How to set up Vaultwarden

Published 11 May 2026 · Updated 31 July 2026 · SparkBox team

Private password manager. This guide covers how to access it, log in for the first time, configure the basics, and where its data lives so you can back it up.

1. What is Vaultwarden?

Self-hosted Bitwarden-compatible password manager. Store passwords, secure notes, and TOTP codes on your own NAS — works with the official Bitwarden browser extension and mobile apps.

2. Before you start

Two things to know. First: your vault starts with no account, and signup is switched OFF by default so nobody else can register on it — you turn Allow Signups ON in Settings → Apps → Vaultwarden to create yours, then switch it back OFF. See First login below. Second: the Bitwarden web vault (browser tab) requires HTTPS by browser policy. Use the Bitwarden BROWSER EXTENSION or MOBILE APP to access your vault over plain HTTP — they're exempt from the HTTPS gate. After install, see Settings → Passwords for the full access guide and admin token.

3. How to access it

Once it's enabled, Vaultwarden runs on your SparkBox at:

http://<your-NAS-IP>:8222

Web vault opens over HTTP only on localhost. For LAN access use the Bitwarden browser extension or mobile app (point them at this NAS:8222) — see Settings → Passwords.

4. First login

Step 1 — make your account first. A brand-new vault is empty: there is no account yet, and SparkBox ships with new-account signup switched OFF so that nobody else who can reach your box can register themselves on your vault. Tapping “Create account” in the Bitwarden app before you change that WILL be rejected. To create yours: in the dashboard go to Settings → Apps → Vaultwarden, switch Allow Signups ON and save (SparkBox restarts Vaultwarden for you, which takes a few seconds). Create your account — and one for your partner or anyone else you share with — using the connection options below. When everyone has an account, come back and switch Allow Signups back OFF. Rather not open it up even briefly? Open http://<your-NAS-IP>:8222/admin/ (that page does work on a plain HTTP address), sign in with the admin token, and use Invite User — an invited email address can register even while signups stay off.

Step 2 — reach your vault. Vaultwarden's WEB VAULT (browser tab) won't load over plain HTTP from a non-localhost browser — that's a browser-side WebCrypto / secure-context rule, not a Vaultwarden bug. THREE paths that work on a fresh install: (1) BROWSER EXTENSION — install the official Bitwarden extension (Chrome / Firefox / Edge / Safari), in Settings → Self-hosted, point Server URL at http://NAS-IP:8222, then log in with the account you made in step 1 (or create it here, if you switched Allow Signups on). The extension is exempt from the HTTPS rule. (2) MOBILE APP — install the Bitwarden iOS / Android app, choose 'Self-hosted', set Server URL the same way. Also exempt. (3) ENABLE HTTPS via the NPM (Nginx Proxy Manager) tile — set up a hostname like vault.your-domain.com, get a Let's Encrypt cert, point it at sb-vaultwarden:80; then the web vault loads. The admin token for the /admin panel is in state/vaultwarden-admin-password.txt and is shown below.

If it instead asks for a password you didn't set, check Settings → Passwords in your SparkBox dashboard — every auto-generated credential is listed there.

5. Settings you can change

You can set these when you enable the module, or later from Apps → Vaultwarden in the dashboard:

• Vault Admin Token — Configurable value.
• Allow Signups — OFF by default, so nobody else who can reach your box can register themselves on your vault. But a brand-new Vaultwarden has NO accounts at all — so you must turn this ON once to create your own account (and any for family), then turn it back OFF to lock the door behind you. Saving this restarts Vaultwarden so the change actually takes effect. Prefer to leave it OFF? Use the admin page instead: http://NAS-IP:8222/admin/ → Invite User. An invited address can still register while this stays OFF.
• Vault Domain — Configurable value.

6. Where your data lives

Vaultwarden's config and persistent data are stored on the SparkBox host under:

/opt/sparkbox/modules/vaultwarden/config/

Backups via the SparkBox dashboard's Backup tile include this directory by default, so a single restore brings Vaultwarden back to its current state on a fresh install.

Next steps