Free tools Windows power users keep installed
One-click scans. No signup required.
Yes—you can self-host KeePass on a VPS by storing your encrypted .kdbx database there and letting trusted KeePass clients open it over WebDAV/HTTPS, SFTP, or a synchronized private folder. The VPS stores and transfers the encrypted file; it is not a central plaintext password database. Decryption occurs only in an unlocked client on your computer or phone.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A safe deployment therefore has two separate jobs: harden the VPS and provide a narrowly controlled storage endpoint. Keep local client copies, maintain a versioned backup outside the VPS, and test that you can recover without the server.
As an Amazon Associate I earn from qualifying purchases.
What “self-host KeePass” actually means
KeePass is an encrypted database file plus client applications. Your entries, passwords, notes, attachments, and database metadata live in the KDBX file. A VPS can provide remote storage, synchronization, backups, and—optionally—a browser interface, but it does not need to process or store your passwords in plaintext.
When a client opens the database, it downloads the encrypted file, asks for the master password and any additional credential, and decrypts the contents in the client process. An unlocked client necessarily holds sensitive data in memory. Lock clients when you step away, avoid opening the database on shared computers, and treat every export as a secret.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The authoritative file should be in a private directory that is not part of a web document root. Publish only the protocol your clients need, and keep administration (SSH, WebDAV management, Docker, and backups) on a separate access path.
Choose a storage and access design
| Choice | Best for | Trade-off |
|---|---|---|
| WebDAV/HTTPS | Clients that support URL-based loading and saving | Requires careful HTTPS and WebDAV access control |
| SFTP | SSH-centric VPS administration | KeePass desktop needs the IOProtocolExt plugin; client support varies |
| Synced mounted folder | KeePassXC plus a file-sync system such as Nextcloud or Syncthing | Adds another service and conflict/backup policy |
| KeeWeb behind HTTPS | Occasional browser access | Adds a web surface that must be patched and protected |
WebDAV over HTTPS
WebDAV is usually the most straightforward choice when your desktop and mobile clients can open a database by URL. KeePass supports WebDAV and HTTPS directly, so no protocol extension is needed. Use an HTTPS URL, strong endpoint authentication, and an account that can access only the database directory. Do not leave WebDAV administration publicly exposed or allow anonymous writes.
SFTP
SFTP fits a VPS that is already administered through SSH. KeePass’s standard file support covers local and network files, FTP, HTTP, HTTPS, and WebDAV; SCP, SFTP, and FTPS use the IOProtocolExt plugin. Install the plugin from a trusted source, check that your client version supports it, and use SSH keys rather than an SSH password. Mobile support varies by application, so confirm that the client can both download and save the KDBX file before making SFTP your only route.
A synchronized private folder
You can keep the KDBX in a folder synchronized by a service such as Nextcloud or Syncthing and point KeePassXC at the local path. This can work well for devices that are online intermittently, but it adds another service, another credential set, and another conflict policy. Synchronization is not a backup: retain independent, versioned copies.
KeeWeb for occasional browser access
KeeWeb adds a browser client, useful on a machine where a desktop application is unavailable. Deploy it in Docker, keep the container on a private listener, and place it behind an HTTPS reverse proxy such as Caddy. The browser still needs the database and its unlocking credentials; adding a web interface increases the number of components that must be patched and protected.
Provision and harden the VPS before uploading the database
Start with a currently supported Ubuntu Server release. The following sequence establishes a least-privilege administrative account, key-based SSH, a host firewall, and automatic security updates before any password service is published.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
1. Create a non-root administrator
Log in through the provider’s console for the initial setup, then create a named account and grant administrative rights:
sudo adduser vaultadmin
sudo usermod -aG sudo vaultadminUse a name that is not obvious, but do not rely on obscurity as a control. Test a new SSH session as this account before closing the console session.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Install an SSH key and disable password login
From your workstation, copy a public key to the new account:
ssh-copy-id vaultadmin@your-server-addressAfter confirming key login works in a second terminal, create a drop-in SSH configuration:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →sudo sh -c 'printf "PasswordAuthentication nonPermitRootLogin non" > /etc/ssh/sshd_config.d/60-keepass-hardening.conf'
sudo sshd -t
sudo systemctl reload sshKeep an existing, verified session open while testing the reload. If the syntax check fails, fix it before reloading. Store a recovery key securely; losing every administrative key can lock you out of the VPS even though the KDBX itself remains intact.
3. Apply updates and enable unattended security updates
sudo apt update
sudo apt full-upgrade
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgradesUbuntu’s security guidance emphasizes least privilege, regular updates, firewalling, and unattended upgrades. Review update logs periodically and schedule a maintenance window for reboots when the kernel or other critical components require one.
