---
title: "Vaultwarden Master Password = Encryption Key"
aliases: [vaultwarden encryption, bitwarden master password encryption, vaultwarden password reset]
tags: [vaultwarden, bitwarden, encryption, homelab, backup, security]
sources:
  - "daily/2026-04-30.md"
created: 2026-04-30
updated: 2026-04-30
---

# Vaultwarden Master Password = Encryption Key

Vaultwarden (self-hosted Bitwarden) uses end-to-end encryption where the master password is not just an authentication credential — it IS the encryption key used to encrypt and decrypt all vault data. This means there is no server-side "reset password" operation that preserves vault contents: resetting or losing the master password permanently destroys access to all stored secrets.

## Key Points

- The master password is the encryption key — it never leaves the client in plaintext
- Resetting the master password (via admin panel or DB) re-keys the account but leaves all existing vault entries encrypted under the old key, making them unreadable
- The only recovery path after a lost master password is restoring from a backup that predates the password loss
- SSO login (e.g., via Authentik) is layered on top; if SSO is removed, email/password login still works as long as the master password is known
- Pre-commit hooks that scan for credential patterns will flag secrets written to disk — always use env vars or session tokens for automation that touches Vaultwarden

## Details

### Why reset appears to work but vault is empty

When an admin resets a user's master password from the Vaultwarden admin panel, the account password hash is updated. The user can log in — but every vault item remains AES-256 encrypted under the original key derived from the old master password. The UI shows an empty vault, not an error.

### SSO removal doesn't break email login

If Authentik (or any OIDC provider) is removed from Vaultwarden, the email+password login path continues to work. The SSO flow is an alternative authentication path, not a replacement for local credentials.

### Backup restore procedure

If the master password is forgotten:

1. Stop Vaultwarden container
2. Restore the `/data/` volume from a Backrest (or equivalent) backup taken before the password was changed/forgotten
3. Start Vaultwarden — the old master password unlocks the vault again

```bash
# Stop container first
docker compose stop vaultwarden

# Restore from Backrest snapshot (adjust snapshot ID and path)
backrest restore --snapshot <snap-id> --target /opt/vaultwarden/data/

# Restart
docker compose start vaultwarden
```

### Homelab service password reset context

In a homelab bulk reset (all services to `admin`), Vaultwarden's admin panel "change master password" should NOT be used to reset a user's vault password unless the vault data is expendable — the data will become inaccessible. Use the admin panel only for account management tasks that don't require decrypting vault items.

## Related Concepts

- [[wiki/concepts/authentik-homelab-tradeoffs]] — Authentik SSO was the IdP layered over Vaultwarden; its removal doesn't affect the master-password encryption flow
- [[wiki/homelab/_index]] — Broader homelab service inventory and backup practices

## Sources

- [[daily/2026-04-30.md]] — Bulk homelab password reset revealed that Vaultwarden's master password cannot be reset like other service passwords; E2E encryption model and Backrest recovery path documented
