KeePassDX

Last reviewed Sep 13, 2026 · 738 words

KeePassDX is not a server and never phones one; it is the Android half of a password setup where the database is a single encrypted KDBX file and you decide how that file moves between devices. That makes it the right client if you already run KeePassXC on the desktop and something like Syncthing to move files, and the wrong starting point if you want an account, a browser extension and a sync server that just work. The app itself is 7,231 stars of Kotlin, GPL-3.0, fully offline, and among the best-behaved apps on the platform.

Sync is your job, and there are two sane ways to do it

The database opens through Android's Storage Access Framework, so any provider that exposes a file works. Option one is Syncthing: share the folder containing passwords.kdbx between phone, laptop and NAS, and KeePassDX opens the local copy. Conflicts are rare because KeePass writes atomically, but they happen if you edit on two devices while one is offline; KeePassXC can merge two databases, so keep the .sync-conflict file rather than deleting it. Option two is the Nextcloud app or any WebDAV client as the file provider, which gives you server-side history of every version. Both beat Dropbox on the principle that a file full of your passwords should not sit on a third party's disk, however well encrypted.

Autofill and biometrics work, with two settings to check

KeePassDX registers as an Android autofill service, so once you select it in the system autofill setting, apps and browsers show a suggestion bar populated from entries whose URL or package name matches. Add the app's package name to an entry when a match fails; it usually fixes it. Biometric login stores a key in the Android Keystore that decrypts your master password; it is convenient and slightly weaker than typing the password, so I turn it on for the phone and protect the database with a key file as well. KDBX 4 with Argon2 is the format to use; if your database is still KDBX 3 with AES-KDF, upgrade it in KeePassXC first, and KeePassDX opens it unchanged.

Free or Pro: the same code

There are two builds: the free one on F-Droid and Google Play, and a paid Pro version on Play. Both are open source; Pro is the project's funding model and adds cosmetic extras such as themes rather than security features. Pay for it if you use it daily; it costs about what a coffee does and it is how a project this size stays maintained.

Keepass2Android and Vaultwarden are the real alternatives

Keepass2Android is the other major Android client, and its distinguishing feature is cloud and WebDAV sync built into the app, so you can skip Syncthing. Its interface is older and the codebase moves more slowly; KeePassDX wins on polish and on keeping sync outside the app where you can see it. The bigger question is whether to be in the KeePass world at all. Vaultwarden gives you the official Bitwarden apps, sharing, and a browser extension that fills every site, at the cost of running a server. The KeePassXC vs Vaultwarden comparison is the decision to make first; KeePassDX only matters if that decision lands on KeePass.

What a self-hoster's setup looks like

Phone: KeePassDX, database in a Syncthing folder, biometric login on, autofill on. Laptop: KeePassXC on the same folder, browser filling via KeePassXC-Browser. NAS: a third Syncthing node with file versioning enabled so a corrupted database has a history to roll back to. One key file that lives on the phone and laptop but never in the synced folder. That is 3 devices, zero servers exposed to the internet, and a password store that keeps working with every one of them switched off.

What I'd do

If you are a KeePass person, KeePassDX is the Android client; install the F-Droid build, pair it with Syncthing, and buy Pro after a month. If you are not yet in either camp, run Vaultwarden instead; the KeePass model demands that you think about sync and conflicts forever, and most households are better served by a server that handles it. I keep both: KeePassXC and KeePassDX for the handful of secrets that should never touch a server, Vaultwarden for everything else.