A recent XDA piece walks through moving passwords, 2FA seeds, and passkeys onto a self-hosted Vaultwarden instance running on a tiny Pi. It works, and the official Bitwarden Android client talks to it out of the box. The catch is that Vaultwarden asks a lot of the household admin: a server to maintain, backups to schedule, a domain and TLS to keep fresh. Not every Android user wants that. These are the seven Vaultwarden alternatives we recommend when the phone matters more than the server, ranked for real Android use with autofill, biometric unlock, and Google Play protection turned on.
Quick comparison
| App | Best for | Free plan | Starting price/mo | Standout feature |
|---|---|---|---|---|
| Bitwarden | Same clients as Vaultwarden, no server to run | Yes, unlimited devices | Around $0.83/mo (Premium) | Official Android client, passkeys, TOTP |
| KeePassDX | Local file, no sync required | Yes, fully | Free | Reads standard .kdbx via Syncthing or Nextcloud |
| Proton Pass | Sealed vault with email aliases | Yes, unlimited | Around $1.99/mo | Hide-my-email aliases powered by SimpleLogin |
| 1Password | Family UX on Android | 14-day trial | Around $2.99/mo | Travel Mode and Watchtower alerts |
| Enpass | Bring-your-own cloud | Free up to 25 items | Around $1.99/mo | Sync via Dropbox, WebDAV, Nextcloud |
| Ente Auth | Free open-source 2FA vault | Yes, unlimited | Free | End-to-end encrypted TOTP sync |
| Keepass2Android | KeePass with wide cloud support | Yes, fully | Free | Works with WebDAV, SFTP, Nextcloud out of the box |
Why people leave Vaultwarden
Three reasons come up over and over on r/selfhosted and the Vaultwarden GitHub issues:
- Someone still has to run the box. A Raspberry Pi 4 is quiet, but the person who set it up is also the person who fixes it at 2am.
- Bus factor. Vaultwarden is essentially maintained by one person, Daniel García. That is fine for many households and terrifying for others.
- Android autofill trips. The Bitwarden Android client is excellent, but pointing it at a self-hosted instance means editing the server URL and eating any TLS mistakes yourself.
None of these are dealbreakers for a self-hoster. All of them nudge people toward a managed alternative or a purely local vault.
The 7 Vaultwarden alternatives on Android
1. Bitwarden, best for the official stack
Bitwarden is the paved road: same Android app, same browser extensions, same autofill flow as Vaultwarden, but the servers are Bitwarden’s problem. The free tier covers unlimited devices, unlimited passwords, passkey storage, and TOTP generation. Bitwarden vs Vaultwarden in 2026: identical client experience on Android, opposite operational surface.
Where it falls short: the free tier’s TOTP support is limited to the mobile app; you need Premium to have TOTP codes autofill on desktop browsers. The UI can feel dated next to 1Password.
Pricing:
- Free: unlimited passwords and devices.
- Paid: Premium around ten dollars a year, Families around forty dollars a year for six people.
- vs Vaultwarden: both free for individuals. Bitwarden bills for features Vaultwarden gives away because Bitwarden pays engineers.
Migrating from Vaultwarden: export encrypted JSON from Vaultwarden’s web UI, then import into the Bitwarden app. Folder structure, TOTP seeds, custom fields, and attachments all transfer. Passkeys have to be re-registered per site.
Download: Aptoide · Google Play
Bottom line: pick this when you like everything about Vaultwarden except the part where you have to keep it running.
2. KeePassDX, best for no-server file vaults
KeePassDX is a native Android client for the standard .kdbx format. Pair it with Syncthing, Nextcloud, or Google Drive and the vault file syncs like any other. Autofill works, biometric unlock works, and the app never phones home. KeePassDX vs Vaultwarden in 2026: opposite philosophies. Vaultwarden runs a server so multiple devices stay in sync automatically; KeePassDX punts sync to a file provider you already trust.
Where it falls short: conflict resolution is the user’s job. Two devices editing the vault offline will produce two divergent files, and merging them is manual. No browser extension, only system autofill.
Pricing:
- Free: everything, on GitHub and F-Droid.
- Paid: a one-time donation unlocks cosmetics; nothing functional is locked.
