Reselling managed Vaultwarden in 2026

This guide is for agencies and MSPs that want to add a password manager to their service catalog without running a hosting company. The product is managed Vaultwarden, an open-source server that works with the official Bitwarden apps. You host the server for each client; they use the same browser, mobile, and desktop apps they already know. A 20-client password line can bring in roughly €420 to €1,020 a month in recurring margin. Here is how the model works, what it costs, and where it fits.

TL;DR

• Managed Vaultwarden gives clients the official Bitwarden apps on a server you host.
• Your cost is €9 per client instance per month; you set the retail price.
• At €30 to €60 retail, 20 clients is roughly €420 to €1,020 a month in gross margin.
• Per-seat tools like 1Password Business (around $7.99 per user a month) keep rising with headcount; a Vaultwarden instance is flat.
• DANIAN does not offer a white-label reseller console yet; you keep the client relationship and the billing.

The agency math

The math is simple. You pay €9 a month for each client's Vaultwarden instance. You resell it as a managed password service at €30 to €60 a month. That leaves €21 to €51 per client in gross margin, before your own support time. Twenty clients puts the recurring number between €420 and €1,020 a month.

The reason the spread is wide is that you set the retail price, not us. A small client on a tight budget might pay €30. A client that wants their passwords managed, backed up, and supported as a hands-off service will pay €50 or €60 without blinking, because the comparison in their head is a per-seat tool that costs more and still leaves them managing it. The table below shows how the recurring number grows as you add clients.

These figures are gross. Subtract your own support hours to get the real number. The good news is that a password manager is low-touch once it is set up. Most client questions are a forgotten master password or a new team member who needs an account, not the server. You can run a 20-client line on a few hours a month once the onboarding is done. You can start with a single instance of managed Vaultwarden at €9/month and add clients as you sign them.

Why Vaultwarden is the product to resell

Vaultwarden is an open-source server that speaks the Bitwarden protocol, written in Rust. It runs on modest resources compared with the heavier official self-hosted stack, which is part of why it is cheap to host one instance per client. Your clients install nothing unusual: they use the official Bitwarden browser extension, mobile app, and desktop app, pointed at the server you host.

That compatibility is the whole hook. The apps are polished and widely used, and Bitwarden maintains them. You operate the server; the client gets a product they recognize and that works the way they expect. There is no half-finished open-source client to apologize for, because there is no separate client at all.

A single instance is enough for a small client team. Vaultwarden supports organizations, collections, shared logins, member roles, and event logs, so a team can share credentials, separate them into folders, and control who sees what. One instance hosts the whole organization and its users, which is exactly the unit you are reselling.

The project is open source under AGPL-3.0, has more than 60,000 stars on GitHub, and is actively maintained. That matters for a line you intend to sell for years: the software is not a hobby experiment, and you are not betting a client relationship on a project that might disappear next quarter.

Be honest about the limits, because your clients will ask. Vaultwarden is an independent project and is not affiliated with Bitwarden. Its maintainers aim it at individuals, families, and small organizations rather than large enterprises. For a 20-person client it is a strong fit. For a 2,000-person company with a dedicated identity team, the official Bitwarden product is the safer recommendation, and saying so makes the rest of your pitch more credible. (Sources: the Vaultwarden project on GitHub, github.com/dani-garcia/vaultwarden; the Bitwarden apps, bitwarden.com/download.)

The reason this line is worth building now is that per-seat password tools have been climbing. 1Password raised its business price to around $7.99 per user a month in 2026 (1password.com/business-pricing). For a client, that bill grows every time they hire. A Vaultwarden instance does not. The table below puts the per-seat tools next to your flat wholesale cost for a 20-person client team.

Read the table the way your client will. Per-seat tools scale with headcount, so the bill never stops growing. You charge the client a flat retail price of €30 to €60, which is still below what a per-seat tool costs a growing team, and you keep €21 to €51 of it. The client pays less and gets a managed service; you earn a margin that does not shrink as they hire. Both sides come out ahead, which is the kind of deal that stays sold. (Bitwarden pricing: bitwarden.com/pricing/business.)

What white-label actually requires

White-label means the client never sees a third party. To get there you need three things: a custom domain for the login, your branding on what the client sees, and billing that comes from you. Some of this is available today, and some of it is not. It is better to know which is which before you promise a client a fully branded product.

The custom domain is the easy part. Each client's vault lives on a subdomain you control, such as vault.clientdomain.com or passwords.youragency.com. That is standard, and it is what makes the service feel like yours rather than a generic host. Pointing a subdomain at an instance is a routine setup step.

