A few years ago, the commercial cloud password manager I was paying a monthly subscription for suffered a massive security breach. Hackers walked away with encrypted vaults belonging to millions of users. That was the moment I realized that outsourcing the keys to my digital life to a third-party corporation was a terrible idea.
I started looking for best password managers that actually respected user privacy and didn’t lock my data in a proprietary silo. If you truly want to own your data, you have two choices: host a Vaultwarden server on a VPS, or use an offline vault like the KeePass ecosystem.
In this guide, I’ll walk you through how I set up KeePassDX on Android and KeePassXC on Linux/Windows to create a bulletproof, decentralized password management system. We’ll cover everything from biometric unlocks and browser integrations to setting up WebAuthn Passkeys and TOTP codes.
Why Choose KeePass? The Local Database Advantage
Unlike cloud managers, KeePass operates on a local, highly encrypted .kdbx file that you completely control. There are no subscriptions, no telemetry, and no centralized honeypots for hackers to attack.
At its core, KeePass uses modern cryptographic standards like AES-256 and the ChaCha20 stream cipher to encrypt your vault. But the real magic happens in the Key Derivation Function (KDF).
Modern KeePass uses Argon2id. Why does this matter? Because Argon2id requires physical RAM to compute hashes. If a hacker steals your .kdbx file and tries to brute-force your master password using massive GPU arrays, they will fail because GPUs lack the RAM required by Argon2id. (If you’re unsure if your credentials are safe right now, read our guide on how to check if your password has been leaked).
Multifactor Database Authentication
Instead of relying purely on a password generated by our password generator, KeePass lets you combine authentication methods:
- The Master Password: A long, high-entropy passphrase known only to you.
- A Key File: A file containing 256 bits of cryptographically secure random bytes. To open your vault, you must supply both the password and this physical file.
- Hardware Keys: You can use physical YubiKeys to sign challenge-response prompts on desktop clients.
Crucial Warning: If you use a key file, never upload it to the same cloud folder as your database. Store it on a physical USB drive. If you are exploring deeper encryption tools, keeping key components separated is rule number one.
Setting Up KeePassDX on Android
KeePassDX is a native, telemetry-free password manager for Android. You can download it directly from the Google Play Store or F-Droid.
Creating Your First Vault
- Launch KeePassDX and tap Create a new database. Save it to your local device storage.
- Under encryption settings, select Argon2id.
- Tune the parameters based on your phone’s processor. I recommend setting memory to at least 64 MB, iterations to 10, and parallelism to 4. (If the database takes more than two seconds to open, lower the memory configuration slightly).
- Create a strong Master Password.
Enabling Biometric Quick Unlock
Typing a 20-character passphrase every time you log into a website on your phone is miserable. Fortunately, KeePassDX integrates securely with Android’s hardware-backed KeyStore.
- Go to Settings > Security.
- Enable Biometric Unlock.
- KeePassDX will encrypt your Master Password and cache it inside the Android Secure Enclave (HSM).
- You can now unlock your database instantly with your fingerprint, while the master password remains securely isolated.
Setting Up Android Autofill
To make KeePassDX automatically suggest passwords inside Chrome or other apps:
- Open your Android System Settings > Languages & Input > Autofill service.
- Select KeePassDX.
- Inside the KeePassDX app, go to Settings > Form Filling and enable the Autofill service.
Now, whenever you tap a login field, your phone will prompt you for your fingerprint, fetch the credential from your .kdbx file, and drop it into the form. (This works beautifully, even if you are connecting to internal apps running on a Proxmox home lab or managing a Kubernetes cluster). If you prefer editing configurations from your phone, you can also copy passwords into text editors like Micro or Nano via SSH.
Setting Up KeePassXC on the Desktop (Windows/Linux)
To access your vault on a computer, you need the desktop client: KeePassXC. It is a community-driven C++ application that is lightning-fast and natively cross-platform.
