KeePassXC vs Vaultwarden

Last reviewed Aug 24, 2026 · 613 words

Both keep your passwords out of LastPass's next breach disclosure, but they disagree about what a password manager is. KeePassXC says: an encrypted file (.kdbx) on your disk, opened by a desktop app, with no server anywhere — synchronisation is a separate problem you solve with tools you already trust. Vaultwarden says: a lightweight server you run, spoken to by Bitwarden's official clients on every platform, with accounts, organizations, and sharing. File versus service. The right answer follows from who uses it and what you fear.

The service: why Vaultwarden usually wins the household

Vaultwarden's decisive advantage is that you don't use Vaultwarden — you use Bitwarden's apps, which are excellent: browser extensions that autofill reliably, iOS/Android integration, TOTP codes, passkey storage, emergency access, and organizations for sharing the Netflix login without a group chat. The server is a 128 MB Rust container. The costs are operational and real: it's an always-on service with an attack surface (HTTPS mandatory, signups locked down, updates monthly), and — the part people underweight — you are now running credential infrastructure, with the backup obligations that implies. The clients' offline cache softens outages (read-only access continues), but a dead server with no backup is an unrecoverable category of mistake. The Vaultwarden guide covers the full checklist.

The file: what KeePassXC's austerity buys

KeePassXC has no server to patch, no ports to expose, no domain, no TLS, and no 3 a.m. "is the vault container healthy" thought. The database is one file encrypted with Argon2; an attacker needs the file and your passphrase (plus the optional key file — a strong second factor that never leaves your machines). Browser integration comes via its extension talking to the local app, TOTP and passkeys are supported, and the format is an open standard with a dozen compatible apps. The tax is synchronisation: you place the .kdbx in Syncthing or Nextcloud, and mobile means a third-party (but mature) KeePass app like KeePassDX or Strongbox reading that synced file. It works well — and it's exactly the sort of assembly some households will never tolerate, and the KeePass ecosystem's merge handling makes simultaneous edits on two devices something to avoid rather than something solved.

Threat models, honestly

For remote attackers, KeePassXC's posture is strictly smaller: nothing listens. Vaultwarden behind Tailscale-only access closes most of that gap while keeping the app polish — the configuration the threat-modeling post lands on for most people. For the availability threat — you die, or the server does, and family needs the passwords — both have answers (Bitwarden's emergency access; a sealed envelope with the KeePass passphrase), but only if you set them up this month rather than eventually. And both beat the actual baseline threat, which is password reuse because the manager was too annoying to use — the strongest argument for whichever one your household will genuinely adopt.

Decision table

What I'd do

For a household: Vaultwarden over Tailscale, backups tested, signups closed — the polish is what makes the family actually use unique passwords, and that's the whole ballgame. For a solo technical user with Syncthing already humming: KeePassXC plus a key file is beautifully unkillable. The wrong answer is neither — it's the browser's password store on a Google account you were trying to migrate away from.