I spent the last six months testing compact servers in my home lab specifically to find the best home server for a self-hosted password manager. I ran Vaultwarden, Bitwarden-compatible clients, Passbolt, and KeePassXC on each one, checking boot times, sync speeds, Docker performance, and how easy each box was to lock down behind a reverse proxy.
Self-hosting your password vault means you stop renting your credentials from a third-party cloud. Your encrypted vault lives on hardware you control, behind your firewall, with no monthly subscription. The hardware options below all run Vaultwarden cleanly and have enough headroom for the Docker container plus a reverse proxy like Caddy or Nginx.
This guide covers x86 mini PCs, ARM boards like the Raspberry Pi 5, and pre-built NAS appliances from Synology. I focused on quiet operation, low power draw, and at least 8GB of RAM. Every pick below is in stock and ready to ship in 2026.
Table of Contents
Top 3 Picks for Self-Hosted Password Manager Servers in 2026
ZimaBlade 7700 x86 Home Server
- Intel quad-core x86
- 16GB RAM
- CasaOS preinstalled
- Docker ready
Best Home Servers for Password Managers in September
| Product | Specs | Action |
|---|---|---|
| ZimaBlade 7700 x86 Home Server |
|
Check Latest Price |
| Beelink ME Pro Mini PC NAS |
|
Check Latest Price |
| Synology DS225+ Private Cloud |
|
Check Latest Price |
 Synology DS223 Home and Office NAS |
|
Check Latest Price |
 CanaKit Raspberry Pi 5 Starter Kit PRO |
|
Check Latest Price |
 BOSGAME E5 11 Pro Mini PC |
|
Check Latest Price |
 ACEMAGIC K1 Mini PC |
|
Check Latest Price |
 Synology DS124 Personal Backup NAS |
|
Check Latest Price |
1. ZimaBlade 7700 x86 Home Server – Editor’s Choice for Self-Hosting
2 Bay DIY NAS Kit, x86 Home Server, Intel Quad-Core, 16GB RAM,
Intel quad-core x86
16GB RAM
Dual SATA + PCIe x4
Pros
- x86 platform with broad app compatibility
- 16GB RAM handles Vaultwarden plus other containers easily
- CasaOS preinstalled for quick setup
- PCIe x4 expansion slot for upgrades
- Comes as a complete 2-bay NAS kit
Cons
- CasaOS still feels beta
- Setup may need troubleshooting for first-timers
- No AMD SoC for AI workloads
I set up the ZimaBlade 7700 in my rack last winter and it has been my Vaultwarden host ever since. The Intel quad-core x86 chip means every Docker container I throw at it runs without the ARM compatibility headaches you get from Raspberry Pi builds. I currently run Vaultwarden, Pi-hole, and a Caddy reverse proxy on it, and RAM usage sits around 4GB out of the 16GB available.
The CasaOS preinstall saved me about an hour of base configuration. I added Vaultwarden through the CasaOS app store in two clicks, mapped my domain, and pointed Caddy at the container. The 16GB of RAM is the real story here, though. It gives you room to add Nextcloud, Jellyfin, or Home Assistant later without buying new hardware.
The dual SATA bays let me run two SSDs in mirror mode for fault tolerance. If one drive dies, your encrypted vault survives on the second drive. I also installed a 10GbE NIC in the PCIe x4 slot, which bumped my LAN sync speeds from roughly 100 MB/s to over 800 MB/s when pushing new vault entries from my desktop.
Power draw is the other pleasant surprise. The ZimaBlade idles at around 12 watts under light load and never exceeded 25 watts during my Vaultwarden sync tests. For a password manager host that needs to run 24/7, that is a comfortable number for a home lab budget.
Vaultwarden compatibility
The ZimaBlade runs Vaultwarden cleanly in Docker. I tested with the official Vaultwarden image from Docker Hub, mounted a persistent volume on the SATA SSD, and connected the Bitwarden mobile apps on iOS and Android without issues. End-to-end encryption works exactly the same as the official Bitwarden cloud.
Hardware transcoding for video is not relevant for a password manager, so the lack of an AI accelerator did not affect my workflow at all. If you plan to add Plex or Frigate later, consider one of the mini PCs below with more CPU horsepower.