If you are on Ubuntu, you can install it using standard Linux commands:
sudo apt install keepassxc -yThe Browser Extension Handshake
You do not want to manually copy and paste passwords from the desktop app into your browser. Instead, install the KeePassXC-Browser extension (available for Firefox, Chrome, and Edge).
How does this stay secure? The browser extension and the KeePassXC desktop app communicate via a local loopback socket symmetrically encrypted using the NaCl (libsodium) cryptographic library. It’s essentially End-to-End Encryption running locally on your motherboard.
When you load a webpage, the extension asks the desktop app for matching credentials. KeePassXC prompts you for permission, and if approved, securely fills the form. No malware can sniff your clipboard, meaning even if a virus bypassed your ClamAV antivirus and AppArmor/SELinux protections, your credentials remain safe inside the KeePass process memory.
Next-Gen Authentication: Passkeys and TOTP
The world is moving past standard passwords. The KeePass ecosystem is fully equipped to handle both WebAuthn Passkeys and Time-Based One-Time Passwords (TOTP).
Managing Passkeys
Passkeys replace traditional passwords with public-key cryptography. Your client generates a unique cryptographic key pair: the public key goes to the website, and the private key stays in your KeePass vault. When you log in, your private key signs a mathematical challenge to authenticate you.
- On Desktop: The KeePassXC browser extension intercepts passkey requests and routes them to the desktop app, which stores the key pair directly inside the database entry.
- On Android: KeePassDX integrates with the modern Android Credential Manager API, allowing you to sign passkey challenges natively using your fingerprint.
Generating TOTP Codes Natively
You don’t need Google Authenticator or Authy. You can store your two-factor authentication (2FA) seeds directly inside KeePass.
- When a website gives you a 2FA QR code, copy the underlying base32 secret text string instead.
- Inside your KeePass entry, click Set up TOTP and paste the seed.
- KeePass will dynamically generate the rotating 6-digit codes.
Why is this better? Because when you back up your KeePass .kdbx file, you automatically back up all your 2FA tokens. You will never lose access to your accounts just because you dropped your phone in a lake. (Though you should still be wary of phishing attacks—always check a website before clicking a link to ensure you aren’t pasting your TOTP into a fake portal set up by an attacker using OSINT investigations or Google Dorking).
Syncing Your Vault Across Devices
Because KeePass is entirely offline, you are responsible for syncing the .kdbx file between your phone, laptop, and desktop. Here are the two best ways to do it.
Method 1: Peer-to-Peer Syncing with Syncthing
If you want maximum privacy and zero cloud servers, use Syncthing.
Syncthing securely syncs files directly between your devices over your local Wi-Fi or via encrypted relay servers when you are away. It’s like having your own private P2P network.
- Install Syncthing on your PC and your phone.
- Pair the devices by scanning the QR code.
- Create a shared folder on your PC (e.g.,
~/KeePass/) and place your.kdbxfile inside. - Accept the shared folder on your phone.
- If you modify the database on both devices at the exact same time, Syncthing will generate a conflict file. Simply open KeePassXC on your PC, select Tools > Merge Database, and it will safely merge the conflicting entries.
Method 2: Private Cloud Sync with Nextcloud (WebDAV)
If you prefer the convenience of cloud storage but still want to control the server, host your database on a Nextcloud server.
You can easily deploy Nextcloud using Docker on Ubuntu (or use Podman if you prefer daemonless containers). To keep it secure behind a firewall, configure UFW and Fail2ban.
Once Nextcloud is running:
- Generate an App Password in Nextcloud’s security settings.
- In KeePassDX on your phone, tap Open Database and select the WebDAV protocol.
- Paste your Nextcloud WebDAV URL (e.g.,
https://your-server.com/remote.php/dav/files/user/vault.kdbx), your username, and the App Password. - KeePassDX will safely download the vault, cache it locally, and push changes back to Nextcloud using HTTP PUT requests (if you’re curious about HTTP verbs, read how HTTP works for beginners).
