iOS app is in testing phase. Please help by testing via TestFlight 🙏🏻 Join the beta here
2Secret
Donate Download
Download Donate View on GitHub

Self-hosting

Run your own 2Secret server.

A small Docker container on a Raspberry Pi, NAS, Proxmox or VPS is all it takes. Your devices sync through it, you can share vaults, it serves the web vault, and it only ever stores your vaults encrypted.

Reference documentation Server downloads

Before you start

What you need.

  • A small machine

    A Raspberry Pi, a NAS, a Proxmox container or a small VPS is plenty for a family or team. The image runs on amd64 and arm64.

  • Docker

    Docker with the Compose plugin. A single binary with systemd works too.

  • A domain name

    Something like vault.example.org, so your apps can reach the server over HTTPS.

  • Fifteen minutes

    Most of it is waiting for Docker to download the image.

For the technically curious

The server never sees your master password, your Secret Key or your vault contents in readable form. Still, treat it like any internet-facing service: keep it updated, back it up and use HTTPS.

Recommended

Docker Compose with Caddy and automatic HTTPS.

Caddy sits in front of the 2Secret server and gets a free HTTPS certificate for your domain automatically. The repository’s deploy folder has ready-made example files.

  1. Point your domain at the machine

    Create a DNS record (A or AAAA) for your domain that points to the machine’s public IP address, and make sure ports 80 and 443 reach it.

  2. Get the example files

    bash
    git clone --depth 1 https://github.com/joostiphone/2Secret.git
cd 2Secret/deploy

  3. Set your domain and invite code

    Open the Caddyfile and replace vault.example.com with your domain. In docker-compose.yml, replace the example value of TWOSECRET_INVITE_CODES with a long invite code of your own: sign-ups are invite-only from the start. The other settings are in the configuration reference.

  4. Start it

    bash
    docker compose up -d
docker compose logs -f

    When the logs show that Caddy obtained a certificate, open your domain in a browser: you should see the 2Secret web vault.

  5. Create your account

    Create your account in the app or the web vault, with your server address and the invite code. Give the code only to people you want on your server; once everyone has an account, you can close sign-ups.

Docker only

Already have a reverse proxy?

Run the container on its own and point your existing proxy (nginx, Traefik, Nginx Proxy Manager, …) at it. Always put HTTPS in front of it.

Pull the image

bash
docker pull ghcr.io/joostiphone/2secret:latest

Run it with a persistent data volume

bash
docker run -d --name 2secret --restart unless-stopped \
  -p 127.0.0.1:8743:8743 \
  -v 2secret-data:/data \
  -e TWOSECRET_SIGNUPS=invite \
  -e TWOSECRET_INVITE_CODES=choose-a-long-secret-code \
  ghcr.io/joostiphone/2secret:latest

The port is bound to localhost only; your proxy forwards HTTPS traffic to it. Without TWOSECRET_SIGNUPS, anyone who can reach the server can create an account.

Other ways to run it

Pick the setup that matches your hardware.

  1. Binary with systemd

    Every release includes 2secret-server for Linux (x86_64-unknown-linux-gnu), and the web vault as a separate archive. Download them from the download page, check the SHA-256 checksums, and run the server as an unprivileged user under systemd. The repository’s deploy folder has a ready-made unit file, 2secret-server.service; the reference documentation walks through it.

  2. Proxmox LXC

    Create a small unprivileged Debian container and enable nesting and keyctl, which Docker needs. Install Docker inside it and follow the Docker Compose steps.

    bash
    pct set <ID> --features nesting=1,keyctl=1

  3. Raspberry Pi

    The image is built for arm64 as well. Use a 64-bit Raspberry Pi OS (for example on a Pi 4 or 5), install Docker, and follow the Docker Compose steps.

    bash
    curl -fsSL https://get.docker.com | sh

    Prefer an SSD over an SD card for the data volume, and back it up.

  4. Synology or QNAP NAS

    Install Container Manager (Synology) or Container Station (QNAP). Create a project from the example docker-compose.yml, but leave out the caddy service and publish port 8743 of the 2secret service instead. Map the data volume to a shared folder that is included in your NAS backups, and use the NAS’s reverse proxy or a Cloudflare Tunnel for HTTPS.

  5. Behind a Cloudflare Tunnel

    No open ports on your router: cloudflared makes an outgoing connection to Cloudflare, which serves your domain over HTTPS.

    1. In Cloudflare Zero Trust, create a tunnel and install cloudflared on the machine with the command it shows.
    2. Add a public hostname (for example vault.example.org) with service http://localhost:8743.
    3. Skip Caddy: Cloudflare handles HTTPS. Run the container as in Docker only.

    Your vaults stay end-to-end encrypted by the apps. Cloudflare does terminate HTTPS, though, so it can see e-mail addresses, sign-in requests and other metadata, never the contents of your vaults.

Invite-only sign-ups

Your server, your guest list.

With TWOSECRET_SIGNUPS=invite, new people can only create an account with one of the codes in TWOSECRET_INVITE_CODES (comma separated), so give a code only to your family or your team. Once everyone has an account, set TWOSECRET_SIGNUPS=closed. The default is open, so always set one of the two. All settings are in the configuration reference.

Configuration

Every setting, explained.

The server is configured with environment variables or command-line flags, such as TWOSECRET_BIND, TWOSECRET_DATA_DIR, TWOSECRET_WEB_DIR, TWOSECRET_SIGNUPS, TWOSECRET_INVITE_CODES, TWOSECRET_SESSION_DAYS and TWOSECRET_CORS_ORIGINS. The reference documentation has the complete, current table with defaults.

Day-to-day

Backups, upgrades and health.

  1. Back up the data volume

    Everything the server stores is in its data volume, in the SQLite database 2secret.db. The vaults in it are encrypted, but a backup still protects you against a broken disk. Stop the server while you copy it:

    bash
    docker compose stop 2secret
docker run --rm -v deploy_2secret-data:/data:ro -v "$PWD":/backup debian:trixie-slim \
  tar czf /backup/2secret-backup-$(date +%F).tar.gz -C /data .
docker compose start 2secret

    deploy_2secret-data is the volume Compose creates in the deploy folder; docker volume ls shows the exact name. Treat backups as sensitive and keep at least one copy on another machine. Your devices also keep a full encrypted copy of the vaults they use.

  2. Upgrade

    Read the changelog first, make a backup, then:

    bash
    docker compose pull
docker compose up -d

    Database migrations run automatically.

  3. Check that it’s healthy

    bash
    docker compose ps
docker compose logs --tail=50
curl https://vault.example.org/api/v1/health

    The health-check endpoint /api/v1/health answers with {"status":"ok","version":"…","signups_open":…}, handy for monitoring tools.

Connect

Connect your apps, extension and CLI.

  1. Apps

    When you create an account (with Sync with a 2Secret server switched on) or sign in, enter your server’s address, for example https://vault.example.org. A local vault can be connected later in Settings → Connect to server.

  2. Browser extension

    Sign in to the extension with the same server address, e-mail address, master password and Secret Key.

  3. CLI

    Sign in once with 2secret account signin --server https://vault.example.org --email [email protected]; see the CLI guide.