In short
A self-hosted password manager runs on your own servers; a cloud one is run by the vendor, with vaults encrypted on each device. Keeper, 1Password, NordPass and LastPass all offer European hosting in the cloud, and Forever Systems can quote and set them up. Bitwarden Enterprise and Self-Managed Keeper cover on-premises needs.
Want help weighing up hosting?
Tell us about your users, systems and data location requirements and we can talk through the options with you.
What self-hosting a password manager means
With a cloud password manager, the vendor runs the servers, the database, the backups and the updates, and your staff connect to its service. With a self-hosted password manager, your organisation installs the vendor's server software on infrastructure it controls, such as a virtual machine in your own data centre or private cloud, and runs it from then on.
Bitwarden describes the difference plainly. Its cloud is delivered "via a multi-tenant SaaS model", while "for some customers, preference, regulatory and compliance needs, or security policies require that platforms like Bitwarden be deployed in-house instead of using a cloud-hosted model" (Bitwarden (opens in a new tab)). Keeper makes the same distinction for Self-Managed Keeper, which "runs on your environment; Keeper Cloud runs on Keeper-managed infrastructure" (Keeper (opens in a new tab)).
One point is easy to miss. The password managers on this page are all zero-knowledge designs: vaults are encrypted and decrypted on each user's device, so a cloud vendor holds only encrypted data it cannot read. Keeper says the same holds for its self-hosted product: "Keeper does not have access to your credentials or vault data, whether the platform is cloud-hosted or self-managed" (Keeper (opens in a new tab)). Self-hosting therefore changes where the encrypted data lives, who keeps the service running and whether it depends on the internet, rather than who can read the passwords. Our guide to whether password managers are safe explains the encryption models in more depth.
The trade-offs, side by side
What changes when you move the server from the vendor's cloud to your own infrastructure:
| Area | Zero-knowledge cloud vault | Self-hosted server |
|---|---|---|
| Data location | Chosen at set-up from the vendor's regions (for example Europe); the vendor runs the data centres | Your own servers, private cloud or isolated network, under your control |
| Patching and updates | The vendor updates the service | Your team applies each release. Bitwarden says it is "critically important to keep your self-hosted Bitwarden instance up to date" and that self-hosted releases "lag several days behind cloud server releases" (Bitwarden (opens in a new tab)) |
| Backups and disaster recovery | The vendor backs up and replicates data; LastPass, for example, describes backups at 24-hour and seven-day intervals kept for 18 months (LastPass (opens in a new tab)) | Yours to design and test. Bitwarden: "you are responsible for implementing your own backup procedures", including configuration and certificate data (Bitwarden (opens in a new tab)) |
| High availability | Run by the vendor; Keeper describes multi-zone and multi-region environments (Keeper (opens in a new tab)) | Your architecture. Bitwarden recommends its Helm (Kubernetes) deployment for high availability (Bitwarden (opens in a new tab)) |
| TLS certificates and email | Handled by the vendor | Yours: a Let's Encrypt certificate needs inbound ports 80 and 443 open to the internet, or you supply your own (Bitwarden (opens in a new tab)), and the server needs an SMTP mail server for invitations and alerts (Bitwarden (opens in a new tab)) |
| Monitoring | The vendor monitors its platform | Your team monitors the server, database, disk space and certificate expiry |
| Staff time and skills | Administration through the admin console | Bitwarden rates its standard Linux deployment "Intermediate to advanced", for IT professionals and system administrators with Linux command-line, server management and SQL skills (Bitwarden (opens in a new tab)) |
| Compliance evidence | The vendor's published certifications (SOC 2, ISO 27001 and others) cover its own operation of the service | The vendor's audits cover its software; the controls around your server (access, patching, backups, monitoring) are yours to evidence |
| Internet dependence | The vault is reached through the vendor's service; LastPass, for example, says a user without an internet connection can still access a version of the encrypted vault cached on their device from their last login (LastPass (opens in a new tab)) | Can run inside an isolated network: Keeper says Self-Managed Keeper works with "zero connectivity to Keeper's cloud service" (Keeper (opens in a new tab)) |
If you are certified to Cyber Essentials, both routes are in scope. The v3.3 requirements (opens in a new tab) say "Cloud services cannot be excluded from scope", and a self-hosted server is an in-scope device whose software must be updated "within 14 days" of release when the vendor rates a fix as critical or high risk. Our sister site covers the Cyber Essentials password requirements (opens in a new tab) in detail.
Keeper sums up the balance in its own documentation: "Keeper's cloud platform remains the recommended deployment for most use cases", because it runs "without requiring your organization to host or patch the platform", with Self-Managed Keeper as "an alternative when hosting, isolation or operational requirements call for a deployment inside your own environment" (Keeper (opens in a new tab)).
