, Google Drive or Dropbox. The server test-restores the latest backup every week and shows when it last passed.
Safe even from the server
Everything is encrypted on your devices before upload, and every change is signed. A hacked server can't read your vault, and your devices notice if it tampers with it.
How a signed vault protects you
Most password managers encrypt your data, so a server can't read it. DreyVault also stops a server from quietly changing it: deleting an item, swapping in an old password, or rolling the whole vault back to last month.
1 · On your device
Encrypt and list
Your master password unlocks keys that never leave your devices. Each item is encrypted, and your device keeps a list of every item and its version.
2 · Every change
Sign and count
That list (the manifest) is signed with your personal key and gets a higher number on every change. The server stores it but can't forge your signature.
3 · Every sync
Check everything
Your devices verify the signature, refuse an older number than they've already seen, and check that each item matches the list. Anything off is reported as tampering.
Devices also refuse weakened password-hashing settings, and they ignore public keys sent by the server, deriving their own instead. Security model
Everything you expect
- Autofill button on login and one-time-code fields, with a picker when several logins match
- Save and update prompt after you sign in, including two-step logins
- Live two-factor (TOTP) codes with one-tap fill
- Password generator, strength meter and duplicate warnings
- Breach alerts for your email addresses and passwords (Have I Been Pwned)
- Email aliases from the generator
- File attachments and item history
- Send links: share a secret or file that expires, end-to-end encrypted
- Sign in with a fingerprint or face (WebAuthn), plus TOTP or security-key 2FA
- Device list with remote sign-out, travel mode
- Admin panel: invites, signup control, server health, backups
- Any number of independent accounts on one server; no telemetry
How it compares
| Capability | DreyVault | Vaultwarden | KeePassXC | Hosted services |
|---|---|---|---|---|
| Your data on your own hardware | Yes | Yes | Yes (a file) | No |
| Sync server included | Yes | Yes | No, bring your own file sync | Yes (theirs) |
| Guided installer with HTTPS | Yes | Manual setup | Not applicable | Not applicable |
| Scheduled encrypted backups with restore tests | Built in | Do it yourself | Do it yourself | Managed by the provider |
| Signed vault manifest (detects a tampering server) | Yes | No | Not applicable | You trust the provider |
| Browser autofill extension | Yes | Yes (Bitwarden clients) | Yes, with the desktop app running | Yes |
| Firefox for Android | Yes | Yes | No | Varies |
Get started
- Run the server. On any machine with Docker:
curl -fsSL https://dreyvault.abhishekm.work/install.sh | sh. Other ways - Create your account. The first account becomes the admin. Set a backup passphrase in Admin → Backups.
- Install the extension or Android app and point it at your server. Download