KeePassium

Last reviewed Sep 13, 2026 · 759 words

Self-hosting a password manager on Apple devices comes down to a fork in the road: run a server, or sync a file. Vaultwarden is the server answer. KeePassium is the best argument for the file. Your vault is a single encrypted .kdbx database that any KeePass-compatible program can open, KeePassium reads and writes it on iPhone, iPad and Mac with Face ID and system AutoFill, and there is nothing to keep patched, back up or expose to the internet because there is no service. For one person who already runs KeePassXC on a desktop, that is a complete password setup with zero operations.

A file, not a service: what that buys you

The KDBX format is open, versioned and implemented by dozens of tools. That means your passwords are not tied to KeePassium, or to KeePass, or to any one company's continued existence; if the app vanished from the App Store tomorrow you would open the same file in KeePassDX or KeePassXC and lose nothing. It also means backup is a file copy, and a sync tool with version history gives you vault history for free. The cost is that a file has no server to resolve conflicts, which is the whole subject of the next section.

KeePassium is GPL-3.0 with the source on GitHub, which for the app that holds every credential you own is not a small thing. Its 1,689 stars understate how widely it is used, since most users install from the App Store and never visit the repository.

Sync options ranked

KeePassium opens databases through the iOS Files interface, so anything that mounts as a file provider works. In order of how well they behave with a database that is written from two devices:

iCloud Drive is the zero-effort option and the least self-hosted. Nextcloud via its iOS app or WebDAV works well and keeps the file on your hardware. Syncthing is the most private, though on iOS it needs a third-party client such as Möbius Sync, and you should turn on file versioning on at least one node.

The rule that prevents grief is one writer at a time. Edit on the phone, let it sync, then edit on the desktop. KeePassium and KeePassXC both handle a changed-on-disk file sensibly, and a KDBX conflict copy is recoverable by merging in KeePassXC, but "recoverable" is not the same as "fun".

Free versus premium: what is actually gated

The core loop is free with no entry limits: open, search, edit, AutoFill, Face ID, TOTP codes. At last check the premium tier, sold as a subscription or a one-time purchase, covers hardware-key authentication, keeping several databases open at once, longer auto-lock timeouts and some convenience features. That is a fair split. A person with one database and a master password never needs to pay; a person who unlocks with a YubiKey does, and the price is a fraction of a 1Password year.

Pair it with KeePassXC on the desktop, or don't bother

A phone-only KeePass setup works but wastes the format. The natural pairing is KeePassXC on Windows, Linux or macOS with its browser extension, the same file synced between them, and KeePassium as the mobile and AutoFill half. The KeePassXC vs Vaultwarden comparison is really the choice you are making here, with KeePassium as the reason the KeePass side is viable on an iPhone at all.

When Vaultwarden is the better answer

Two situations. Sharing: a file model has no concept of "give my partner these 20 logins but not those 200", while Vaultwarden's organizations do exactly that. Many devices: once you have three people on six devices, file sync conflicts stop being rare, and a server that merges changes centrally is worth its 128 MB. Vaultwarden also gives you the official Bitwarden apps on every platform, including the Android phone that KeePassium cannot help with.

What I'd do

One person, Apple devices, a desktop somewhere: KeePassium plus KeePassXC, the database in Nextcloud or Syncthing with versioning on, and a copy of the file in your backups. Pay for premium if you use a hardware key, because that is the feature worth paying for. A household, or anyone who needs to share credentials: Vaultwarden, and use KeePassium only as the emergency reader for an exported KDBX kept offline. Either way you have left 1Password without giving up AutoFill, which was the thing that used to keep people there.