KeePassXC

Last reviewed Aug 26, 2026 · 809 words

KeePassXC has no server, and for a self-hoster that is the feature rather than a gap. Your entire vault is one encrypted .kdbx file that you can put on any disk, any sync tool, any backup, and there is no login page on the internet for anyone to attack. The trade is stated plainly in its own docs: sync is your responsibility, and the way you handle that decides whether this is the most private password setup available or a merge-conflict generator.

Where it sits in a stack: it is a file

Think of KeePassXC the way you think of a spreadsheet. The desktop app on Linux, macOS and Windows opens a local database encrypted with your master password (and optionally a key file or hardware key challenge-response), formatted as KDBX 4 with Argon2id key derivation. Nothing phones home. That means the piece you self-host is not KeePassXC at all; it is whatever moves that file between your machines. Every other tool in the password managers category runs a server that clients talk to; here the "server" is a file share.

Sync options, ranked by how badly they can hurt you

The saving grace is inside KeePassXC itself: when it notices the file changed on disk while open, it offers to reload or merge, and the built-in merge combines entries from two copies by modification time rather than clobbering one. So the rule is short. Let Syncthing move the file, close the database when you are done on a machine, and if you ever see two copies, open one and use Database, Merge from database to fold in the other. I have run this across 3 machines for years with 2 conflicts, both resolved in a minute.

Mobile is third-party, and that is fine

There is no official KeePassXC phone app. KeePassDX on Android and Strongbox or KeePassium on iOS all open the same KDBX 4 file, support TOTP and autofill, and can read it from a Syncthing folder (Android) or a WebDAV share such as Nextcloud (iOS, where Syncthing is awkward). Pick one, point it at the synced file, and you have a phone vault with no vendor between you and it. Set the mobile app to read-only if you want to remove any chance of a phone edit racing a desktop edit.

Browser integration and the extras people miss

KeePassXC-Browser for Firefox, Chrome and their derivatives talks to the desktop app over native messaging, so autofill works without any extension ever holding your secrets. Beyond passwords the database holds TOTP codes (it will show and copy the 6-digit code), passkeys via the same extension, SSH keys it can load into your agent when the database is opened, and arbitrary attachments. The SSH agent feature alone is a reason some people run it: private keys stay encrypted in the vault and are loaded only while it is open.

Vaultwarden fits a different person

Vaultwarden gives you official Bitwarden apps everywhere, sharing with family members, and a server to run, patch and expose. KeePassXC gives you one person, one file, zero services, and a merge to think about. The KeePassXC vs Vaultwarden comparison lays it out; the short form is that if you need to share a Netflix login with a partner who will not tolerate a sync folder, Vaultwarden wins, and if the idea of a password server on your network makes you uneasy, KeePassXC wins.

The file is the backup, but keep versions

A single synced file means a corrupted or accidentally emptied database syncs everywhere within seconds. Turn on Syncthing's file versioning (staggered, 30 days) on at least one node, or point a nightly restic job at the folder. KeePassXC also keeps a .old backup on save if you enable it in settings. Test opening a month-old copy once; the master password is all you need, which is the other quiet advantage of having no server to rebuild.

What I'd do

One .kdbx in a Syncthing folder shared between 2 desktops and an Android phone running KeePassDX, staggered versioning on the always-on node, key file kept out of the sync folder, browser extension on each desktop. For a single person who wants nothing listening on a port, this beats every hosted option, and I would move to Vaultwarden only on the day a second person needs shared entries.