Vaultwarden
this post was submitted on 15 Mar 2026
52 points (93.3% liked)
Selfhosted
57575 readers
904 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
I ended up going with KeePassXC on desktop + KeePassDX on Android, synced via Syncthing. Here is what made it work reliably:
- Set Syncthing to sync only the
.kdbxfile (not the whole vault directory) - Enable "ignore permissions" on the Android side
- Use Syncthing's file versioning (simple, keep 5 versions) as a safety net against corruption
- On Android, KeePassDX can directly open from the Syncthing folder — no extra steps
The Syncthing-Fork situation is concerning, but the original Syncthing Android app still works. You can grab it from F-Droid or GitHub releases directly.
Alternatively, if you already run any kind of server (even a small VPS), Vaultwarden is genuinely fantastic. It is a lightweight Rust implementation of the Bitwarden API — runs in a single Docker container using maybe 20MB RAM. The official Bitwarden apps on every platform just connect to your self-hosted instance. Setup takes about 10 minutes with Docker Compose + Caddy reverse proxy.
I have been running Vaultwarden for about a year and it has been completely bulletproof for syncing across 4 devices.
Its a port of linux pass with git built in.
You backup your passwords in a private repo and sync back and forth. It's great if you already use pass
Yeah, pass has been discussed a bit in the thread already, but there are a few security issues that keep me from using it. Speaking of security, I had no idea the Android app was archived in 2024. That's quite a long time without updates. Are you using a fork?
Thank you for sharing your workflow wither way! Using a git based solution would be amazing.
Vaultwarden, no question. When I used KeePass, I had Synology Drive which worked well to sync.
@clifmo @versionc not on android but vaultwarden syncs across basically everything. Mac, Linux, Windows, ios, and should hit the bitwarden app and extensions on android too. my only extras catch is I put it behind my tailnet. so I have to have the device on it to see it. Though if you are trying to stay away from bitwarden/vaultwarden I'm not sure.
Works perfectly on android. Push notifications, sync, passkeys, everything
Bitwarden.
Paid. Not because I need the added paid features, but because I value it and want to show my appreciation for the developers.
Paid bitwarden.
I use Bitwarden too. I now use the paid version (which is incredibly cheap) but I was able to sync between Android and PC without the paid for version iirc
The only (known to me) perk of the paid version is the encrypted storage (and probably the org feature).
So yeah. I see it more of a donation/appreciation than a service fee.
But the recent peice increase stung a bit.
Paid also helps if you share passwords with multiple people.
KeepassXC and Nextcloud. Been working fine for years.
Same setup here. Worked for years and I've no plans to switch. As long as Nextcloud is up, bidirectional editing is simple. Trouble comes when one of the clients edited the KeePass file and can't sync.
I've had that happen though rarely. In those cases it's been easy to manually merge the one or two entries if necessary.
I've been using KeePass for almost 20 years now, used to host the database on Google Drive. I started using Syncthing about a year or so ago, including Syncthing-Fork on my Android devices. It's nearly flawless - I sync the database across 6 devices (two phones, two laptops, gaming PC, NAS [which is backed up regularly]), so there is the occasional conflict maybe once every few months, but I think that's more user error than anything else. It's fairly easy to resolve since Syncthing clearly labels the affected file.
It's very important to remember that "Syncthing-Fork" IS NOT the official Syncthing project. Syncthing-Fork uses Syncthing under the hood while providing a mobile-friendly wrapper.
Edit: Catfriend1 (the original maintainer of Syncthing-fork) recently put in their 2 cents.
TL;DR - The new dev is fine. For me personally, the fact that 1) devs from both F-Droid and Syncthing itself have reviewed and confirmed that the code is safe, and 2) the original maintainer vouched for the new guy, is good enough for me. There will always be those who refuse to trust anything, even from the original developer, and they are often the most vocal about it - i.e. the "vocal minority". Whether or not you want to listen to their criticisms is up to you. IMO, they're just beating a dead horse.
I'm a vaultwarden user, who likes the idea of both the bitwarden and the keepass way. Just to consider new possibilities, isnt it possible to put the keepass db in a private git (selfhosted forgejo or gitea). And sync the repo with an app like puppygit which syncs automatically everytime I open or close keepass. Is this a safe walkthrough?
I like the idea of using git, and there are people using it with their KeePass database (here's an example), but I don't think it's optimal. If you want to use git, pass is probably the better option, but that brings in a whole lot of other problems.
I've started using Nextcloud to sync my database and it's worked out fine so far. Though it would be nice to use something like git that I use all the time regardless, right now the whole bloated Nextcloud stack I have hosted only syncs my small password database haha.
OpenCloud seems promising. It's a fork of ownCloud from former developers of ownCloud, lighter weight than NextCloud, it uses flat files to store data rather than a DB, and it has an Android client on F-Droid (and Google Play).
I'm hesitant about OpenCloud. Their parent company is Heinlein Group, whom I know nothing about, nor can I find anything about their reputation. The website uses a lot of marketing fluff, which puts me off already.
