Native Bitwarden & Vaultwarden Integration for Nextcloud
Access your Bitwarden vault directly from Nextcloud – no browser extension required, no data shared with third parties. All decryption happens client-side in the browser. Your master password never leaves your device.
- 🔑 Login entries – username, password, TOTP, URLs
- 📝 Secure notes – encrypted free-text notes
- 💳 Credit cards – card number, CVV, expiry date
- 🪪 Identities – address, phone, email, company
- 📁 Folder navigation with entry count badges
- 🔍 Full-text search across all vault items
- ➕ Create & edit vault entries
- 🏢 Organisation vaults (shared vaults via RSA-OAEP)
- 🌍 Bitwarden Cloud (US & EU) + self-hosted Vaultwarden
Browser Nextcloud Server Bitwarden / Vaultwarden
│ │ │
│── Master Password ──▶ PBKDF2/ │ │
│ Argon2id │ │
│ │ │ │
│ ▼ │ │
│ Master Key │ │
│ (32 bytes) │ │
│ │ │ │
│ HKDF-Expand │ │
│ ┌─────┴─────┐ │ │
│ encKey macKey│ │
│ │ │ │
│── passwordHash ──────────┼───────▶│── POST /identity/connect ───▶ │
│ (PBKDF2, 1 iter.) │ │ /token │
│ │ │◀── access_token + encKey ─── │
│ │ │ │
│◀──────── encKey (encrypted) ──────│ │
│ │ │ │
│── AES-CBC decrypt ───────┘ │ │
│ (HMAC-SHA256 verify) │ │
│ │ │
│◀──── Vault items (encrypted) ─────│──── GET /api/sync ──────────▶ │
│ │ │
│── AES-CBC decrypt (in browser) ──▶ Plaintext (never sent to server)
Security guarantees:
- Master password is never transmitted to any server
- Vault keys are held in browser RAM only (no LocalStorage)
- Tokens stored in PHP session only (server-side, never in the browser)
- All cryptographic operations via Web Crypto API (native browser code)
| Component | Version |
|---|---|
| Nextcloud | 31, 32 or 33 |
| PHP | 8.1+ |
| Node.js | 20+ |
| npm | 8.3+ |
cd /var/www/html/apps # or your Nextcloud apps directory
git clone https://github.com/derfips/nc_bitwarden.gitcd nc_bitwarden
npm install
npm run buildsudo -u www-data php /var/www/html/occ app:enable nc_bitwardenNextcloud → Settings → Personal → Bitwarden
| Option | Description |
|---|---|
| Bitwarden Cloud (US) | bitwarden.com – default |
| Bitwarden Cloud (EU) | bitwarden.eu – GDPR compliant |
| Self-hosted | Your own Bit- or Vaultwarden instance |
APP=/var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/apps
# Copy app
cp -r nc_bitwarden $APP/
# Build
cd $APP/nc_bitwarden
npm install && npm run build
# Enable
sudo docker exec --user www-data nextcloud-aio-nextcloud \
php /var/www/html/occ app:enable nc_bitwardenEnter only the base URL – without a trailing slash:
✅ https://vault.example.com
❌ https://vault.example.com/
❌ https://vault.example.com/api
If Bit- or Vaultwarden uses an internal hostname or IP, Nextcloud must be allowed to connect locally:
sudo docker exec --user www-data nextcloud-aio-nextcloud \
php /var/www/html/occ config:system:set \
allow_local_remote_servers --value=true --type=boolAdd your CA certificate to Nextcloud's trust store:
cp my-ca.crt /var/www/html/resources/config/ca-bundle.crt# Development mode with auto-rebuild
npm run dev
# Linting
npm run lint
# Production build
npm run buildnc_bitwarden/
├── appinfo/
│ ├── info.xml # App metadata, NC version range
│ └── routes.php # URL routing
├── lib/
│ ├── AppInfo/ # Bootstrap
│ ├── Controller/ # PHP endpoints (API proxy, settings)
│ ├── Service/ # Bitwarden proxy, user settings
│ └── Settings/ # NC personal settings page
├── src/
│ ├── services/
│ │ ├── api.js # Axios wrapper for NC backend
│ │ └── crypto.js # PBKDF2, Argon2id, AES-CBC, HKDF-Expand, RSA
│ ├── components/
│ │ ├── LoginForm.vue # Master password entry
│ │ ├── VaultList.vue # Sidebar with folders & entries
│ │ ├── ItemDetail.vue # Entry detail view
│ │ ├── ItemForm.vue # Create / edit dialog
│ │ ├── FieldRow.vue # Reusable field row component
│ │ └── Settings.vue # Server configuration
│ └── App.vue # Root component + vault loader
└── templates/ # PHP templates for NC integration
The browser may show the following console message:
AES-CBC and AES-CTR do not provide authentication by default...
This is not an error. Bitwarden uses AES-CBC together with a separate HMAC-SHA256 (Encrypt-then-MAC), which is cryptographically sound. The warning is a generic browser recommendation; this app deliberately follows the Bitwarden wire protocol for full compatibility.
- Memory dump: JavaScript strings are immutable – the master password cannot be securely wiped from the heap after use. This applies to all browser-based password managers and is an accepted trade-off.
- Organisation vaults: Require RSA-OAEP decryption of the user's private key (fully implemented). For very large vaults this may take a few seconds on first load.
- Live TOTP code display (auto-refresh)
- Password generator
- Favourites view
- Offline cache (Service Worker)
- Bitwarden Send support
Pull requests are welcome! Please:
- Fork the repository
- Create a feature branch (
git checkout -b feature/my-feature) - Commit your changes (
git commit -m 'Add: my feature') - Push the branch (
git push origin feature/my-feature) - Open a Pull Request
AGPL-3.0 – the same license as Nextcloud itself.
- Bitwarden – open-source password manager
- Vaultwarden – unofficial Bitwarden-compatible server
- Nextcloud – self-hosted cloud platform
- @noble/hashes – pure-JS Argon2id implementation