- vs Vaultwarden: both free. KeePassDX removes the server from the equation entirely.
Migrating from Vaultwarden: export Vaultwarden to encrypted JSON, then run KeeWeb (desktop) or the community bitwarden-to-keepass script to convert to .kdbx. Custom fields transfer; attachments come along as file entries.
Download: Aptoide · Google Play · F-Droid
Bottom line: pick this when you already run Syncthing or Nextcloud and want your vault to be a file inside them.
3. Proton Pass, best for privacy-conscious households
Proton Pass is the newest of the big-name managers, from the same company that runs Proton Mail and Proton VPN. The Android app supports passkeys, TOTP, credit cards, and one differentiator worth calling out: hide-my-email aliases powered by SimpleLogin. That single feature reshapes how you sign up for accounts. Proton Pass vs Vaultwarden in 2026: no server to run, plus alias generation Vaultwarden simply does not do.
Where it falls short: no export to Bitwarden’s JSON format; only CSV. That makes round-tripping messier. The desktop apps for Windows and macOS are still catching up.
Pricing:
- Free: unlimited passwords, ten aliases.
- Paid: Pass Plus around two dollars a month on annual, included with Proton Unlimited.
- vs Vaultwarden: both free for the basics. Proton Pass charges for what most people actually want it for, aliases.
Migrating from Vaultwarden: export Vaultwarden to CSV, then import into Proton Pass. TOTP secrets transfer if you use the “Bitwarden JSON” importer via Proton’s desktop tool. Passkeys have to be re-registered.
Download: Aptoide · Google Play
Bottom line: pick this when hide-my-email aliases would change how you sign up for accounts.
4. 1Password, best for family UX on Android
1Password has the most polished Android app in the space, with the widest Watchtower breach alert coverage and the cleanest passkey UI. Travel Mode lets you hide sensitive vaults when crossing borders. Family plans genuinely work for non-technical relatives. 1Password vs Vaultwarden in 2026: an opposite bet, prioritising family adoption over self-hosting purity.
Where it falls short: no free tier, and no self-hosting story. Business admins looking for on-prem storage will have to stay on Bitwarden or Vaultwarden.
Pricing:
- Free: 14-day trial only.
- Paid: Individual around three dollars a month, Families around five dollars a month for five people.
- vs Vaultwarden: Vaultwarden wins on price. 1Password wins on family adoption.
Migrating from Vaultwarden: 1Password imports Bitwarden’s encrypted JSON directly from the desktop app. Folders become tags. Watchtower runs a breach scan during the import; expect a few “please rotate” notifications the first day.
Download: Aptoide · Google Play
Bottom line: pick this when the household includes someone who will not use a password manager unless it feels great on their phone.
5. Enpass, best for bring-your-own-cloud
Enpass stores the vault locally and syncs through your existing account with Dropbox, Google Drive, OneDrive, iCloud, Nextcloud, or a raw WebDAV endpoint. The Android app supports biometric unlock, passkeys, and system autofill. Enpass vs Vaultwarden in 2026: a middle ground with no server to run and no vendor cloud to trust.
Where it falls short: the free Android tier caps out at 25 items per vault. A one-time purchase or subscription lifts the cap. Sharing with family requires the paid Family plan.
Pricing:
- Free: 25 items per vault.
- Paid: Individual around two dollars a month, Family around three dollars a month, or a one-time lifetime license.
- vs Vaultwarden: Vaultwarden is cheaper if you already have the hardware; Enpass is cheaper if you count your evenings.
Migrating from Vaultwarden: export Vaultwarden to CSV. Enpass imports the CSV and offers a mapping wizard for custom fields. TOTP transfers if you tick the option in Vaultwarden’s export.
Download: Aptoide · Google Play
Bottom line: pick this when you already pay for Dropbox or Google One and don’t want another sync provider in the mix.
6. Ente Auth, best for the 2FA-only user
Ente Auth is a free, open-source TOTP vault from the team behind Ente Photos. It syncs 2FA secrets end-to-end encrypted, works on Android with biometric unlock, and imports directly from Google Authenticator, Authy, Aegis, and Raivo. If Vaultwarden’s role in your life is mostly holding 2FA codes, Ente Auth does that job on Android without the server.
