I’m selfhosting vaultwarden and access it through wireguard. This is is probably the safest way to host passwords, since the encrypted vault isn’t on someone else’s server while the risk of an attacker exploiting vulnerabilities is extremely slim. This works well for all my services, e.g. Jellyfin and radicale (cal-/carddav).

I’ve paid 10€ for a year of Bitwarden before and it’s also a good deal.