I've been a happy 1Password subscriber since 2022 (and a user for longer - it was exposure at work which caused me to adopt it at home). This week, however, I made the decision to migrate away from 1Password to another password manager. After a bit of looking around, I decided to move to Vaultwarden - an unofficial Bitwarden compatible server (Bitwarden itself would be a fine option, except that I've been trying to reduce exposure to US service providers). This post describes two things: getting Vaultwarden running and migrating my credentials from 1Password. If you're moving to Bitwarden (whether the cloud service or the self-hosted option), the migration portion of this post should work for you. Why? Part of the reason that I've remained with 1Password for so long is that their implementation is very good at a technical level: as well as the master password, decryption requires a static key too - so cracking your unlock password isn't enough on its own. All other things being equal, I'd probably have stuck with 1Password for quite some time. Unfortunately, though, they've chosen to support a David Heinemeier Hansson (DHH) vessel: the Omacom Foundation (which funds the Omarchy project). Over the course of the next three years, they intend to provide financial support to the tune of $300,000. This was an unpleasant surprise, because DHH is well known for publishing and supporting extreme right-wing ideology. Just last year, in fact, he wrote in support of Tommy Robinson, a figure so toxic that even Nigel Farage doesn't want to be associated with him. The "peaceful" march that DHH wrote so positively about actually ended in violence and disorder. More recently, DHH compared the Romani population of Denmark to its growing wolf population: When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. It's not as if 1Password could have been caught by surprise here, because these aren't just isolated examples: DHH has been loud and proud with his views for years now (ironic really given that he's previously argued that people should keep their politics to themselves1). Over the years, he's taken issue with trans people, migrants, black people, overweight people, those without children and even those with ADHD. The canned reply from the 1Password Support desk even alludes to awareness of DHH's rhetoric2: We recognize that Omarchy is closely associated with its founder, and that raises questions about what our support means. Our contribution is made to the Omacom Foundation, not to an individual, and is not an endorsement of any individual's personal or political views. 1Password does not endorse hateful, dehumanizing, or exclusionary views. Of course, the association is not really that easy to handwave away. Pouring money into a DHH project serves to amplify his platform. 1Password's response acknowledges that DHH's views are problematic, but attempts to separate them from his organisation. I was a bit grumpy about this in my reply: Thank you for the reply, and I just want to note that I understand this is a canned statement and not something that you've personally written or endorse, so please take this reply as something to be passed on rather than aimed even remotely at you. All of that being said, the reply is a complete crock and 1Password, as an organisation, should know better. It's simply not possible for you to donate to Omacom without it being viewed as support (endorsement, even) of DHH and his views. DHH holds and pushes views which actively harm members of the very development and open-source communities that you claim to support. I don't know whether 1Password leadership's head is stuck in the sand, or somewhere more bodily, but they can't be feeling the wind around their ears if they think that this argument holds even a drop of legitimacy. Amongst other things, DHH has actively blogged in support of a right wing UK racist who's known for turning up on people's doorsteps and filming himself trying to provoke them into hitting him. A man so monumentally embroiled in racism, in fact, that even Nigel Farage won't be seen to be associated with him. That is the stink that 1Password is currently voluntarily rubbing into itself. There is no "we didn't donate to an individual" here - the individual and Omacom Foundation are one and the same, and the money that you've provided helps ensure that he has a platform to support him while he spreads hate. Whether or not you claim to endorse hateful, dehumanising or exclusionary views you are actively providing financial support to the project of someone who regularly espouses those views. As with so many things, though, it's not the act that seals things, but the response. 1Password's leadership could have said "err, duhhh.... we didn't think about that" and changed course. Instead, The Verge's reporting suggests they've doubled down (some of the talking points in the article are visible in the support ticket response too). So... that's why - my subscription alone doesn't mean much in the grand scheme of things, but I'm not comfortable giving 1Password any more money, knowing that it may be used to further DHH's campaigns of hate. 1Password could well have the best technical offering in the market, but their sponsorship of DHH is a red line - we're not talking about some minor political disagreement, we're talking about supporting the far right. Vaultwarden Setup Vaultwarden recommend that deployments use their docker images (also available via Github, if it happens to be up). There is a particularly important thing to note here: Vaultwarden is an unofficial server and the Bitwarden clients sometimes change out from underneath it, so the project also recommends that containers are kept up to date. So, as well as deploying the Vaultwarden container, I deployed watchtower to check for if :latest has changed and update the container if so. My docker-compose.yml looks like this: services: watchtower: image: nickfedor/watchtower container_name: watchtower environment: - WATCHTOWER_LABEL_ENABLE=true # This is actually the default # but I don't want to have to remember that - WATCHTOWER_POLL_INTERVAL=86400 volumes: - /var/run/docker.sock:/var/run/docker.sock vaultwarden: image: vaultwarden/server:latest container_name: vaultwarden labels: # Tell