Branding is partial. The Vaultwarden web vault can carry a custom name and look, so the page a client lands on is not a generic default. The theming is limited, so be honest: it will not look like a bespoke product built from scratch, but it will not advertise another company's brand either. For most clients, a clean login on their own domain is enough.

Billing is entirely on you, and that is by design. DANIAN bills you €9 per instance. You invoice the client at your retail price through your own system, on your own schedule, under your own name. That separation is what lets you own the relationship and the margin instead of passing the client through to a host.

Here is the gap, stated plainly: there is no single console today that provisions, brands, and bills dozens of instances for you. There is no automated white-label control plane and no per-instance reseller dashboard yet. If a turnkey console is a hard requirement for you this quarter, this is not it yet. For an agency that is comfortable managing a client list and invoicing in its own tools, the current setup works; for one that needs a finished reseller platform on day one, it does not.

The DANIAN partner setup today

The setup is deliberately simple. Each client gets a separate instance at €9 a month. We patch it, back it up daily off-site, monitor it, and answer chat around the clock. You point a subdomain at it and manage the client.

What you get today is the operational work done for you. We handle patching, daily off-site backups, and monitoring, and we answer support chat at any hour. You choose the region for each client's instance, each client is isolated from the others, and each one runs on a custom subdomain you control. That is the part of "running a hosting company" you do not have to build or staff.

What is not here yet, said directly: there is no central multi-client console, & no automated branded invoicing. For details see our Partner program.

The workaround is straightforward: you keep the client list, the billing, and the front-line relationship, and we keep the servers. It is a clean division of labor that works today, without waiting for a console to ship.

One honest note on where this is going. We are building the partner side around real agencies, not assumptions about what agencies want. If a reseller console would change your decision, tell us what it needs to do. The roadmap is shaped by which features actually unblock a sale, and partner feedback is the input we weigh most.

The security story your clients will ask about

There are two parts to the security answer, and clients tend to blur them: what the software does, and what we do as the host. Keeping them separate makes the answer honest and easy to give. The vault is encrypted so that only the master password opens it. We run the server, isolate it, and back it up.

On the software side, the important fact is that each vault is encrypted on the client's device before it ever reaches the server, using a key derived from the user's master password. We host encrypted data only. We cannot read a client's passwords, and neither can anyone who obtains the stored files without the master password. This is a property of how the Bitwarden protocol works, not a promise we are asking anyone to take on faith.

On the hosting side, each client runs on a separate, isolated instance. One client's vault never shares space with another's, which is the answer to the question every buyer eventually asks: am I on the same box as strangers. The answer is no.

We patch the server, monitor it around the clock, and back it up daily to off-site storage, and a backup that does not restore is not a backup, so restores are part of the routine, not an afterthought. If a client wants their two-factor codes kept separate from their passwords, you can add 2FAuth for two-factor codes as a second instance, which keeps the TOTP codes in their own place.

Two promises worth making to a client in writing. We will not change a client's resources or your bill without asking first, so there are no surprise charges. And we will not delete a client's data if a payment fails; we hold it and tell you, so a billing hiccup never costs a client their vault.

When this works, and when it doesn't

This model fits some agencies cleanly and is the wrong tool for others. Three situations where it works well, and three where it does not.

Where it fits

• You have a handful of small clients who each need a shared vault for a team of five to fifty. One instance covers each client, and the per-instance cost is where your margin comes from.
• You want recurring revenue without an on-call rotation. We carry the patching and the 2am pages; you carry the client and the invoice.
• You are comfortable owning client billing and front-line questions. The margin is yours because the relationship is yours.

Where it doesn't

• A client's procurement requires a vendor that can hand over a formal, independently attested security report. That is not something this setup provides today; point that client to a provider that can, and keep this line for the clients it fits.
• You want a finished white-label console on day one. It does not exist here yet, and building your offer on a feature that has not shipped is a way to disappoint a client.
• You are serving a 2,000-seat enterprise with a dedicated identity team. The official vendor is the better recommendation, and making it keeps your judgment credible with that client.

How to start as a partner

If the model fits, the path to a live client is short. You can validate the whole thing on one instance before you sign anyone.

1. Start a 7-day trial on one Vaultwarden instance and point a subdomain at it, such as vault.youragency.com.
2. Add yourself as the organization admin, install the official Bitwarden browser extension and mobile app against your subdomain, and confirm the experience end to end.
3. Set your retail price using the math above. Between €30 and €60 a month per client is common, depending on how hands-off the client wants the service to be.
4. Onboard your first client. You invoice them; we run the server. As you add instances, start the partner pricing conversation so volume terms are in place before you scale.