Still deciding? Ask us
Tell us what your policies require and we can go through the options with you.
Which vendors offer self-hosting or a choice of region
How each vendor describes its hosting options for business customers:
| Vendor | Cloud data regions | Self-hosted or on-premises options |
|---|---|---|
| Keeper | A fully managed service on AWS; organisations host their tenant in a preferred primary region: United States, US Government Cloud, Europe (EU), Australia, Canada or Japan (Keeper (opens in a new tab)) | Self-Managed Keeper (opens in a new tab): a self-hosted, container-based deployment for on-premises, private cloud or air-gapped networks, licensed separately from Keeper's cloud platform. Separately, components such as the Active Directory Bridge and Keeper Connection Manager install on-premises, and SSO Connect and Keeper Automator come in cloud and on-premises versions (Keeper (opens in a new tab)) |
| 1Password | Accounts are created in one of three regions: 1Password.com (United States), 1Password.ca (Canada) or 1Password.eu (European Union); data "is never automatically moved from one region to another" (1Password (opens in a new tab)) | 1Password Connect servers run in your own infrastructure and cache vault data for your applications (1Password (opens in a new tab)); for 1Password Enterprise Password Manager, user provisioning can be hosted by 1Password, which 1Password says "removes the operational burden of self-hosting" (1Password (opens in a new tab)) |
| NordPass | Business organisations are created in a U.S. or EU data centre, chosen when you buy or start a business trial; an organisation cannot be migrated between data centres later (NordPass (opens in a new tab)) | A cloud service, with the data centre chosen at set-up |
| LastPass | Vault data is hosted in the United States by default, with Europe (AWS in Ireland, Germany and the United Kingdom), APAC and Canada hosting locations (LastPass sub-processors (opens in a new tab)); LastPass describes the region as "specifically elected by customer during account creation" (LastPass (opens in a new tab)) | A cloud service, with the hosting location set when the account is created |
| Bitwarden | United States and European Union cloud regions; an organisation "only exists in the region where it was first created" (Bitwarden (opens in a new tab)) | "Bitwarden's Enterprise plan includes self-hosting for no additional cost", on Linux or Windows with Docker, offline or air-gapped, or on Kubernetes with Helm (Bitwarden (opens in a new tab)) |
For most UK organisations the question is data location rather than hosting: all five offer a European option in the cloud, so a requirement to keep data in Europe does not on its own mean running your own server. Whichever you choose, pick the region before you create the organisation, because NordPass, 1Password and Bitwarden each say the region cannot simply be changed afterwards.
Each vendor page has the detail: Keeper, 1Password, NordPass and LastPass. For Bitwarden's plans beside each of the four, see Keeper vs Bitwarden, 1Password vs Bitwarden, NordPass vs Bitwarden and LastPass vs Bitwarden.
What running Bitwarden on your own servers involves
Bitwarden publishes the most detail on self-hosting, so its documentation is a useful checklist of the work involved, whichever product you are considering:
- A licensed cloud organisation first. The subscription starts on a Bitwarden cloud server, and a licence file is then uploaded to the self-hosted server (Bitwarden (opens in a new tab))
- A supported host. Docker on Linux or Windows; Bitwarden's Linux guide lists a minimum of a 1.4GHz x64 processor, 2GB RAM and 12GB storage, with 4GB RAM and 25GB recommended (Bitwarden (opens in a new tab)). The host platform must be under active mainstream support (Windows Server 2022 or later), and Docker Desktop on Windows may need a Docker licence (Bitwarden (opens in a new tab))
- A database. Deployments ship with an MSSQL Express image by default, or connect to an external MSSQL server or cluster of version 2019 or later (Bitwarden (opens in a new tab))
- Network rules. A standard server makes outbound connections for updates, push notifications to the apps and Families sponsorships; the offline guides avoid any outbound connection (Bitwarden (opens in a new tab))
- Single sign-on and keys. With login with SSO, Bitwarden says "your Identity Provider cannot and will not have access to the decryption key" (Bitwarden (opens in a new tab)). Organisations that want to serve the encryption keys from their own systems can use Key Connector, which itself needs a self-hosted Bitwarden server (Bitwarden (opens in a new tab))
- A tested restore. Nightly database backups run in the standard deployment, but Bitwarden advises backing up the whole data directory, including environment variables, attachments and data protection keys, for complete disaster recovery (Bitwarden (opens in a new tab))
None of this is unusual for an IT team that already runs Linux servers and containers. The question is whether a password manager, which every member of staff depends on to sign in to everything else, is a service you want to run yourselves.
Cloud or your own servers?
