KeePass

Last reviewed Sep 13, 2026 · 840 words

There is nothing to host with KeePass, and that is the point. Your entire vault is one .kdbx file, encrypted with AES-256 or ChaCha20 and a key derived from your master password by Argon2, and "self-hosting" means deciding which disk that file lives on and how it reaches your other devices. No server process, no TLS certificate, no update schedule, no attack surface listening on a port. The price is that the sync problem is yours to solve, and the original Windows client is showing its age.

KeePass 2.x is the reference, not the client you will use

The 2003-vintage project at keepass.info is written in C# for .NET, which makes it a native Windows application first. It runs on Linux and macOS under Mono, badly enough that almost nobody does. Its lasting contribution is the KDBX format: an open, documented container that a dozen independent clients read and write, and the reason the ecosystem has outlived several commercial managers. The plugin system (KeeAgent for SSH keys, KeePassRPC for browser integration, dozens of import filters) and the trigger engine are things the ports have not fully matched, and the software has been audited and picked over for two decades. The catalogue's only con, a dated Windows-centric interface, is fair.

The client per platform

On Windows, KeePass itself is fine, and the portable zip build runs from a USB stick with no installation. Everywhere else, use a KDBX-compatible client. KeePassXC is the cross-platform desktop standard on Linux and macOS, with a maintained browser extension and SSH agent built in; most people who say "I use KeePass" mean this. On Android, KeePassDX reads the same file, with autofill and biometric login. On iOS, KeePassium does the same. All four open the same file with the same password, and none of them phones home.

Pick KDBX 4 as the format if you have an old database, since it brings Argon2 and the newer ciphers, and use a key derivation setting that takes about a second to open on your slowest device. That is the only crypto decision you have to make.

Sync is the actual self-hosting question

The file has to move between devices, and the choice is where it moves through. The options from least to most infrastructure: a USB stick and discipline; a folder in your existing Nextcloud, which every client can open through WebDAV or a synced folder; or Syncthing, which moves the file peer to peer with no server holding it. Syncthing is my pick for a household, because the vault is never at rest on a machine you did not choose.

The failure mode is the same on all of them: you edit on the phone and the laptop before they sync, and now there are two versions. KeePass has a built-in synchronize-with-file merge that resolves this entry by entry, and KeePassXC has the equivalent under its database menu. Syncthing's conflict copies preserve both versions rather than losing one, so the worst case is a 2-minute merge, not lost data. Turn on file versioning in whichever tool you use and this stops being scary.

When to run a server instead

The moment more than one person needs shared entries, or you want the browser extension and mobile app to just work without thinking about files, a server wins. Vaultwarden gives you the Bitwarden clients, organizations, and sync across every device, and the full guide is the setup I recommend. The KeePassXC vs Vaultwarden comparison lays out the trade honestly: the file model has zero operations and zero exposure, the server model has convenience and sharing, and you cannot have both.

Coming from 1Password or LastPass, KeePass will feel spartan. There is no shared vault with a family plan, no travel mode, no emergency access. In exchange, the format has been public for 20 years and there is no company between you and your passwords.

Backups are trivial and still get skipped

A vault that exists on three synced devices is not backed up; a sync error deletes it in three places at once. Copy the .kdbx into your normal backup rotation as a plain file, which is the one advantage over every server-based manager where the backup is a database dump. Keep an offline copy on a drive in a drawer and refresh it a few times a year. Test that you can open it.

What I'd do

Use KeePassXC on the desktops, KeePassDX or KeePassium on the phones, and let Syncthing move one KDBX 4 file between them with versioning on. Keep the original KeePass around only if you depend on a specific plugin. If a partner, team or parent needs access to the same passwords, stop there and set up Vaultwarden instead. For a single person who wants the fewest moving parts and no server to maintain, the file is still the best design in the password managers category.