3.9K ·GitHub
What is this?
NodeWarden is a self-hosted, Bitwarden-compatible password manager server that runs entirely on Cloudflare Workers, letting you sync vaults, attachments and TOTP codes with standard Bitwarden clients without renting a VPS.
NodeWarden is a self-hosted, Bitwarden-compatible password manager server that runs entirely on Cloudflare Workers, letting you sync vaults, attachments and TOTP codes with standard Bitwarden clients without renting a VPS.Is this an app I install, or a server I deploy myself?It's a backend server you deploy into your own Cloudflare account (Workers plus a D1 database, with R2 or KV for storage) — nothing runs on your device, you just point official Bitwarden-compatible clients at it.
It's a backend server you deploy into your own Cloudflare account (Workers plus a D1 database, with R2 or KV for storage) — nothing runs on your device, you just point official Bitwarden-compatible clients at it.How do I deploy it?Fork the repo on GitHub, open Cloudflare Workers & Pages, choose 'Continue with GitHub' and select your fork, then set build command to 'npm run build' and deploy command to 'npm run deploy' (or 'npm run deploy:kv' for KV-backed storage).
Fork the repo on GitHub, open Cloudflare Workers & Pages, choose 'Continue with GitHub' and select your fork, then set build command to 'npm run build' and deploy command to 'npm run deploy' (or 'npm run deploy:kv' for KV-backed storage).What do I need besides a GitHub fork?Just a Cloudflare account with Workers/D1/R2-or-KV bindings and a JWTSECRET of at least 32 random characters set as a Worker secret; the Worker creates the D1 schema itself on first request, no manual SQL needed.
Just a Cloudflare account with Workers/D1/R2-or-KV bindings and a JWTSECRET of at least 32 random characters set as a Worker secret; the Worker creates the D1 schema itself on first request, no manual SQL needed.What official Bitwarden features are missing?Organization/collection/role sharing and SSO/SCIM/directory sync are not implemented, and macOS desktop support hasn't been fully verified yet, though Windows, Linux, mobile and browser-extension clients are confirmed working.
Organization/collection/role sharing and SSO/SCIM/directory sync are not implemented, and macOS desktop support hasn't been fully verified yet, though Windows, Linux, mobile and browser-extension clients are confirmed working.Is this officially backed by Bitwarden, and is my vault safe?No — it's an unofficial, independent reimplementation; vault data is end-to-end (zero-knowledge) encrypted before it reaches your own Cloudflare storage, and the README explicitly warns this is a learning project, not affiliated with Bitwarden.
No — it's an unofficial, independent reimplementation; vault data is end-to-end (zero-knowledge) encrypted before it reaches your own Cloudflare storage, and the README explicitly warns this is a learning project, not affiliated with Bitwarden.What's the difference between using R2 or KV for storage?R2 requires a payment card on file but gives a 10GB free tier with up to 100MB per attachment/Send file; KV needs no card but caps free storage at 1GB with a 25MiB per-file limit.
R2 requires a payment card on file but gives a 10GB free tier with up to 100MB per attachment/Send file; KV needs no card but caps free storage at 1GB with a 25MiB per-file limit.Can I hide the built-in web vault?Yes — setting a HIDEWEBVAULT=1 variable in Workers settings makes the server's frontend pages return 404 while the sync, login, attachment and other client APIs keep working normally.
Yes — setting a HIDEWEBVAULT=1 variable in Workers settings makes the server's frontend pages return 404 while the sync, login, attachment and other client APIs keep working normally.Does it support passkeys or hardware security keys?Yes, it supports passkey (passwordless) login plus TOTP and YubiKey-based two-factor authentication, matching features normally reserved for paid Bitwarden plans.
Yes, it supports passkey (passwordless) login plus TOTP and YubiKey-based two-factor authentication, matching features normally reserved for paid Bitwarden plans.Does it offer vault backups beyond basic self-hosting?It includes a built-in cloud backup center that can run scheduled incremental backups to WebDAV or S3, a feature the official free Bitwarden tier doesn't provide.
It includes a built-in cloud backup center that can run scheduled incremental backups to WebDAV or S3, a feature the official free Bitwarden tier doesn't provide.What are similar projects?ente, mailflare, edgeever, DoulorCloud, keepassxc, cloudflare_temp_email, mail2telegram, open-compute
ente, mailflare, edgeever, DoulorCloud, keepassxc, cloudflare_temp_email, mail2telegram, open-computeWhich topics is it in?workers, zero-knowledge, password, password-manager, totp, cloudflare-r2, preact, cloudflare-d1, end-to-end-encryption, webdav, lgpl, 2fa
workers, zero-knowledge, password, password-manager, totp, cloudflare-r2, preact, cloudflare-d1, end-to-end-encryption, webdav, lgpl, 2fa