Expanding Your Self-Hosted Ecosystem
Taking control of your passwords is the gateway drug to the self-hosted lifestyle. Once you realize how empowering it is to own your data, you’ll want to self-host everything.
You can use Docker Compose to deploy a Jellyfin media server for your movies, Paperless-ngx to digitize your physical documents, and Pi-hole to block advertisements network-wide.
To keep everything running smoothly, deploy Uptime Kuma to monitor your services and track logs via Linux system logs. If you script automated backups via systemd (use our cron expression generator), you can push the archives off-site using SFTP. Ensure your Linux file permissions are correct (check with our permission calculator) so unauthorized users can’t read your backups.
If you decide to expose any of these services to the public internet, don’t forget to protect them behind a secure reverse proxy like Caddy or manage them with robust firewall security. If you’re building APIs, our guide on building a Node.js REST API covers securing endpoints, and if you are pushing code, you’ll want to use Git and GitHub. Finally, verify how domain names resolve in what is DNS and what happens when you type a URL.
Official Documentation
- KeePassDX Official Site: https://www.keepassdx.com/
- KeePassXC Official Site: https://keepassxc.org/
- Syncthing Documentation: https://docs.syncthing.net/
Frequently Asked Questions (FAQ)
What is KeePassDX?
KeePassDX is an open-source, offline password manager specifically designed for Android devices. It reads and writes .kdbx database files, making it completely compatible with desktop KeePass clients like KeePassXC on Windows, macOS, and Linux.
Does KeePassDX sync across devices automatically?
KeePassDX does not have a built-in cloud sync feature because it is designed to be completely offline and secure. To sync your passwords across devices, you must store your .kdbx file on a cloud storage provider (like Nextcloud) or use peer-to-peer sync tools like Syncthing.
Does KeePassDX support Passkeys?
As of recent updates, KeePassDX (and its desktop counterpart KeePassXC) actively support storing and using Passkeys (FIDO2/WebAuthn credentials). This allows you to log into supported websites securely without a password, entirely offline.
Can KeePassDX generate TOTP codes?
Yes, KeePassDX has a built-in Authenticator feature. You can store your TOTP (Time-based One-Time Password) secret keys inside your database, and KeePassDX will generate the 6-digit 2FA codes for you, removing the need for a separate app like Google Authenticator.
Is KeePassDX safe to use?
Yes. KeePassDX is completely open-source, ad-free, and respects user privacy. Your passwords are encrypted locally on your device using military-grade AES-256 encryption. The app never sends your data to any external server.
What happens if two devices edit the database at the same time?
If you are syncing via Syncthing or a cloud provider and both devices modify the .kdbx file simultaneously, a conflict file is created to prevent data loss. You can easily merge these conflict files back into your main database using the “Merge Database” tool in KeePassXC.
Can I use my fingerprint to unlock KeePassDX?
Yes. KeePassDX natively supports Android’s BiometricPrompt API. It securely caches your master password inside the Android hardware-backed KeyStore, allowing you to unlock your vault using your fingerprint or facial recognition without weakening encryption.
Do I need to buy a subscription?
No. Both KeePassDX and KeePassXC are 100% free and open-source software (FOSS). There are no hidden paywalls, premium tiers, or subscription fees.
How do I use KeePass passwords in my desktop browser?
You should install the official KeePassXC-Browser extension for Firefox, Chrome, or Edge. It securely communicates with the KeePassXC desktop application in the background, allowing you to autofill forms without ever copying and pasting passwords to your clipboard.
What is Argon2id in KeePass?
Argon2id is a modern Key Derivation Function (KDF) used by KeePass to transform your master password into the actual encryption key. Unlike older algorithms, Argon2id requires memory (RAM) to compute, making it highly resistant to brute-force attacks from massive GPU arrays.
Discussion
Loading comments...