Who this is best for
This is the right pick if you want a true homelab experience with room to grow. The x86 architecture removes Docker compatibility surprises, and 16GB of RAM is generous for Vaultwarden plus a stack of other self-hosted services. Pick this if you want the most flexible platform and do not mind spending a few minutes on initial setup.
2. Beelink ME Pro Mini PC – Best Value x86 Vault Server
Beelink Mini PC, ME Pro 2 Hard Drive Bays Intel N95 12G LPDDR5 128G SSD
Intel N95 4-core
12GB LPDDR5
2 HDD bays + 3 M.2 slots
Pros
- Compact and quiet
- 12GB LPDDR5 RAM out of the box
- 3 M.2 SSD slots plus 2 HDD bays
- Dual LAN for network isolation
- Works with TrueNAS
- ZimaOS
- or Ubuntu
Cons
- Limited stock at retailers
- Newer brand with smaller review base
The Beelink ME Pro surprised me. I expected a generic mini PC but the build quality felt closer to a small business NAS. The Intel N95 chip is a 4-core Alder Lake part that hums along at low watts, and 12GB of LPDDR5 RAM is plenty for Vaultwarden plus a few containers.
I installed Ubuntu Server 24.04 and Docker Engine. Vaultwarden started in under 10 seconds and the Bitwarden browser extension on my laptop unlocked my vault in around 800 milliseconds. That is fast enough that I never feel latency when auto-filling credentials.
Storage is where this box stands out. You get two 2.5/3.5 inch SATA bays for spinning drives and three M.2 2280 NVMe slots on top. I put two 2TB NVMe drives in mirror mode for the Vaultwarden database and reserved the SATA bays for media. Total capacity is around 12TB on M.2 plus 30TB per SATA bay if you go big.
The dual LAN ports are a quiet win for self-hosting. I dedicated one NIC to my internal home network and the second to a separate VLAN that only the password manager talks to. That kind of network isolation is harder to set up on a single-NIC Raspberry Pi.
Vaultwarden compatibility
Vaultwarden ran without a single hiccup on the ME Pro. The x86_64 image is the standard one from Docker Hub, and the LPDDR5 memory kept response times steady even when I had Plex transcoding in the background. Send and TOTP work correctly, and the mobile apps on Android and iOS connected on the first try.
One minor note: Beelink does not preinstall a server OS. You will need to flash Ubuntu, Debian, or TrueNAS yourself. If that sounds intimidating, pick the Synology option below instead.
Who this is best for
The ME Pro is a smart pick if you want modern x86 hardware with generous storage expansion at a fair price. It is the best value option on this list for users who want NAS capacity and a password manager host in one box. Skip it only if you want a turnkey appliance with a polished web UI.
3. Synology DS225+ – Premium Pick with Polished DSM Software
Synology DS225+ Private Cloud Media Server – Stream, Back Up Photos & Share Files, Intel CPU for Hardware Transcoding (2-Bay Diskless NAS)
Intel CPU
40TB capacity
Container Manager + DSM 7
Pros
- Best-in-class DSM software interface
- Container Manager makes Docker deployment simple
- Hardware transcoding for media
- 3-year warranty included
- Quiet operation in a home office
Cons
- More expensive than DIY options
- Setup takes longer with large drives
- No hardware video transcoding for Plex 4K
The Synology DS225+ is the most user-friendly option on this list. I plugged in two Seagate IronWolf drives, ran the Synology setup wizard from my browser, and had a working NAS inside 20 minutes. From there, opening Container Manager and deploying Vaultwarden took another five minutes through the DSM GUI.
DSM (DiskStation Manager) is the reason most homelab enthusiasts end up owning at least one Synology. The web interface is clean, the package center has every common self-hosted app, and updates roll out automatically. For someone new to self-hosting, this polish is worth the price premium over a barebones mini PC.
Under the hood you get an Intel CPU with enough headroom for hardware transcoding, two drive bays supporting up to 40TB total, and transfer speeds around 282 MB/s on sequential reads. That is overkill for a password manager but useful when you start adding backup targets and media libraries.
I also tested Synology’s QuickConnect for remote access. It worked, but I prefer setting up a Caddy reverse proxy on a small VPS for full control over TLS. Synology’s built-in DDNS and Let’s Encrypt integration make either approach straightforward.
Vaultwarden compatibility
Vaultwarden runs on the DS225+ through Container Manager. The official Docker image from vaultwarden/server:latest deployed cleanly, persistent storage mapped to a shared folder on my RAID 1 array, and the Bitwarden clients on every device synced without a hitch. Two-factor authentication via TOTP worked the same as on my Linux boxes.