We can talk through the trade-offs that matter for your organisation.
Choosing: a decision table
Match your requirements to the hosting model that meets them:
| If your organisation needs | Cloud vault | Self-hosted |
|---|---|---|
| Data held in Europe | Meets it: choose the Europe region at set-up (Keeper EU, 1Password.eu, NordPass EU data centre, LastPass Europe, Bitwarden EU) | Also meets it, with more work |
| No dependence on the internet, or an air-gapped or OT network | Does not fit an isolated network | Self-Managed Keeper or a Bitwarden offline deployment |
| Encryption keys served from your own systems with SSO | Zero knowledge already keeps keys away from the vendor | Bitwarden Key Connector, on a self-hosted server |
| A small IT team with no out-of-hours server cover | Fits: the vendor runs updates, backups and uptime | Plan for patching, monitoring and restores |
| High availability across sites | Run by the vendor across zones and regions | Your design, such as Bitwarden on Kubernetes with Helm |
| Audit evidence with little extra effort | The vendor's SOC 2 and ISO 27001 reports, plus your admin settings | Your own server controls, plus the vendor's software audits |
| Fast access to new features | Updates arrive in the service | Bitwarden notes self-hosted releases lag the cloud by several days |
Many organisations settle on the cloud with a European region for staff, and keep self-hosting for the narrow cases that need it. Keeper describes that pattern: "Organizations can use Keeper Cloud for corporate IT and Self-Managed Keeper for OT or restricted networks", each as an independent tenant.
How we can help
We can quote the business plans of Keeper, 1Password, NordPass and LastPass, and help you work out which hosting model and data region your policies call for. We can:
- Talk through your data location, availability and audit requirements, and match them to the plans and regions that meet them
- Set up the organisation in the right region from the start, with single sign-on, provisioning, policies and shared folders
- Help you move passwords from a self-hosted server, browsers or spreadsheets into the new vault
- Quote the licences, which can be billed monthly, with the plan, region and terms confirmed at quote
Contact us for free advice or a quote. The enterprise password manager guide covers SSO, SCIM and audit at scale, and switching password manager covers export and import.
Frequently asked questions
Is a self-hosted password manager more secure than a cloud one?
Not by itself. Keeper, 1Password, NordPass, LastPass and Bitwarden are zero-knowledge designs, so the vendor stores only encrypted vaults it cannot read. Self-hosting moves that encrypted data onto your own servers and makes your team responsible for patching, backups, certificates and monitoring. It suits organisations that must keep data inside their own network or run without the internet; for most, a cloud vault in a European region meets the same data location requirement with less work.
Can Bitwarden be self-hosted?
Yes. Bitwarden says its "Enterprise plan includes self-hosting for no additional cost", using Docker on Linux or Windows, offline or air-gapped deployments, or Kubernetes with Helm (Bitwarden (opens in a new tab)). The subscription starts in the Bitwarden cloud and a licence file is uploaded to your server, and Bitwarden says you are responsible for your own backups (Bitwarden (opens in a new tab)).
Do Keeper, 1Password, NordPass and LastPass have self-hosted versions?
Keeper sells Self-Managed Keeper, a self-hosted deployment for on-premises, private cloud and air-gapped networks, licensed separately from its cloud platform (Keeper (opens in a new tab)). 1Password, NordPass and LastPass describe cloud services with a choice of region: 1Password in the US, Canada or the EU, NordPass in a U.S. or EU data centre, and LastPass with US, Europe, APAC and Canada hosting locations. 1Password Connect servers do run in your own infrastructure, to give your applications access to vault items.
Can we keep our password manager data in the UK or EU?
Yes, in Europe. Keeper offers a Europe (EU) region, 1Password has 1Password.eu, NordPass offers an EU data centre for business organisations and Bitwarden has an EU cloud. LastPass's Europe hosting location runs on AWS in Ireland, Germany and the United Kingdom (LastPass (opens in a new tab)). Choose the region when the account is created, because moving later usually means a new organisation.
Are unofficial Bitwarden-compatible servers supported?
Not fully. Bitwarden's hosting FAQ says that "Bitwarden cannot guarantee that official clients will work perfectly with non-official servers" and that its support "may be limited" for client issues on them (Bitwarden (opens in a new tab)). Bitwarden's own self-hosted server, which it does support, comes with its Enterprise plan.
Can we move from a self-hosted server to a cloud vault later?
Yes. Export the vault from the self-hosted server (Bitwarden exports to .json, .csv or an encrypted .json file), set up the new organisation in the region you want, import, check a sample of items, then delete the export file. Shared collections are best recreated once by an administrator. Our switching guide covers each vendor's import steps.
Still deciding?
Ask us and a member of our team will get back to you.