Bitwarden self-hosted organization licensing is the mechanism Bitwarden uses to sell paid features to customers who run the Bitwarden server on their own infrastructure. “Self-hosting Bitwarden is free, however some features must be unlocked in your self-hosted instance with a registered license file.”[1] The licence file is downloaded from a paid organization or Premium account in the Bitwarden cloud web app and uploaded to the self-hosted server.[1] Commercially, a self-hosted organization is a copy of a cloud subscription. “For billing purposes, organizations must first be created in the Bitwarden cloud web vault”.[2] Catalog program: Self-hosted organization licensing. Catalog proof: Self-hosted organizations must first be created in the cloud for billing.
Editions
Self-hosted organizations “will be able to utilize all paid features provided by their chosen plan”. However, “Only Families and Enterprise organizations can be imported to self-hosted servers.”[4] Teams organizations therefore cannot be self-hosted, and the business pricing page lists “Flexibility to self-host” as an Enterprise feature.[7] Individuals can also apply a Premium licence on a self-hosted server. The cloud and self-hosted account email addresses should match.[1] Enterprise organizations can self-host Secrets Manager alongside their existing self-hosted installation.[6] Catalog proof: Only Families and Enterprise organizations can be self-hosted; Secrets Manager self-hosting limited to Enterprise organizations.
| Licence type | Who retrieves it | Applies to | Update methods |
|---|---|---|---|
| Individual (Premium) | The account holder | Self-hosted Premium account | Manual re-upload |
| Organization (Families) | Organization owner | Self-hosted Families organization | Manual only |
| Organization (Enterprise) | Organization owner | Self-hosted Enterprise organization | Manual or automatic billing sync |
Source: License Organizations or Premium.[1]
Metrics
The self-hosted organization uses the same User seat as the cloud organization. “Self-hosted organization seat counts are set by the license.”[1] The seat count “will always mirror its counterpart cloud-organization”. Self-hosted organizations “do not automatically scale users”.[3] Catalog proof: Self-hosted seats mirror the cloud organization.
Counting / floors
Adding seats. To add seats, the owner first adds them to the cloud organization and then updates the licence on the self-hosted server.[1] A self-hosted Enterprise organization is therefore capped by its licence. It cannot over-deploy in the way auto-scaling cloud organizations can, but adding a user always needs a cloud purchase first.
One deployment per subscription. “Per the Bitwarden terms of service, one organization deployment is permitted per subscription.” Only an organization owner can retrieve, apply and update the licence.[1] When the licence is downloaded, the owner enters the installation ID of the self-hosted server. That ID must come from the same data region as the organization.[1] A second production instance, such as a separate regional server, needs its own subscription. Catalog proof: One self-hosted organization deployment per subscription.
Renewal and expiry
“A self-hosted organization’s license must be updated within 60 days of renewal. If the license is not updated after 60 days, the organization will be disabled.”[1] Bitwarden explains that cloud and self-hosted expiry dates differ because of this grace period, “which is provided to prevent the inadvertent loss of organization functionality”.[1] The renewal guide confirms a 60-day grace period for self-hosted customers, against seven days for cloud customers. A disabled self-hosted organization is re-enabled by downloading a new licence file and updating it in the self-hosted Admin Console.[5] Catalog proof: Self-hosted licence must be updated within 60 days of renewal; Grace periods before a disabled organization: 7 days cloud, 60 days self-hosted.
Billing sync
Licences can be updated by manual re-upload or by automatic sync. Automatic sync:
- removes the need to re-upload licences, though the admin must still trigger “Sync license” when an update is needed;
- makes Families sponsorships possible for members of self-hosted organizations, synced daily;
- “Cannot be setup by organizations still in a free trial period”.[1]
Sync requires globalSettings__enableCloudCommunication=true, a cloud region setting and outbound access to Bitwarden’s API and identity endpoints. A billing sync token is generated in the cloud Admin Console.[1] The self-hosting guide describes sync as optional. Its benefits are easier licence updates when seats change or the subscription renews, and access to sponsored Families organizations.[2]
Individual Premium licences
A Premium licence is retrieved from the cloud web app under Settings, Subscription, using “Download license”. It is applied on the self-hosted server under the same menu, after the user has verified an email address. That step needs the server’s SMTP settings to be configured.[1] The individual licence also has to be updated, for example “when it expires”. The user retrieves it again and uses the “Update license” button.[1] Individual licences have no billing sync.
Effective licence position
For a self-hosted Enterprise organization, the licence position can be read from three places:
- The cloud organization’s subscription page, which shows the purchased seats and the renewal date. Seats are bought and reduced only there.[3]
- The licence currently applied on the self-hosted server, which sets the seat count the server enforces. It can lag the cloud if it has not been synced or re-uploaded since the last seat change or renewal.[1]
- The number of self-hosted deployments, which should be one per subscription.[1]
If the cloud renewal date has passed and the server licence has not been refreshed, the organization still works until the 60-day grace period ends. After that it is disabled.[1][5] An organization on manual updates should treat each renewal as a scheduled task. If an upload fails with a “version not supported” error, the server must first be updated.[1]
Virtualization & partitioning
The licence is bound to an organization and an installation ID, not to hosts, cores or virtual machines. Bitwarden runs on Docker on Linux and Windows machines, including offline and air-gapped installs.[2] The retrieved documents contain no rule on high-availability or disaster-recovery copies. A practitioner should get written confirmation before running a second live instance against one subscription, given the one-deployment rule.[1]
Cloud / BYOL
Self-hosting is the BYOL path. The subscription is bought and managed in the Bitwarden cloud, and the licence is carried to the customer’s server.[2] The Provider Portal for MSPs “is not supported for self-hosted environments at this time”.[8]
Open source versus licensed features
The server code is mostly AGPL 3.0. Modules such as Commercial.Core and SSO integration are under the Bitwarden License, which “requires a paid subscription for production use”.[9] Self-hosters can build the Api module without Commercial.Core by passing /p:DefineConstants="OSS" to dotnet.[9] A self-hosted server running the standard images with enterprise features in production therefore needs a paid organization licence. See Bitwarden open source and Bitwarden License. Catalog proof: Production use of Bitwarden Licensed code requires a paid subscription.
Programs
- Sponsored Families for Members. Available to self-hosted Enterprise organizations only through automatic billing sync.[1]
- Enterprise trial. Trial organizations cannot set up automatic sync.[1]
Out of scope
- Server installation, sizing and upgrade procedures, except where they affect licensing.
- Self-hosted Teams organizations, which the plans page does not allow.
- Third-party server implementations that are not distributed by Bitwarden.