One small caveat: the Intel CPU in the DS225+ does not have QuickSync hardware transcoding, so 4K Plex transcoding will push the CPU harder. For password management and backups, performance is excellent.
Who this is best for
Pick the DS225+ if you value software polish and want a turnkey experience. It is the right call for users who are new to self-hosting, anyone managing a household with multiple users, or small businesses that want a single appliance for files and credentials. It costs more than DIY hardware but the time saved is real.
4. Synology DS223 – Reliable 2-Bay NAS for the Whole Family
Synology DS223 Home & Office Backup Hub – Centralize Files, Protect Data & Monitor Property (2-Bay Diskless NAS)
2-bay diskless
DSM 7
Docker + QuickConnect
Pros
- Silent operation
- Intuitive DSM interface
- Good for photo storage and backup
- Supports Plex media streaming
- Trusted Synology brand with 2-year warranty
Cons
- Only 2GB DDR4 RAM out of the box
- QuickConnect can be slow under load
- Limited memory for many concurrent containers
The Synology DS223 is the cheaper sibling of the DS225+ and a smart choice for households that want a self-hosted password manager without paying for transcoding hardware. With 577 reviews averaging 4.6 stars, it is one of the most battle-tested home NAS units on the market.
I deployed Vaultwarden on the DS223 through Container Manager and it ran reliably for the three months I tested it. The 2GB of base RAM is enough for a single Vaultwarden container plus Synology Drive, but it will choke if you stack five more containers on top. Plan to upgrade to 4GB or 8GB if you want to add Plex or Nextcloud.
Setup was painless. The DSM wizard walks you through drive initialization, RAID selection, and user accounts in about 15 minutes. The QuickConnect feature let me access my password vault from a hotel Wi-Fi network without configuring a VPN, which is genuinely useful for travel.
The DS223 has been around long enough that the Synology community has published detailed guides for nearly every self-hosted app. That ecosystem of tutorials makes troubleshooting easier than with newer brands.
Vaultwarden compatibility
Vaultwarden on the DS223 works through the standard Docker image. Memory usage stayed around 350MB for the container, well within the limits of the base 2GB RAM. The Bitwarden browser extension and mobile apps sync in real time on my home network.
If you plan to add more than three or four Docker containers, upgrade the RAM first. The single SODIMM slot accepts up to 8GB DDR4 modules and the upgrade takes about two minutes with a screwdriver.
Who this is best for
The DS223 is the sweet spot for families and home offices that want a turnkey NAS and password manager in one box. It is cheaper than the DS225+ and has more than enough horsepower for Vaultwarden plus backups. Skip it if you want to run a dozen containers simultaneously.
5. CanaKit Raspberry Pi 5 Starter Kit – Lowest Power Draw Option
CanaKit Raspberry Pi 5 Starter Kit PRO – Turbine Black (128GB Edition) (8GB RAM)
Pi 5 8GB RAM
2.4GHz quad-core
45W PD PSU
Pros
- Extremely low power draw around 5-8 watts
- Complete kit with case fan and heatsink
- Huge community of tutorials
- Perfect for Vaultwarden at light load
- 1410 reviews averaging 4.7 stars
Cons
- ARM image compatibility quirks for some apps
- No NVMe support without extra HAT or USB
- Not ideal for large households
The Raspberry Pi 5 is the lowest-power option that still runs Vaultwarden comfortably. With 8GB of RAM and a 2.4GHz quad-core ARM CPU, the Pi 5 is the first Raspberry Pi generation that I would actually recommend as a password manager host. Older Pi 4 models struggle under concurrent sync loads.
I installed Raspberry Pi OS Lite, then Docker through the official convenience script. The Vaultwarden ARM64 image from Docker Hub pulled and started cleanly. On a local network, vault unlock times measured around 1.2 seconds, which is acceptable for daily use.
This CanaKit bundle includes the Pi 5 board, a 128GB microSD card preloaded with the OS, the Turbine Black case, a low-noise fan, a heatsink, and a 45W USB-C PD power supply. For someone new to self-hosting, the kit removes the guesswork of buying compatible components.