If you're curious, their GitHib issues and website have a bit more about them: https://github.com/opencloud-eu/opencloud/issues/231
The Heinlein Group, to which OpenCloud belongs, is probably best known as the operator of the email provider mailbox.org, but also develops OpenTalk, an open source video conferencing solution.
from heise.de.
Being the owner of mailbox.org doesn't mean anything to me, but it's context. And there's more info in that GitHub issue's links.
My impression is that they know what they're doing when it comes to production ready software--I share the OPs concerns about the syncthing-fork maintainer--and they have the funding and acumen to stay in business, meaning their software will be maintained.
I can't endorse them beyond my own personal opinion though. I don't have any info beyond what a few hours of digging turned up last time I looked into them.
This bit from the heise.de article stood out:
Kiteworks, on the other hand, is less than enthusiastic about – a closed group of developers who are now using the same code in their own company that they already developed under Kiteworks or ownCloud? For Kiteworks, this smells like poaching, so the company is going on the offensive: in an interview with heise online, Kiteworks CEO Jonathan Yaron stated that he intends to sue Peer Heinlein under German and US law: "We love open source, but we won't let anyone steal from us".
facepalm
Keepass + syncthing = win
Personally, I use Keepass with syncthing and it works fine enough. If you don't really trust the new person behind Syncthing-Fork, you could always install the older version before the handover (I think before v3.4?). If you really don't trust syncthing at all, you could just manually back it up. New passwords aren't made every day, so you could just copy the passwords database over between your devices whenever there's a change. That's what I did before I heard about syncthing, and is what I do with my music still, since I don't regularly update what music I listen to.
Vaultwarden with the Bitwarden Android app and browser extension for my desktop. I already have a solid system for backing up the important data for all my docker containers. As soon as I added it, it was automatically added to that process.
My spouse has an account so if I die she can gain access to my passwords with a simple request. That's function is important to me.
My exact answer as well. Saved me some typing - thanks :)
If you're using a keepass database, Keepass2Android can natively sync with many cloud options including self hosted and generic ones, even without specific "companion" apps. That's what I use. In my case, it's backed by my NextCloud, but it used to be Google drive before.
Just also sync the file on your PC, merging changes from different clients is part of the keepass database format and "just works".
Also VaultWarden works great if your can self host it, but I prefer keepass for a variety of features and integrations.
KeePass2Android is a fantastic project. I've been using it for 10+ years on my Android devices. Every once in a while I'll try a different variant, like KeePassDX, but I always return to the spartan look of KP2A. It "just works", with no extra fluff.
merging changes from different clients is part of the keepass database format and “just works”.
This is the best thing about KeePass in general.
I use Vaultwarden. Each synced device is a backup, so there's no real need to keep anything further than that, but I do keep one backup of the server files anyway.
Yeah, that's a good point. There are still a few cons though:
- If the server goes down (or your internet connection goes down), you can't add entries to your database. Local changes aren't allowed.
- Bitwarden doesn't support supplementing your passphrase with a key file.
- The Bitwarden clients aren't enitrely FOSS as far as I understand, the SDK used has a non-free license.
There are pros and cons in both alternatives, and there is unfortunately not a perfect solution. I like the idea and philosophy behind the KeePass format, so the increase in syncing complexity is worth it (for now at least).
It's true re adding passwords while the server is offline, but my server runs 24x7 and it's never down for more than a few minutes. If it goes down, I fix it. I also backup the encrypted DB regularly to cloud, so there is little risk of data loss. I am a very satisfied Vaultwarden user. Especially because it allows password sharing with my family. Everyone has an account.
Vaultwarden handles the syncing for me.
However I do export backups on both my phone and laptop just in case.
load more comments
(4 replies)
bitwarden
seems odd you say how cumbersome it is to manage and backup (not an issue I've faced though) and yet you are using some cumbersome alternative ?
Nextcloud and favorite the file. It's worked reliably forms for years. I don't need to create new passwords on my phone, though.
Keypass with the vault loaded onto a free OneDrive account.
Just back it up occasionally.
On Android I use KeePassDx Syncthing-Fork. The handover was rough but the maintainer of the Play version joined researchxxl's team. Many on the Syncthing forum seem to have accepted research which is good enough for me. Also, KeePass's database in encrypted so no danger there.
load more comments
(7 replies)
Syncthing-Fork is still untrustworthy since the disastrous handover
Maybe I'm OOTL on this?
I thought everyone concluded that it was poorly communicated but ultimately no indication of any foul play.
Correct.
That conversation has finished, the dust has settled and syncthing-fork is fine.
I share your sentiment about Syncthing-Fork and the botched handoff to researchxxl. I have yet to implement the Termux-based workaround that allows me to use Syncthing from the browser without the Android app / wrapper. It looks pretty clean as it's just pure Syncthing with a little starter script.
load more comments
(1 replies)
I use KeepassDX syncing via Nextcloud, works flawlessly. I also used to use Keepass2Android, also works very well.
Can you elaborate on the "nextcloud doesn't support 2-way syncing on android" statement? I can sync my Keepass database back and forth without issues.
load more comments
(8 replies)
KeePass2Android:
Selfhost Vaultwarden. Browsers Bittwarden extensions and Android with Keyguard app.
view more: next ›