Leaving

You can download your data at any time and run it yourself with a stock docker run. This page is the whole procedure. It is worth trying once before you need it.

Download your data

Log in to the portal and choose "Download data". You are asked for your password and a code.
The instance is paused for the moment it takes to copy the data directory.
You get an email when the archive is ready. The download link is in the portal, and the archive is kept for a day.

Downloading works while the subscription is active, while a payment is overdue, and for 30 days after the vault has been stopped. It changes nothing about your subscription.

What is in the archive

libreyard-NAME-YYYYMMDD.tar.gz holds one directory named after your instance, with a README and the data directory Vaultwarden wrote:

Path	What it is
`README.txt`	The upstream image Libreyard ran, by digest, and the command to run it
`data/db.sqlite3`	The database: accounts, encrypted vault items, organisations
`data/db.sqlite3-wal`, `-shm`	Parts of the database, if present. Keep them beside `db.sqlite3`
`data/rsa_key.pem`	The key that signs logins. Keeping it keeps devices logged in
`data/attachments/`, `data/sends/`	Files, encrypted
`data/config.json`	Settings changed on the admin page, if any
`data/icon_cache/`	Website icons. Safe to delete

Libreyard's admin token is not in it.

Run it yourself

You need a machine with Docker, a domain name, and a reverse proxy that can get a TLS certificate. The README in your archive has these steps with your own values filled in.

Unpack the archive and move data to where it should live.

tar -xzf libreyard-NAME-YYYYMMDD.tar.gz
sudo mkdir -p /srv/vaultwarden
sudo mv NAME/data /srv/vaultwarden/data

Start the image named in the README, with that directory mounted at /data. Replace IMAGE with the line from the README, which looks like vaultwarden/server@sha256:….

docker run -d --name vaultwarden --restart unless-stopped \
    -v /srv/vaultwarden/data:/data \
    -p 127.0.0.1:8080:80 \
    -e DOMAIN=https://vault.example.com \
    -e SIGNUPS_ALLOWED=false \
    -e INVITATIONS_ALLOWED=true \
    -e ADMIN_TOKEN='choose-a-long-random-string' \
    IMAGE

It has to be a bind mount of that directory. A volume Docker creates by itself would start empty.

Put a reverse proxy with a TLS certificate in front of 127.0.0.1:8080. Bitwarden clients need HTTPS.
In each client, log out, set the server to the new address, and log in again.

Notes

ADMIN_TOKEN opens /admin. Leave the line out to turn the admin page off.
If data/config.json exists, it overrides the -e settings, and its domain still names the Libreyard address. Change it on the admin page or delete the file.
A newer Vaultwarden release reads this data and upgrades the database when it starts. An older one may not.

Libreyard's test suite does this on every run: it downloads an archive through the portal, starts a plain Vaultwarden on it, and checks that the accounts are there and that Libreyard's admin token does not open it.

If Libreyard disappears

Every logged-in client keeps an offline copy of the vault. You can still read it, and export it to a file, but not sync or edit. With an archive, follow run it yourself and import anything newer from a client's export. Without one, export from each client, start an empty Vaultwarden, and import.

So download an archive now and then, and keep it somewhere other than Libreyard.

What is deleted when you leave

When the 30 days after a subscription end are over, or when you delete a vault or close your account, the data directory is deleted and you get an email saying so. What is kept is in the privacy policy.