What to do this week

If a client has asked you to host their passwords, this is a clean way to say yes. Run one trial instance, point a subdomain at it, and try the Bitwarden apps yourself so you are selling something you have used. Price it, and add it to your catalog. If you expect several clients, start the partner conversation now rather than after you have signed them. The server work is ours; the client and the margin are yours.

Frequently asked questions

What is Vaultwarden, and how is it different from Bitwarden?
Vaultwarden is an open-source server that speaks the Bitwarden protocol, written in Rust. It is an independent project, not made by Bitwarden, and it runs on far fewer resources than the official self-hosted server. Your clients still use the official Bitwarden apps, so the difference is mostly on the hosting side.

Do my clients install a special app, or use the normal Bitwarden apps?
They use the normal Bitwarden apps. The official browser extension, mobile app, and desktop app all work against a Vaultwarden server. You point them at the address you host, and the experience is the same one they would get from Bitwarden's own service. Nothing unusual to install.

Does Vaultwarden support passkeys?
Yes. The Bitwarden apps your clients use can store and use passkeys in the vault for passwordless login to websites, and a client can also sign in to the vault itself with a passkey. Hardware security keys that follow the FIDO2 standard work as well. A client moving toward passwordless login gives up nothing by being on a Vaultwarden server.

What two-factor options can a client turn on for the vault login?
A client can protect the vault login with an authenticator app for time-based codes, with email codes, or with a hardware security key using the FIDO2 standard. These are set per user inside the vault, so a client can require a second factor across their whole team. This is separate from 2FAuth, which is a standalone app for storing the two-factor codes a client uses on other services.

How do I move a client from 1Password or LastPass to Vaultwarden?
Your client exports their existing vault and imports it into the Bitwarden web vault pointed at the server you host. The Bitwarden import tool reads LastPass, 1Password, and dozens of other formats, and the import runs on the client so the data is encrypted before it reaches the server. File attachments and a few item types may need to be re-added by hand, but logins, notes, and cards come across in one pass.

Does each client get their own separate instance?
Yes. Each client runs on its own Vaultwarden instance at €9 a month, isolated from every other client. One client's vault never shares space with another's. This per-client isolation is the answer most clients want when they ask whether they are sharing a server with strangers.

Can one instance handle a whole client team?
Yes. A single Vaultwarden instance supports organizations, collections, shared logins, and member roles. One instance can host a client team of five to fifty users on the base plan. The €9 cost is per instance, not per user, which is where the margin against per-seat tools comes from.

Is the password data encrypted, even from DANIAN?
Yes. Each vault is encrypted on the user's device before it reaches the server, using a key derived from their master password. We host encrypted data only. We cannot read a client's passwords, and neither can anyone who has only the stored files without the master password.

How often is a client's vault backed up?
Every client instance is backed up daily to off-site storage, separate from the server it runs on. A backup that cannot be restored is not a backup, so restores are part of the routine rather than a promise. If a client ever needs data brought back, the path exists and has been used, not just configured.

What is included in the €9 per month per instance?
Each instance runs on its own resources with patching, daily off-site backups, monitoring, and chat support around the clock. The base plan covers a small client team, with storage and traffic limits suited to a password vault rather than a media server. If a client needs more, you can add resources for a clear monthly amount. The price is flat per instance, not per user, which is the whole point for a reseller.

How much margin can an agency make on a password line?
Your cost is €9 per client instance per month. A common retail price is €30 to €60 a month. That is €21 to €51 in gross margin per client, before your support time. At twenty clients, the recurring margin lands between €420 and €1,020 a month.

Who handles client billing, DANIAN or the agency?
You do. DANIAN bills you €9 per instance per month. You invoice your client at your own retail price through your own billing system. Keeping the billing on your side is what lets you own the client relationship and set the margin, rather than passing the client to us.

Can I give my own clients a trial before they commit?
Yes. You set the terms with your client, so you can offer them a trial period on an instance you are running. On the DANIAN side, a new instance starts with a 7-day trial, which gives you room to set it up and show the client before any charge begins. How you structure a trial for your client is your call, since you own the pricing and the relationship.

How quickly can I get a client live on a password manager?
An instance is ready fast, often the same day. The work on your side is pointing a subdomain at it, adding yourself as the organization admin, and inviting the client's users. Most of the real time goes into the client importing their existing passwords, not into standing up the server. You can have a client trialing their own vault well inside the first day.