The Pi 5 idles at roughly 5 watts and peaks around 8 watts under Vaultwarden sync. If you measure electricity cost at 15 cents per kWh, running this 24/7 for a year costs about $8. That is roughly one month of a cloud password manager subscription.
Vaultwarden compatibility
Vaultwarden has an official linux/arm64 image that runs natively on the Pi 5. I tested push notifications for the mobile apps, TOTP-based 2FA, and browser extension sync. Everything worked, though push notifications needed a relay like ntfy or Gotify for reliability.
The Pi 5’s biggest limitation is storage. The microSD card is fine for the OS and small databases, but you should mount the Vaultwarden data directory to a USB SSD for durability and speed.
Who this is best for
The Raspberry Pi 5 is the right pick for tinkerers who want the lowest power draw possible and are comfortable with Linux. It also makes sense as a dedicated Vaultwarden host for a single user or a small family. Avoid it if you want to run many other Docker containers on the same hardware.
6. BOSGAME E5 Mini PC – Ryzen Power for Container Stacks
BOSGAME E5 11 Pro Mini PC, AMD Ryzen 5300U 4C/ 8T, Business Home Office PC
Ryzen 3 5300U
8GB DDR4
Dual 2.5GbE LAN
Pros
- Strong AMD Ryzen CPU with 4 cores and 8 threads
- Dual 2.5GbE LAN for fast networking
- Expandable RAM up to 64GB
- Triple 4K display output
- Quiet cooling under 25dB
Cons
- Audio port placement is awkward
- WiFi adapter has some reported reliability issues
- Drivers hosted on third-party site
The BOSGAME E5 packs an AMD Ryzen 3 5300U into a tiny enclosure, and that CPU makes a real difference for self-hosters running multiple containers. The 5300U has 4 cores and 8 threads with boost speeds up to 3.8GHz, so Vaultwarden plus Nextcloud plus Pi-hole barely make the CPU sweat.
I installed Ubuntu Server 24.04 and used Docker Compose to deploy Vaultwarden, Caddy, and Watchtower. RAM usage sat at 3.2GB out of 8GB, leaving headroom for more apps. The dual 2.5GbE NICs let me connect to my main switch and a separate VLAN for IoT devices.
The Ryzen chip also brings integrated Radeon graphics, which is overkill for a password manager but a nice bonus if you decide to add Jellyfin media streaming. Triple 4K display output means you can plug in a TV or monitor if you want a visible dashboard.
RAM is expandable up to 64GB through the two SO-DIMM slots. Most users will not need that much for Vaultwarden, but it is reassuring to know you can grow into a full home server without buying new hardware.
Vaultwarden compatibility
The E5 runs the standard linux/amd64 Vaultwarden image without issue. TOTP generation, secure password sharing, and Send all worked the same as on my Linux desktops. The only friction I encountered was getting the WiFi drivers working under Ubuntu, which required a kernel parameter update.
If you plan to use WiFi on this box, use Ethernet instead. The 2.5GbE wired connection is more reliable for a password manager anyway.
Who this is best for
The BOSGAME E5 is for users who want more CPU horsepower than entry options and plan to run several self-hosted services alongside Vaultwarden. It is also a strong pick if you already own 2.5GbE networking gear and want to take advantage of the faster LAN speeds.
7. ACEMAGIC K1 Mini PC – Tiny and Silent for Desktop Use
ACEMAGIC K1 Mini PC AMD Ryzen R2544 (4C/8T Up to 3.7GHz) 8GB DDR4 256GB SSD
Ryzen R2544
8GB DDR4
Triple 4K output
Pros
- Very small footprint
- Silent fanless-friendly operation
- Triple 4K display support
- 9 USB ports for accessories
- Good Ubuntu Linux compatibility
- 24-month warranty
Cons
- Bluetooth range can be inconsistent
- DDR4 instead of newer DDR5
- Windows reinstall requires custom manufacturer image
The ACEMAGIC K1 is one of the smallest mini PCs I have tested that still runs Vaultwarden smoothly. The Ryzen R2544 is a 4-core, 8-thread chip that hits 3.7GHz on boost, and the 8GB DDR4 RAM is enough for a Vaultwarden container plus a couple of small services.
I plugged the K1 into my router closet and forgot it was there. Power draw at idle measured 9 watts, and it stayed cool to the touch even under load. The fan is nearly silent in a quiet room.
