KeeWeb

Last reviewed Aug 26, 2026 · 744 words

KeeWeb answers one narrow need well: you already keep a KeePass .kdbx file and you want to open it from any browser without installing anything. It is a static web application, so hosting it is copying a folder, there is no server database to back up, and encryption happens entirely in the browser using the same format KeePassXC reads. The catch is in the catalogue's last line. Development has slowed to the point where I would not choose KeeWeb for a new setup in 2026, and I would think carefully before keeping it as the primary way into a vault I depend on.

No server database means the file has to live somewhere

KeeWeb is a client, not a service. It opens a .kdbx from a local file, from a WebDAV share, or from Dropbox, Google Drive and OneDrive through their APIs, and it writes changes back to the same place. For a self-hoster the WebDAV path is the interesting one: point KeeWeb at the WebDAV endpoint of a Nextcloud instance, and the same file that KeePassXC on the desktop and KeePassDX on Android already sync becomes reachable from a browser too. Concurrent edits are handled the way KeePass tools always handle them, by merging on save. The file is the source of truth; KeeWeb is one window onto it.

Hosting it is a folder behind TLS

Download the web build from the project's GitHub releases, unpack it, and serve it:

mkdir -p /srv/keeweb
unzip KeeWeb-*.html.zip -d /srv/keeweb

keeweb.example.com {
    root * /srv/keeweb
    file_server
}

An official Docker image exists as well, but a static server such as Caddy or nginx is fewer moving parts for what is essentially one HTML file plus assets. TLS is not optional: the browser features KeeWeb depends on, from clipboard access to Web Crypto, require a secure context. Cross-origin rules are the other snag, since a browser will not let KeeWeb talk to a WebDAV server on a different domain unless that server sends permissive CORS headers. The simplest route is serving KeeWeb from a path on the same domain as the WebDAV endpoint, or using the community Nextcloud app that embeds it, if it still installs on your Nextcloud version. The catalogue's 128 MB is the web server; KeeWeb itself costs your server nothing after the first page load. Keep a copy of the release archive you deployed somewhere safe: if the project ever disappears, the static build you already have is fully functional, works offline, and can be re-served from any web server in minutes.

The maintenance signal matters more for a password tool

KeeWeb is MIT-licensed with nearly 13,000 stars, but releases have been rare for years and the issue tracker moves slowly. For a wiki that is a shrug; for the program that decrypts your passwords in a browser it is a real factor. The .kdbx format itself is not at risk, since KeePassXC and others maintain it actively, and KeeWeb has no server side to exploit, so the exposure is the client code and its dependencies ageing. My position is that it remains acceptable as a read-mostly emergency window onto a vault, and is no longer a good primary client.

Where it loses to Vaultwarden and KeePassXC

Vaultwarden gives you official Bitwarden apps, browser autofill that works everywhere, sharing and TOTP, on 128 MB of server RAM, for the price of running one small service. KeePassXC gives you a maintained desktop client for the same file KeeWeb opens, with a browser extension for autofill. KeeWeb's own extension exists but is far less complete than either, and it has no team or sharing features at all, as the catalogue notes. The KeePassXC vs Vaultwarden comparison is the decision most people should be making; KeeWeb is a footnote on the KeePassXC side of it.

What I'd do

If you have a KeePass vault and want browser access, keep KeePassXC and KeePassDX as your daily clients and, if you must, host KeeWeb as a static site behind TLS on a subdomain, opened only when you are away from your own devices. If you are starting from nothing, do not start here: Vaultwarden is the better self-hosted password setup by every measure except "no server process", and nothing else in the password managers category beats it for a household.