Once Self-Hosted, Always Self-Hosted: Whose "Lifetime" Is It, Anyway?
Plex tripled its lifetime pass and now charges to stream your own files. Bitwarden scrubbed "Always free" as private-equity execs moved in. One week, one lesson about whose "lifetime" it really is, and why you should hold the key yourself.
In one week of May 2026, two companies we had handed an enormous amount of trust quietly reminded us whose life the word "lifetime" actually refers to.
Plex tripled the price of its lifetime pass, from $249.99 to $749.99 starting July 1 (a year earlier it was $120). And as of April 29, streaming your own files from outside your house stopped being free: without a Plex Pass or a Remote Watch Pass, your server will not hand you your own movie on the TV at your parents' place. That same week, Bitwarden scrubbed "Always free" from its site, swapped "Inclusion" and "Transparency" in its company values for "Innovation" and "Trust," and handed the CEO and CFO chairs to people whose LinkedIn pages advertise experience in mergers, acquisitions, and work with private equity.
It is the same story, told twice in one week. A subscription is a lease. A lease turns against the tenant eventually, because the landlord changes faster than your habits do. The only genuinely lifetime access is the one whose key you hold yourself.
"Somewhere" always means: on someone else's server, waiting
Start with an idea that, after 2022, should sound like a joke: keeping all your passwords "somewhere." In the cloud. With a vendor who promises their encryption is unbreakable.
LastPass. In August 2022, attackers got into the development environment and walked out with source code and documentation. The company reassured everyone that customer vaults were safe. On November 30 it admitted what had really happened: building on the August break-in, someone had copied encrypted backups of roughly 30 million vaults, keys and crypto seed phrases included. Those vaults were not cracked that night. The attackers pulled them onto disk and have been cracking them offline ever since. TRM Labs ties around $35M in crypto theft to that leak, spread over years; Krebs and U.S. prosecutors link it to a $150M heist on January 30, 2024. Your weak master password from 2019 is, right now, working for someone else.
The same failure kept repeating across the industry. Norton LifeLock, December 2022: credential stuffing against roughly 925,000 password-manager accounts. Passwordstate, 2021: a poisoned update pushed through the supply chain straight into corporate vaults. One central pile of millions of people's encrypted secrets is a standing bounty, and the math on it never changes. The only open question was when, and how long the quiet offline decryption would run afterwards.
That is why Bitwarden's corporate wobble lands harder than it looks. Bitwarden was the good one: open, auditable, with a free tier promised forever. When a company that holds your passwords in its cloud starts speaking the language of M&A and deletes "free" from its homepage, you are looking at a preview of who will own your vault two quarters from now.
Vaultwarden: does it survive when Bitwarden gets sold?
The good news is stronger than it looks. Vaultwarden, the unofficial compatible server written in Rust, is an independent reimplementation of the API that does not use Bitwarden's SDK. When you self-host Vaultwarden, the one closed-source piece, Bitwarden's own backend, simply does not apply to you: you never run it. The client apps on phone, browser, and desktop stay under the GPL and talk to your server the same way they would talk to the cloud.
In practice that means even if a fund buys Bitwarden tomorrow and turns the free plan into a 14-day trial, your vault sits on your box and keeps working. The one residual risk is Bitwarden someday closing the clients or breaking compatibility, and those clients are GPL, so a fork stays on the table. Migration takes a few minutes:
services:
vaultwarden:
image: vaultwarden/server:latest
volumes: [ ./vw-data:/data ] # your vault lives here, on your disk
environment:
SIGNUPS_ALLOWED: "false" # invite by hand only
ports: [ "127.0.0.1:8080:80" ] # localhost only; the VPN does the rest
Export the JSON from Bitwarden, import it, and stop being a line item in someone else's risk ledger.
And Plex? Self-hosted that phones the cloud for your own files
The same logic runs through media, with extra irony. Plex sells itself as self-hosted, yet authentication, server discovery, and (when a direct connection will not come up) the stream itself via Plex Relay all pass through plex.tv. Your server under the desk phones the cloud to let you into your own library. Now it wants to charge for the call.
Remote access to a home server has been a solved problem for a decade, and it goes by WireGuard or Tailscale. Jellyfin serves the same media with no middleman: fully FOSS, no account, no cloud, hardware transcoding included for free where Plex keeps it behind the Pass. The trade-offs are real. You stand up remote access yourself with a reverse proxy and TLS or that VPN, the smart-TV apps are rougher, and family sharing is less polished. With Plex you pay for convenience, and the price of that convenience is that someone else holds the switch.
Whose life is it, anyway
"Lifetime" on a price list always meant the vendor's lifetime. The vendor's life ends the day someone buys the company. A lifetime pass is a liability on a balance sheet, waiting for a new owner with a private-equity background to convert it into a revenue stream. Plex just showed what that looks like in numbers. Bitwarden just changed its stated values to ones that read better in a data room.
Once self-hosted, always self-hosted. The reason is plain arithmetic. The only server that will still be on your side next quarter is the one whose electricity bill you pay yourself. So the closing question is simple. How many of your "lifetime" services survive the next change of ownership, and which of them hold a key that should only ever have been yours?
Buy Me a Coffee
Fuel my creativity with a coffee — every sip keeps this blog running!
Support This Blog — Because Heroes Deserve Recognition!
Whether it's a one-time tip or a subscription, your support keeps this blog alive and kicking. Thank you for being awesome!
Tip OnceYou read this far.
Subscribe to get the full stack: Vaultwarden plus Jellyfin behind a single WireGuard tunnel, with no cloud, no pass, and no owner who changes their mind next quarter.
SubscribeDOGE: DSYxsbfWKAX8wWED9aWeqLEVXU7KihKk6h
Canary: pro-it.rocks-canary-76f2695d