How do I add or remove users on a client's vault?
You manage users from the organization view inside the client's vault. As the admin, you invite a new team member by email, set which collections they can see, and remove someone the same way when they leave. Because each client is its own instance, changes you make for one client never touch another. Day-to-day user changes do not involve us at all.

Do my clients' staff need any technical skill to use it?
No. For the people using it, a Vaultwarden vault behaves like any password manager: they install the Bitwarden extension, sign in, and their logins fill in for them. The technical side sits with you and with us, not with the client's staff. That makes it an easy product to sell into a non-technical client, because the daily experience is just the browser extension they already understand.

Do I need to be a sysadmin to resell this?
No. The server work is ours. We patch, monitor, back up daily off-site, and answer chat around the clock. You point a subdomain at the instance and handle client questions, which are mostly about forgotten master passwords and new team members, not the server itself.

Why not just host Vaultwarden myself instead of using a managed service?
You can. Vaultwarden is open source, so a technical agency can run it on its own server. The trade is your time: you take on patching, monitoring, off-site backups, certificate renewal, and the 2am page when something breaks for a client. The €9 managed price exists so you can sell the service without staffing that work. If you have a sysadmin who wants to own it, self-hosting is viable; if you would rather sell and support clients, managed is the cheaper path once you count hours.

Who do my clients contact for support, me or DANIAN?
Your clients contact you. You are the face of the service, and you handle the questions that are really about the client: who has access, a forgotten master password, a new hire. DANIAN supports you on the server side, so when something is a hosting problem you have a team behind you. The client never has to know there is a host underneath.

Does DANIAN offer a white-label reseller dashboard today?
Not yet. You can host each client on a custom subdomain and brand the login page, but there is no central console that provisions, brands, and bills many instances at once. If a turnkey reseller dashboard is a hard requirement this quarter, this setup does not meet it yet.

Can I bundle the password manager with other apps I resell?
Yes. The password manager is one app at €9 a month, and a client can run other open-source apps on the same flat per-instance model: a file-sync tool, a help desk, a project board. You can package several into one monthly price and present a small managed software line under your own name. Each app is a separate instance, so a client only pays for what they use.

Is it legal to resell Vaultwarden as a paid service?
Yes. Vaultwarden is released under the AGPL-3.0 license, which allows commercial use and offering the software as a hosted service. The main obligation is that the source code stays available to users, and the Vaultwarden source is public on GitHub. This is general information, not legal advice; if you sign reseller contracts, have your own lawyer review them.

Can I host a client's vault in a specific region?
Yes. You can place each client's instance in the region closest to them, chosen from 21 datacenter locations across six continents. This is useful when a client wants their data kept near their users or within a particular country.

How is this different from Bitwarden's own MSP program?
Bitwarden's MSP program bills per seat through Bitwarden's cloud. Reselling managed Vaultwarden is flat per instance on a server you host, so your cost does not climb as a client's headcount grows. The trade-off is that Vaultwarden is an independent project without Bitwarden's official support behind it.

What if a client outgrows the base plan?
The base instance covers most small teams. If a client's vault, attachments, or user count grows beyond it, you can add resources for a clear monthly amount rather than re-platforming. We tell you before anything changes, so the upgrade is a decision, not a surprise on the bill.

What happens if a client stops paying me?
On our side, a failed payment does not trigger deletion. We hold the data and tell you. You decide what to do with the client. We will not change resources or your bill without asking first, so there are no surprise charges while you sort out a client account.

Can clients export their data if they leave?
Yes. The data belongs to the client, and a Vaultwarden vault exports in standard Bitwarden formats. If a client leaves you, or you leave us, the vault is portable. Nothing about the hosting locks a client in, which is an easy promise to make during a sales conversation.

What happens to a client's passwords if DANIAN stops operating?
The data stays portable, so a shutdown does not strand a client. A Vaultwarden vault exports in standard Bitwarden formats, and because the apps are the official Bitwarden apps, a client can move to another Vaultwarden host or to Bitwarden's own service without changing tools. Export rights plus standard apps are what make the line safe to sell for the long term.

What if a client needs a formal security report for procurement?
If a client's procurement process requires a vendor that can produce a formal, independently attested security report, this setup does not provide that today. That is an honest limit. Point those clients to a vendor that can meet the requirement, and keep this line for the clients it fits.

Can I pair the password manager with a separate two-factor app?
Yes. Some clients prefer to keep their two-factor codes apart from their passwords. You can add 2FAuth, a self-hosted app for two-factor codes, as a second €9 instance. It keeps TOTP codes in their own place, which adds a layer of separation some clients ask for.

Try managed Vaultwarden hosting for 7 days