watchtower to monitor this container - "com.centurylinklabs.watchtower.enable=true" environment: # Set this to your domain - DOMAIN=https://example.com restart: always volumes: - /home/ben/docker_files/files/vaultwarden/data:/data ports: - '3001:80' A quick docker compose up -d later and the container was running. Next I configured my Nginx reverse proxy: upstream vaultwarden { server 192.168.13.25:3001 weight=1; keepalive 2; } server { listen 443 ssl; root /usr/share/nginx/empty; index index.html; server_name example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_session_timeout 5m; location / { proxy_set_header Connection ""; proxy_http_version 1.1; client_max_body_size 525M; proxy_pass http://vaultwarden; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header Host $http_host; proxy_hide_header X-Powered-By; } } The web vault became available at https://example.com. Tweaking Password Complexity Requirements Registration is enabled by default, so to get started, I hit Create Account. But, I quickly ran into an issue: the master password has an enforced minimum length of 12 chars: The password that I wanted to use comes in just under that. Because this was a migration, I wanted to keep things like-for-like (to begin with, anyway). There's a discussion thread asking for an official way to relax the requirement, but as it was introduced upstream it seems unlikely that one will be forthcoming. There was, however, a comment which provided a pointer so I hacked at the container: docker exec -it vaultwarden bash find / -name 'main*js' -exec sed -i 's/minimumPasswordLength=12/minimumPasswordLength=10/g' {} \; Note: this change won't survive a container recreation, but it only needed to last long enough for me to register the account. This allowed me to proceed to register with an 11 char password. With the account created, I updated docker-compose.yml to disable signups: environment: - SIGNUPS_ALLOWED=false Sharing Some of my 1Password vaults were shared with other family members. In Vaultwarden (and Bitwarden) this is achieved by creating an organisation and then assigning credentials to collections: New users can then be added to the organisation in order to access whichever collections have been shared with them. Browser Extension Setup The official Bitwarden apps and browser extension can connect to Vaultwarden. I run Waterfox and so installed the Firefox extension. When you click sign-in it'll default to signing into bitwarden.com, but clicking the server-selector reveals a Self-hosted option (allowing you to enter the domain to use to reach Vaultwarden). Exporting Credentials From 1Password 1Password's web-ui doesn't provide a way to export passwords, however the desktop client can do it. This will create an unencrypted dump of passwords, so be very careful how you handle the file. Importing Credentials can be imported via the web-ui or the browser extension. In either case, you're asked to define which vault credentials are imported into, the import format and then to provide a copy of the file: If, like me, you have multiple vaults in 1Password, there is a small annoyance here: 1Password exports everything (there isn't a way to only export an individual vault) and Bitwarden doesn't provide a way to manually specify what should be imported where. So, everything ends up being dumped into a single vault and needs sorting back into individual collections. Extension Tweaking With all of my credentials in place, I disabled the 1Password browser extension and set about testing things out before running into a couple of annoyances. Like 1Password, Bitwarden matches on the base domain rather than full subdomain, so multiple credentials were suggested. This can be changed in the extension itself: Settings -> Autofill -> Default URI match detection -> set to Host. The Bitwarden extension also offers to create and store passkeys. That can be disabled by going to Settings -> Notifications -> Ask to create and save passkeys Other than that, both the Android app and the Firefox extension seemed to work just fine. Backups Vaultwarden uses an sqlite database by default, so my vault is automatically backed up by the host's filesystem backup routine. However, there is some risk with a filesystem snapshot - if the backup ran just as the database was being written to disk, it may not be usable. So, I also a created a cronjob to take a backup: #!/bin/bash DB="/home/ben/docker_files/files/vaultwarden/data/db.sqlite3" OUT_DIR="/home/ben/docker_files/files/vaultwarden/backup" DATESTAMP=`date +'%Y%m%dT%H%M'` sqlite3 "$DB" ".backup ${OUT_DIR}/${DATESTAMP}.db" # Cycle out old backups find $OUT_DIR -type f -mtime +14 -delete At some point in the future, I would also like to setup automatic replication to an isolated offsite instance. That way, if anything were to happen to the house, I'd still have access to my credentials. Cancelling 1Password Cancelling a 1Password subscription is quite easy: Log into my.1password.com Billing Scroll down to the bottom: Clicking the button opens a prompt asking for the reason for cancellation. With no free-text box to fill out, I simply selected Other. Job done, my automatic renewal has been cancelled. I'll give it a few days in case I find that something's missing, but the next step will be Settings -> Permanently Delete Family Account. As a precaution, I am also going to keep hold of the export for a little while, and so have encrypted it: gpg -a -r $MY_EMAIL -e 1PasswordExport-MQAVVRC32BATBGEWCCXTENWDCU-20260905-221250.1pux shred -uz 1PasswordExport-MQAVVRC32BATBGEWCCXTENWDCU-20260905-221250.1pux Conclusion I remember my migration into 1Password being quite a manual and painful process. Migrating back out, though, has proven to be really quick and easy. Getting Vaultwarden up and running was equally simple. I don't know how many will move away from 1Password, but their own goal could prove quite punishing: it's really easy to move between password managers nowadays and there's an entire market of providers not giving financial support to the likes of DHH. Funnily enough, those posts have historically tended to appear not long after he's been called out. ↩ Of course, not being aware would be an odd sign of a lack of due diligence by a company in the security sector ↩