XDA’s Karan Singh made the case that the $15 Raspberry Pi Zero 2 W is enough hardware to host a surprising amount, once the household stops thinking of it as “too weak to be a real server” and starts thinking of it as a subscription killer. The trick is picking apps that fit inside 512 MB of RAM without complaint. Seven of them do, and together they replace a password manager, a PDF editor, an ad-blocker, a file utility set, and a remote access tunnel. Here’s the stack, tested.
What to look for in a Pi Zero 2 W app
The Pi Zero 2 W has a quad-core ARM Cortex-A53 at 1 GHz and 512 MB of RAM. That’s less than a modern browser tab. An app fits comfortably on this hardware only if it hits three marks:
- Idle memory footprint under 60 MB. Everything else eats into the OS’s working set.
- No heavy database. SQLite is fine. Postgres is not.
- Client-side heavy lifting. If compression or OCR happens in the browser, the Pi is a request router, not a compute node.
Two other pieces matter for a household:
- A remote-access tunnel (Tailscale) so nothing is exposed to the public internet.
- A slim OS (DietPi) that removes anything the Pi Zero can’t afford.
Nothing below breaks these rules.
Quick comparison
| App | Best for | Platforms | Free | Standout |
|---|---|---|---|---|
| Vaultwarden | Bitwarden-compatible password vault | Docker | Free | Runs at 30–40 MB idle, works with every Bitwarden client |
| BentoPDF | Client-side PDF editing | Docker | Free | All processing in the browser, no Pi CPU load |
| OmniTools | Local utility suite (image, PDF, text) | Docker | Free | 200+ tools, everything runs client-side |
| Pi-hole | Network-wide ad blocking | Bare install or Docker | Free | Classic DNS sinkhole, Pi Zero handles it fine |
| AdGuard Home | Ad blocking with a modern UI | Bare install or Docker | Free | Better UI, DoH/DoT out of the box |
| Tailscale | Remote access without port forwarding | Bare install | Free tier | Zero-config VPN mesh, 3 users free |
| DietPi | Slim Debian base for the Pi Zero | OS image | Free | Trimmed OS, one-menu app installer |
The apps
1. Vaultwarden, best password manager for the Pi Zero
Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. It talks to every Bitwarden client (browser extensions, mobile apps, desktop apps) with no changes on the client side, but it idles under 40 MB of RAM on the Pi Zero 2 W. XDA’s writeup says Vaultwarden has been the anchor tenant on their Pi Zero for over a year without incident.
Where it falls short: Vaultwarden is not officially Bitwarden. Bitwarden Inc. can change the client protocol at any time, and while dani-garcia has kept up for years, that risk exists.
Pricing:
- Free: Yes, open source
- Paid: N/A
Platforms: Docker container, runs on any Linux ARM board
Download: GitHub (dani-garcia/vaultwarden)
Bottom line: Start the Pi Zero here. It replaces a paid password manager cleanly.
2. BentoPDF, best PDF editor
BentoPDF is a self-hosted PDF editor that does all its work in the browser. The Pi Zero acts as a static asset server, and the browser tab does the compression, merging, splitting, form-filling, and OCR. XDA’s writer specifically flagged it as their Adobe Acrobat subscription killer.
Where it falls short: The client-side model needs a modern browser. Old smartphones and low-power laptops can stall on large PDFs.
Pricing:
- Free: Yes, open source
- Paid: N/A
Platforms: Docker container
Download: GitHub (Bento-project/BentoPDF)
Bottom line: The right PDF tool for a Pi Zero. Nothing on the server does any real work.
3. OmniTools, best local utility suite
OmniTools is 200+ small utilities (image resize, format conversion, batch rename, text case swap, QR code generator, hash comparison, and so on) served from one static site. Like BentoPDF, everything runs in the browser, so the Pi Zero stays light while the utilities feel snappy.
Where it falls short: Not every utility works offline in every browser. The odd tool needs a JavaScript feature Safari lags on.
Pricing:
- Free: Yes, open source
- Paid: N/A
Platforms: Docker container
Download: GitHub (iib0011/omni-tools)
Bottom line: The right pick for anyone who currently opens seven different websites for one-off conversions.
4. Pi-hole, best network-wide ad blocker (classic)
Pi-hole is the reason the Raspberry Pi Foundation added “Pi” to the “sinkhole.” It runs a DNS server on the Pi, adds ad and tracker blocklists, and drops any request that matches. Point a router’s DNS to the Pi, and every phone, TV, and laptop on the network stops seeing ads without installing anything on the client side. On the Pi Zero 2 W, Pi-hole idles under 30 MB.
Where it falls short: The admin UI still shows its 2014 lineage. The gravity update process (blocklist refresh) briefly spikes CPU on the Pi Zero.
