Getting started
From sign-up to a working vault on every device.
1. Sign up
- Go to sign-up. Give an email address and a password for the portal, and agree to the terms of service. The account is free.
- Confirm your email address with the link you are sent, then log in.
- Set up two-factor login. The portal asks for this at the first login, and shows your recovery codes once. See two-factor login on the portal.
- On the dashboard, choose "Create a vault" and give it a name. The name becomes your vault's address:
https://NAME.libreyard.app. - Start the 30-day free trial, which asks for no card, or pay for the first year at Stripe Checkout. The portal shows the address of your vault once it is ready, usually within seconds. You also get an email.
The portal account is for billing and for managing your instances. It is not a Vaultwarden account, and its password is not your master password. One account can hold up to five vaults, each with its own subscription.
2. Create the first Vaultwarden account
Your instance starts with no accounts and with open sign-up switched off. So the first account is created by inviting yourself.
- In the portal, open "admin token". You are asked for your password and a fresh code. Copy the token.
- Open
https://NAME.libreyard.app/admin, enter the token, and under Users invite your own email address. - Open
https://NAME.libreyard.appand create your account with that same address.
No invitation email is sent. Inviting an address is what allows it to register.
Your master password cannot be recovered by Libreyard. It never leaves your devices. If you forget it, the vault is unreadable to everyone, including you.
The account creation form ticks "Check known data breaches" by default. That makes your browser contact an external service. Untick it if you do not want that.
3. Connect the clients
Use the official Bitwarden clients, from Bitwarden's own download page or your app store. Each one has to be told to use your server instead of Bitwarden's.
| Client | Where to set the server |
|---|---|
| Browser extension | On the login screen, change the server selector to "Self-hosted" and enter your vault's address as the server URL. |
| Desktop app | The same: "Self-hosted" on the login screen. |
| Mobile app | The same: "Self-hosted" on the login screen. |
| Command line | bw config server https://NAME.libreyard.app, then bw login. |
| Web vault | Nothing to set. It is served at your vault's address. |
Set the server before logging in. A client that is already logged in to another server has to be logged out first. Bitwarden's own instructions, with screenshots, are in its help pages.
For everyday use, prefer the apps and extensions to the web vault. Why.
Things you may notice
- The first request after a quiet period. Your instance is stopped when idle and started by the next request. See how it works.
- Mobile sync. Push notifications to the mobile apps are not set up. The mobile apps sync when they are opened, or when you sync by hand.
4. The admin page and its token
The admin page at /admin is Vaultwarden's own. It manages users, invitations and settings. It cannot show anyone's vault.
- The token is shown in the portal, as often as you ask, behind a fresh login. Each showing is logged.
- If you change the token on the admin page itself, the portal keeps showing the old one, which no longer works.
- Settings saved on the admin page override the ones Libreyard provides. Do not change the domain, the data paths or the database settings: these can stop the instance from working here.
- "Reset app configuration" in the portal removes everything changed on the admin page and restarts the instance with Libreyard's defaults. It brings back the portal's token. It does not touch accounts or vaults.
Next
- Import from another password manager
- Invite family members
- Download an archive, and keep it somewhere else
Next: Importing