Common Vaultwarden Errors and How to Fix Them

We earn commissions when you shop through the links below. Learn more

Guide · Vaultwarden

Pinned version: Vaultwarden 1.37.4 (GitHub release). Last checked: 2026-10-28.

Most Vaultwarden problems come down to three things. The web vault needs HTTPS and a matching DOMAIN setting. The reverse proxy needs to point to the container's internal port (80). And /data needs a persistent volume, or Vaultwarden refuses to start. The fixes below come from the Vaultwarden wiki and source code (checked 2026-10-28).

"Failed to fetch", login fails, or the web vault won't load

When the browser can't complete the vault's requests, it's usually reported as "failed to fetch" or a failed login. The wiki lists two documented causes:

1. No HTTPS. The Enabling HTTPS page says HTTPS is "pretty much required nowadays" because the Bitwarden web vault uses web crypto APIs that most browsers only allow over HTTPS. The recommended fix is a reverse proxy that handles HTTPS in front of Vaultwarden. Rocket's built-in TLS (ROCKET_TLS) is "not recommended".

**2. A missing or wrong DOMAIN.** The official .env.template says the domain "must match the address from where you access the server". If it isn't set, "certain functionality might not work", such as attachment downloads, email links and U2F. The Docker Compose wiki marks it as "required when using a reverse proxy". Set the full URL, including https:// and any port or path:

yaml
environment:
  DOMAIN: "https://vault.example.com"

Certificate errors on phones. The wiki's FAQ says self-signed certificates often fail because some platforms don't accept them, and recommends Let's Encrypt. If you use Rocket's TLS, serve the full chain (fullchain.pem): without it, "Android devices will fail to connect". A mobile app error saying "Chain validation failed" can also mean OCSP stapling isn't working.

502 Bad Gateway behind a reverse proxy

A 502 means the proxy got no valid response from Vaultwarden. Check:

  1. The container is running: docker ps, then docker logs vaultwarden. It may have exited, for example because of the volume check below.
  2. The port: inside the container, Vaultwarden listens on port 80 (ROCKET_PORT). The proxy examples assume -p 127.0.0.1:8000:80 on the host. With Docker Compose on a shared network, proxy to vaultwarden:80 instead of 127.0.0.1:8000.
  3. Plain HTTP upstream: the examples assume the proxy talks to Vaultwarden over plain http:// (no ROCKET_TLS). If you turned on Rocket TLS, the upstream must be https://.
  4. WebSockets: the nginx examples add the Upgrade/Connection headers that WebSocket notifications need. Copy the example for your proxy (Caddy, nginx, Apache, Traefik and others are on the wiki).

"No persistent volume!" and the container exits

Vaultwarden 1.37.4 checks whether /data is a bind mount or a named volume. If it detects an anonymous Docker volume, it logs:

It looks like you did not configure a persistent volume! This will result in permanent data loss when the container is removed or updated!

and exits (source). Fix it by mounting a host folder or named volume at /data, as in the wiki's compose example:

yaml
volumes:
  - ./vw-data:/data

The same message mentions I_REALLY_WANT_VOLATILE_STORAGE=true, which skips the check. Don't use it for a real vault: your data would be lost when the container is replaced.

Anyone can sign up

The wiki's compose template sets SIGNUPS_ALLOWED: "true" with the note "Deactivate this with 'false' after you have created your account". Set it to "false" once your accounts exist, then recreate the container.

Missing icons for vault items

The FAQ says icons can be missing if the server can't reach the internet or resolve DNS. Check the /admin/diagnostics page (needs the admin page enabled).

For a full HTTPS setup from scratch, follow Vaultwarden with Docker and HTTPS. To reach the vault from outside your home without opening ports, compare Tailscale, WireGuard and Cloudflare Tunnel.

Related: Vaultwarden with Docker and HTTPS · Tailscale vs WireGuard vs Cloudflare Tunnel

FAQ

Which Vaultwarden version were these fixes checked against?

1.37.4, checked 2026-10-28.

Sources

Related guides