Where it falls short: it only handles 2FA. Passwords still need another home. If Vaultwarden holds both, you’ll end up running two apps.
Pricing:
- Free: unlimited codes, unlimited devices.
- Paid: none for Auth. Ente Photos is the paid product.
- vs Vaultwarden: Ente Auth is free and requires no server; it just does less.
Migrating from Vaultwarden: export TOTP entries via the Bitwarden CLI, then use Ente Auth’s “import from Bitwarden JSON” flow. All otpauth:// URIs transfer.
Download: Aptoide · Google Play · F-Droid
Bottom line: pick this when you use a browser-based password manager on desktop and only need 2FA on the phone.
7. Keepass2Android, best for cloud-flexible KeePass
Keepass2Android is the other big KeePass Android client. It reads and writes .kdbx files from WebDAV, FTP, SFTP, Nextcloud, Dropbox, Google Drive, OneDrive, and local storage without any extra glue. The keyboard replacement lets you fill password fields in apps that reject accessibility-based autofill. Keepass2Android vs Vaultwarden in 2026: same anti-server philosophy as KeePassDX, but wired for more remote backends out of the box.
Where it falls short: UI is functional rather than fashionable. The offline-only build (Keepass2Android Offline on F-Droid) exists specifically to reassure paranoid users; the default build ships with Firebase and Google’s URL fetcher.
Pricing:
- Free: yes, GPL.
- Paid: none.
- vs Vaultwarden: both free. Keepass2Android has the widest sync-target list of any Android password client.
Migrating from Vaultwarden: convert Vaultwarden’s export to .kdbx using bitwarden-to-keepass. Attachments become file entries; TOTP transfers via the otpauth:// URI in each entry.
Download: Aptoide · Google Play · F-Droid
Bottom line: pick this when your KeePass file lives on WebDAV or SFTP and you want the client to talk directly to it.
How to choose
- Pick Bitwarden if you like the Vaultwarden experience but not the maintenance.
- Pick KeePassDX if you want to control the file and let Syncthing handle sync.
- Pick Proton Pass if hide-my-email aliases would change how you sign up for accounts.
- Pick 1Password if the household needs the smoothest Android UX and cost isn’t the constraint.
- Pick Enpass if your cloud is already Dropbox, iCloud, or Nextcloud.
- Pick Ente Auth if you only need TOTP on the phone.
- Pick Keepass2Android if you want direct KeePass-over-WebDAV without extra middleware.
- Stay on Vaultwarden if you already run a Pi, backups work, and low resource use matters more than dropping the maintenance load.
FAQ
Can the Bitwarden Android app connect to a Vaultwarden server?
Yes. In the Bitwarden app, tap the region selector on the login screen, choose “Self-hosted”, and paste your Vaultwarden URL. TLS must be valid; the app will not connect to a self-signed certificate without a system-level trust anchor.
What’s the best free Vaultwarden alternative for Android?
Bitwarden’s free tier covers the same feature surface for anyone who doesn’t want to run a server. If you’re allergic to the cloud, KeePassDX plus Syncthing is the free, no-server route.
Can I use Vaultwarden and another password manager at the same time?
Yes, but Android only lets one app be the default autofill provider. Most people pick the primary manager for autofill and keep the second in “manual copy” mode for edge cases like TOTP or archived credentials.
Do these alternatives support passkeys on Android?
Bitwarden, 1Password, Proton Pass, and Enpass support passkey storage and autofill through Android’s Credential Manager. KeePassDX and Keepass2Android read passkeys stored in .kdbx files but interoperability with browser flows lags the big three.
Is a self-hosted password manager more secure than a hosted one?
Not automatically. A well-maintained self-hosted instance can be more private, but it can also be less secure than a professionally-run cloud if backups, patching, and TLS are neglected. The security bar for a household is usually met by any of the audited hosted options on this list.
Can I self-host Bitwarden’s official server on a Raspberry Pi?
Technically yes, on a Pi 4 with 4 GB of RAM, but the full Bitwarden stack is heavier than Vaultwarden and the database will feel it under load. If Pi hosting is the goal, Vaultwarden or Padloc are the sensible picks.
