Migrate from Vaultwarden to LitePassword (export & decommission guide)

You ran Vaultwarden for the zero-knowledge guarantee and no per-seat fees. Keep the guarantee, drop the container you patch, back up, and keep online. Move in about 15 minutes.

Step-by-step migration from Vaultwarden

1. 01

   Export your vault via a Bitwarden client

   Vaultwarden speaks the Bitwarden protocol, so use any Bitwarden client pointed at your instance. Web vault (or desktop): Tools → Export Vault. Choose ".json" (unencrypted) for the easiest import, or "JSON (Encrypted)" if you want it protected in transit. Each user exports their own vault; an org admin can export shared collections. Save the file locally — never email it or drop it in Slack. It contains decrypted secrets.

2. 02

   Note your collections and org layout

   Before touching LitePassword, jot down your Vaultwarden organization collections and who has access to each. LitePassword maps "collections" to "vaults" and replaces granular group permissions with three roles plus per-vault access. Plan the mapping on paper first — it makes the import clean.

3. 03

   Create your LitePassword account

   Go to app.litepassword.com/sign-up. Use your work email and pick a strong master password (16+ characters) — different from your Vaultwarden master password. When the one-time recovery key appears, store it somewhere durable (a sealed envelope, a safe, a separate manager). It is the only way to reset your master password, and we never see it.

4. 04

   Recreate your structure as vaults

   Create empty shared vaults matching your Vaultwarden collections — "Production credentials", "Client — Acme", "Tooling". One vault per collection is the cleanest mapping. Your private vault is auto-created on first sign-in.

5. 05

   Import secrets by type

   Open the JSON export in any viewer. Walk through each item and create the matching LitePassword secret: Logins → Login type, Cards → Credit Card, Identities → Custom, Secure Notes → Secure Note. Skip Bitwarden Sends if you have any (LitePassword has no equivalent). Per-type manual entry produces a cleaner vault than a bulk dump, and a 10-person setup usually moves in well under 20 minutes.

6. 06

   Move TOTP seeds to an authenticator

   If your Vaultwarden setup stored TOTP seeds, those move to a dedicated authenticator app — LitePassword does not generate TOTP codes today. Re-enroll the affected accounts before you shut anything down.

7. 07

   Invite your team and assign roles

   Users page → Invite user. Pick a role: Admin for owners, Manager for full members who create and edit vaults, View only for contractors. Each person signs up, sets their own master password, and generates their own recovery key. No accounts to provision on a server you run.

8. 08

   Grant per-vault access

   For each member, open Manage Vault Access and toggle on only the vaults they need. Access is cryptographically enforced — the vault key is wrapped per recipient, so members literally cannot decrypt vaults they were not granted. On their first unlock, the key re-wraps with their master-derived key.

9. 09

   Securely delete the export

   The JSON from step 1 contains your secrets in (possibly) plaintext. Securely delete it (Mac: rm -P, Linux: shred -u, Windows: SDelete) and empty the trash. Do not keep it "just in case."

10. 10

    Decommission the Vaultwarden container

    Once everyone has unlocked from LitePassword, run Vaultwarden in parallel for at least a week as a fallback. Then take a final encrypted backup of the database, stop the container (docker compose down), revoke any API tokens, remove the DNS record and reverse-proxy config, and let the TLS certificate lapse. Keep the encrypted backup for 30 days, then delete it permanently. No more patching, backups, or uptime pages.