While it doesn't quite answer the question, I ended up switching from Keepass to Vaultwarden, with the Bitwarden client on all devices. It only syncs at home or while on my VPN, sure, but Bitwarden stores its data locally so even if I can't connect to Vaultwarden, I can still grab credentials from the local copy.
this post was submitted on 24 Mar 2026
15 points (94.1% liked)
Selfhosted
56957 readers
474 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
ditto, switched from keepassxc to vault/bitwarden. Couldn't be happier. I have it accessible via cloudflare tunnels, so I always can sync so long as I have internet.
Once I set up S3 cloud storage, I'll have offsite backups as well.
Yeah realistically I could set mine up to be accessible behind Pangolin, but it's the kind of thing I feel more comfortable leaving purely on the LAN. Mostly paranoia.
Syncthing. If you run it on your phone you can keep it always running :)
If you have an old phone or a tablet at home, you can even skip the server step since you already have an always online, low energy consumption device running anyway.
Second this. In the spirit of a 3-2-1 backup scenario, I also like to keep a copy on SpiderOak or Proton Drive and that works well for me. Encrypted cloud storage is my recommendation. And store your key file someplace apart from the database.
This is my setup, though my phone is set to only run syncthing while plugged in and on wifi. My server is always online and taking backups, but if it's down all of my devices still have their own copy.
I set up KeepassKC with Syncthing temporarily years ago while looking for other options. To my surprise it's worked so well there's been no reason to change to anything else.
The database file is always backed up to multiple devices. With Syncthing file versioning turned on older backups are available if that file gets corrupted, but in 8+ years I've never had to use one of those older backups.
Initially I was using Syncthing discovery servers which allowed syncing from anywhere, but I've since moved away from that. Now everything is run locally and I use Wireguard to connect to my home network when I'm away.
I'd get that old Pi running with a cheap SSD, set up Wireguard (or just use the Syncthing discovery servers), put it on a shelf and forget about it. It'll probably run for years with minimal attention.
I have used KeePass for 10+ years and used Android and Windows when I first set it up. Now I need it to work on iOS, Android, Window and Linux and moving away from KeePass was not an option I wanted to consider.
My solution is to use KeePassXC on Windows/Linux^1^, KeePassDX on Android and Strongbox on iOS. To sync the file between all units, I use Syncthing (MöbiusSync on iOS). I have a server always online running syncthing to make sure that at least on node has the latest version.
The only problem I have with this setup is that Strongbox does not auto update, I have to select open existing file and select the same kdbx file (and Strongbox will update the vault etc). Saving changes does not seem to be a problem but I usually do a manual scan in MöbiusSync to make sure updates are pushed.
[1] The reason I use KeePassXC over vanilla KeePass is because the devs from KeePassXC and Strongbox communicate to make sure their applications are compatible. A file created with one works with the other seamlessly.
An alternative to Syncthing is Resilio.
I use both on Windows and iOS - Resilio does a better job syncing in the background.
Either one is a good answer though (and I generally prefer ST anyway).
I put my database within the path that’s mounted to my nextcloud container. KeePassium on iOS lets you connect to WebDAV which is one way to have Nextcloud host it. It’s good about letting you access the database offline if you lost connectivity.
3:2:1 backup can still happen via whatever method you use for all the rest of your files. So far this is working fine (albeit a bit slow at times) on an RPI. Remote access via Wireguard VPN.
Thanks everyone. Syncthing does seem like the ideal option for me and what I'll be going with.
I'd just like to hear opinions if I should also run syncthing on my VPS as well or just on my home PC?
Depends on how many copies you want, how willing you are to maintain it, and how much you want to risk your database being copied.
Well ideally having it on a VPS would give me on-the-go access to the most recent copy, which might not be as important if continuous background sync between my home PC and iOS really works with syncthing.
Having someone steal my keepass database file would be suboptimal, but not the end of the world. I don't think (or at least I really hope) that current tech can't brute-force keepass databases.
Sure they can, but as long as you picked a secure password it ought to take them long enough to make it impossible, in practical terms. Nobody is gonna spend years trying to break the encrypted database of some random Internet user, especially when it might be five or five hundred years till you pop it, and you don't know which until it's done.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| RP-1 | Rocket Propellant 1 (enhanced kerosene) |
| RPi | Raspberry Pi brand of SBC |
| SBC | Single-Board Computer |
| SRB | Solid Rocket Booster |
| SSD | Solid State Drive mass storage |
| VPN | Virtual Private Network |
| VPS | Virtual Private Server (opposed to shared hosting) |
| Jargon | Definition |
|---|---|
| Starlink | SpaceX's world-wide satellite broadband constellation |
[Thread #188 for this comm, first seen 24th Mar 2026, 16:30] [FAQ] [Full list] [Contact] [Source code]
Not quite
Before I got more into selfhosting, I was running nothing but syncthing in a Raspberry Pi.
The pi was the "Server" and all the other Clients were only connected to the pi (in syncthing).
Worked flawlessly :)