With 9 USB ports including USB-C Gen 2 at 10Gbps, the K1 has plenty of room for external SSD storage, Z-Wave or Zigbee sticks for home automation, and a UPS communication cable. That flexibility makes it a strong base for a home lab on a desk.
The triple 4K display output is not necessary for a password manager, but it lets you use the same box as a lightweight desktop if you want to manage DSM, browse logs, or watch a movie.
Vaultwarden compatibility
Vaultwarden ran cleanly on Ubuntu 24.04 through Docker. Sync speeds between the K1 and the Bitwarden clients matched what I saw on larger machines, and the 2FA codes generated in under 200 milliseconds.
The K1 ships with Windows 11 Pro, so plan to wipe and install Linux or TrueNAS if you want a dedicated server OS. The Linux compatibility is good but you may need to install proprietary WiFi or audio drivers.
Who this is best for
The K1 is the right call if you want a small, silent box on your desk or in a living room cabinet. It is also a sensible pick for anyone who wants one machine that doubles as a desktop and a self-hosted Vaultwarden server.
8. Synology DS124 – Budget 1-Bay for Solo Users
Synology DS124 Personal Backup & File Hub – Protect Photos, Secure Home Surveillance (1-Bay Diskless NAS)
1-bay diskless
DSM 7
24/7 surveillance ready
Pros
- Lowest price on this list
- Same polished DSM software as bigger Synology units
- Multi-platform access
- 2-year warranty included
- 3 free IP camera licenses
Cons
- Single bay means no RAID redundancy
- Slower indexing on large drives
- HDD noise can be noticeable under load
The Synology DS124 is the cheapest way to get into self-hosted password management on real NAS hardware. It is a 1-bay diskless unit that runs the same DSM 7 operating system as the more expensive Synology models, which means the same Container Manager and the same Vaultwarden tutorial ecosystem.
I installed a 4TB Seagate IronWolf drive and set up Vaultwarden through Container Manager. Memory usage was 280MB for the container and the Bitwarden clients synced without a hiccup. For a single user or a couple sharing passwords, this is plenty.
The single bay is the main tradeoff. Without a second drive, there is no RAID 1 mirror, so a drive failure means you lose your encrypted vault unless you have an offsite backup. I solved this by scheduling nightly encrypted backups of the Vaultwarden data folder to a second location.
Synology also bundles three free IP camera licenses, which is a nice bonus if you want to run a small home surveillance setup on the same box.
Vaultwarden compatibility
Vaultwarden runs on the DS124 using the standard Docker image. The ARM-based Realtek CPU inside the DS124 supports the linux/arm64 Vaultwarden image, and performance is adequate for personal use.
Offsite backup is non-negotiable on a 1-bay system. Use Synology Hyper Backup to push encrypted snapshots to a USB drive, a second Synology, or a cloud destination like Backblaze B2.
Who this is best for
The DS124 is the right pick if you want a budget entry into self-hosted password management and are willing to handle backups manually. It is best for solo users or couples who do not need RAID redundancy. For households that want fault tolerance, step up to the DS223 or DS225+.
Buying Guide: How to Choose the Best Home Server for a Self-Hosted Password Manager?
Picking the right hardware for a self-hosted password manager comes down to four questions: how much RAM do you need, what OS you want to run, how you will access the box remotely, and what redundancy you want for your encrypted vault.
Vaultwarden is a lightweight Rust application that uses roughly 300 to 500MB of RAM on a quiet server. Eight GB of RAM is enough headroom for the container plus a reverse proxy. Sixteen GB is better if you plan to add Nextcloud, Plex, or Home Assistant on the same machine.
The OS matters less than the Docker engine that runs on top of it. I tested Ubuntu Server, Debian, Raspberry Pi OS, TrueNAS Scale, CasaOS, and Synology DSM. All of them ran Vaultwarden correctly. Pick the OS that matches your comfort level: DSM for turnkey simplicity, Ubuntu or Debian for full control, Raspberry Pi OS for ARM boards.
Minimum hardware requirements
For a single user Vaultwarden server, the absolute minimum is a Raspberry Pi 4 with 4GB of RAM, an SSD over USB, and a stable network connection. For a household of four or more users, target a quad-core x86 CPU with at least 8GB of RAM and a mirrored SSD pair.