Pricing:
- Free: Yes, open source
- Paid: N/A
Platforms: Bare install (recommended on Pi Zero) or Docker
Download: pi-hole.net
Bottom line: The default DNS-based ad blocker. Everybody knows it, everybody uses it.
5. AdGuard Home, best DNS blocker with a modern UI
AdGuard Home is Pi-hole’s more polished competitor. Same DNS sinkhole concept, but with DNS-over-HTTPS and DNS-over-TLS out of the box, a cleaner dashboard, and per-client blocklist rules. On the Pi Zero, AdGuard Home lands at roughly the same idle footprint as Pi-hole and is a matter of taste.
Where it falls short: Blocklist scene community has more overlap with Pi-hole. Some Pi-hole-only lists don’t format cleanly on AdGuard Home.
Pricing:
- Free: Yes, open source (separate from AdGuard’s commercial browser extension)
- Paid: N/A
Platforms: Bare install or Docker
Download: GitHub (AdguardTeam/AdGuardHome)
Bottom line: Pick this instead of Pi-hole if the built-in DoH support is a deciding factor.
6. Tailscale, best remote access
Tailscale is the piece that makes everything above safely accessible from outside the home network. It builds a private WireGuard mesh across every device signed into the same account, so a phone on cellular can hit the Pi Zero’s Vaultwarden without a port ever being open to the public internet. The Pi Zero runs the Tailscale client at ~15 MB idle.
Where it falls short: The free tier is capped at three users and 100 devices. That’s fine for a household, tight for a small team.
Pricing:
- Free: Personal plan (3 users, 100 devices)
- Paid: Around $6 per user per month for the Team plan
- Note: Headscale is an open-source Tailscale coordination server for households that want zero external accounts
Platforms: Bare install (recommended)
Download: tailscale.com/download
Bottom line: Install this before exposing anything else. It’s the one moving part that keeps the Pi Zero off the public internet.
7. DietPi, best OS base for the Pi Zero
DietPi is a Debian-based minimal image built for small ARM boards. It ships with a menu-driven app installer that pre-configures Pi-hole, AdGuard Home, Vaultwarden, and Tailscale, and it strips out desktop packages the Pi Zero can’t afford to run anyway. XDA’s writeup runs on DietPi specifically.
Where it falls short: DietPi’s own menu experience is text-based and unfamiliar for first-time self-hosters.
Pricing:
- Free: Yes, open source
- Paid: N/A
Platforms: OS image (SD card flash)
Download: dietpi.com
Bottom line: Flash this instead of Raspberry Pi OS Lite. The Pi Zero has enough RAM back after the swap to run one extra service.
How to pick the right stack
For a first-time self-hoster: DietPi as the base, Vaultwarden for passwords, Pi-hole for ads, Tailscale for remote access. Four apps, one Pi.
For a household already running Bitwarden’s cloud tier: swap Vaultwarden in and cancel the subscription. Save the ~$40/year, use the Pi Zero’s remaining RAM for BentoPDF.
For an Adobe Acrobat subscriber: BentoPDF and OmniTools replace 90% of the usage. The Pi Zero handles the traffic because the client browser does the work.
For a homelab that already runs Pi-hole on a bigger Pi: skip Pi-hole on the Zero and use the RAM for Vaultwarden and BentoPDF instead.
Skip stacking every app in this list. The Pi Zero can hold four of them at once comfortably, five with tuning, six only if two are DNS-only. Try five and monitor RAM. Add a swap file only as a last resort.
FAQ
Is the Raspberry Pi Zero 2 W really enough to self-host?
Yes, for the specific apps in this article. It has a 1 GHz quad-core ARM chip and 512 MB of RAM. That’s plenty for DNS filtering, a password vault, and browser-heavy tools. It’s not enough for a full media server or a Postgres-backed app like Nextcloud.
Can I run all seven of these apps at once?
No. The Pi Zero 2 W’s 512 MB RAM ceiling caps a comfortable stack at four to five idle services. Two DNS filters at the same time is redundant. Two ad blockers at the same time is also redundant.
Do I need to open ports on my router?
No, and you shouldn’t. Tailscale makes the Pi reachable over a private mesh network without a single public port. That’s the recommended pattern in 2026.
What's the cheapest way to power a Pi Zero 24/7?
The Pi Zero 2 W draws under 2 W idle. At typical residential electricity rates, that’s less than $3 per year. It costs less to run than most kitchen appliances on standby.
Is DietPi worth it over Raspberry Pi OS Lite?
On the Pi Zero 2 W, yes. DietPi’s minimal image saves 50 to 80 MB of RAM at idle, which is the difference between running four services and running five. On a Pi 4 or Pi 5, the difference matters less.