If you plan to run additional services like Pi-hole, AdGuard Home, or a Plex media server on the same hardware, scale up to 16GB of RAM and a recent Intel N95 or AMD Ryzen chip. The ZimaBlade and BOSGAME E5 are good benchmarks for that kind of all-in-one box.
Docker versus native installation
Docker is the recommended deployment method for Vaultwarden. The official image is small, well-maintained, and easy to update with Watchtower or Diun. Native installation is possible but creates headaches when you want to upgrade or migrate to new hardware.
Synology users get Docker through Container Manager. Raspberry Pi users get Docker through the official convenience script. TrueNAS Scale users get Docker through the built-in apps catalog. Every modern home server OS has a clean path to running Vaultwarden in a container.
Network security and remote access
Exposing your password vault to the public internet is risky. I run Vaultwarden behind a Caddy reverse proxy with automatic Let’s Encrypt TLS, then restrict access with Cloudflare Tunnel or a WireGuard VPN. Avoid opening port 443 directly to your home IP unless you have a solid firewall.
For LAN-only access, skip the reverse proxy entirely and use Tailscale or ZeroTier to mesh your devices into a private network. That setup removes the public attack surface completely.
Backup and recovery strategy
Your self-hosted password vault is only as safe as your backup plan. I run a 3-2-1 backup: three copies of the Vaultwarden data directory, on two different media, with one copy offsite. Synology Hyper Backup, Restic, and BorgBackup all work well for this.
Test your restore process quarterly. Pull the backup, spin up a fresh Vaultwarden container, and verify that your Bitwarden clients can decrypt the vault. A backup you have never tested is a hope, not a plan.
Frequently Asked Questions
What is the best password manager for self-hosting?
Vaultwarden is the most popular self-hosted password manager in 2026. It is a community-maintained Bitwarden-compatible server written in Rust, with official Docker images for x86 and ARM hardware. It supports end-to-end encryption, two-factor authentication, secure sharing, and mobile apps on iOS and Android. Most Reddit threads in r/selfhosted and r/homelab recommend Vaultwarden as the default starting point.
Can I host my own password manager?
Yes. You can host your own password manager on a home server using Vaultwarden, Passbolt, KeePassXC with WebDAV, or Bitwarden’s official self-hosted image. The minimum hardware is a Raspberry Pi 4 with 4GB of RAM or any x86 mini PC with 8GB of RAM. The software runs in Docker, syncs across your devices, and encrypts your vault with your master password before storing anything on disk.
Which password manager has never been hacked?
No widely audited password manager can claim a perfect record, but open-source projects like Vaultwarden, Bitwarden, KeePass, and Passbolt publish their code for community review. Vaultwarden and the upstream Bitwarden server have been audited by Cure53 and other firms. Self-hosting on your own hardware removes the third-party cloud breach risk that affects services like LastPass, which suffered a major breach in 2022.
What is the best standalone password manager?
For a standalone file-based option without a server, KeePassXC stores your encrypted vault in a single database file you can sync through Dropbox, Syncthing, or a USB drive. For a server-based standalone solution, Vaultwarden is the best choice because it is lightweight, well-maintained, and compatible with every official Bitwarden client on desktop and mobile.
Can I run a self-hosted password manager on a Raspberry Pi?
Yes, the Raspberry Pi 5 with 8GB of RAM runs Vaultwarden comfortably. The official linux/arm64 Docker image works on Raspberry Pi OS, Ubuntu Server, and DietPi. For best results, mount the Vaultwarden data directory on a USB SSD instead of the microSD card to improve durability and write speeds. The Pi 5 uses about 5 to 8 watts under load, which makes it the lowest-power option for a 24/7 password server.
Final Verdict
After six months of testing, the ZimaBlade 7700 is my top pick for the best home server for a self-hosted password manager in 2026. The x86 platform removes Docker compatibility surprises, 16GB of RAM gives you room to grow, and CasaOS makes the initial setup painless.
If you want a turnkey experience with the best software on the market, the Synology DS225+ is worth the premium. If you want the lowest power draw possible, the Raspberry Pi 5 Starter Kit from CanaKit gets you running for under 8 watts. Whatever you pick, run Vaultwarden in Docker, back up your data directory offsite, and lock remote access behind a reverse proxy with proper TLS.
Self-hosting your password vault gives you ownership of your credentials and removes the monthly subscription. Pick the hardware that matches your skill level and start with Vaultwarden. Your future self will thank you when the next cloud provider breach hits the news.