4. Enable UFW with a minimal ruleset
Allow SSH before enabling the firewall, then open only the service ports you actually publish:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verboseIf WebDAV, KeeWeb, or another HTTPS endpoint is served directly from this host, allow HTTPS. If a reverse proxy is the only public listener, keep the application container bound to localhost or an internal Docker network rather than opening its port to the Internet. Restrict SSH by source address only when you have a reliable way to maintain that allowlist.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Put the KDBX file in a private, non-web directory
Create a directory outside every web root and limit access to the account or service that needs it:
sudo install -d -m 700 -o vaultadmin -g vaultadmin /srv/keepass
sudo chmod 600 /srv/keepass/passwords.kdbxThe filename is not a security boundary, but a non-obvious name can reduce casual discovery. The important controls are directory permissions, authenticated transport, and the absence of a public download route. Never place the file under a directory served as static web content, and never test access by visiting its URL in a browser.
Rank #3
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & convenient login: Plug in your YubiKey via USB-A and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most secure passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
For WebDAV, configure a dedicated account with access limited to this directory, require TLS, and permit only the operations your clients need. For SFTP, use a dedicated account or an SSH restriction that prevents shell access when your client workflow allows it. Keep the VPS administrator account separate from the account used to read and write the database.
Do not expose the Docker socket, WebDAV management interface, or an SSH password prompt to the public Internet. An attacker who obtains a writable path to the KDBX can replace the encrypted file, delete it, or wait for you to open a tampered copy even without immediately learning its contents.
Connect desktop and mobile clients
WebDAV or HTTPS workflow
- Install a KeePass-compatible client on the trusted device.
- Use the client’s open or load-by-URL command and enter the complete HTTPS/WebDAV address of the KDBX file.
- Authenticate with the dedicated storage account when prompted. Do not embed long-lived credentials in a shared browser profile.
- Unlock the database with the master password and, if configured, the key file or hardware credential.
- Save changes through the same endpoint and wait for the client to report a successful write before closing it.
Exact menu labels differ between KeePass clients and mobile applications, but the required capabilities are the same: URL loading, authenticated saving, and a way to lock the database. Test a harmless change and confirm it appears on a second trusted device before moving your normal workflow.
SFTP workflow
- Install IOProtocolExt for a KeePass desktop client that does not support SFTP natively.
- Configure the client with the VPS hostname, the dedicated SFTP account, and an SSH key.
- Open the remote KDBX path and save a test change.
- Confirm that the client writes the file atomically or reports a completed upload before another device opens it.
Because plugin and mobile support varies, keep a local copy available while validating the setup. A client that can download but not save is not a usable synchronization method.
Mounted-folder workflow
If a sync service presents the VPS copy as a local folder, open that local path in KeePassXC. Wait for the synchronization indicator to show that the KDBX is fully transferred before opening it. Never edit two unsynchronized copies and assume the service will merge encrypted binary files safely; use KeePassXC’s merge process when concurrent edits occur.
Keep local copies on trusted devices
A local working copy gives you access during a VPS outage and provides a second recovery path. Keep permissions restrictive, enable the client’s lock-on-idle behavior, and do not leave the database unlocked while a remote session is unattended. The server copy should be treated as a synchronization target and backup source, not your only copy.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteOptional: deploy KeeWeb behind HTTPS
Use KeeWeb only if browser access solves a real problem. Start by installing Docker and Compose through your operating system’s supported packages, then create a dedicated application directory:
sudo install -d -m 750 /opt/keeweb
cd /opt/keewebUse the official KeeWeb Docker image and Compose definition, pinning a reviewed image version rather than silently tracking an unverified latest tag. Keep the container’s listener private and expose it only through the reverse proxy. Do not mount the Docker socket into the KeeWeb container, and do not give the container write access to unrelated VPS directories.
Rank #4
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & Convenient Login: Plug in your YubiKey via USB-C and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most Secure Passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to Last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
With Caddy installed as the reverse proxy, a minimal site block has this shape:
keepass.example.net {
reverse_proxy 127.0.0.1:8080
}Replace the example hostname with a domain you control and point its DNS record at the VPS. Caddy can obtain and renew a public certificate when DNS and inbound HTTPS are correctly configured. Verify that the browser redirects to HTTPS, that the application port is not reachable directly from the Internet, and that the KDBX storage endpoint still has its own authentication and permissions.
Patch both the KeeWeb image and the reverse proxy. A browser client expands your attack surface: a vulnerability in the static application, proxy, container runtime, or authentication layer can affect availability or confidentiality even though the KDBX remains encrypted at rest.
Use a strong master password and optional second factors
Master password
Choose a long, unique master password that is not reused anywhere else. KeePassXC warns that losing the database password can permanently lock the database. There is no server-side reset that bypasses the encryption. Store the recovery instructions in a place your future self or a designated trusted person can reach, without leaving the password in the same unprotected directory as the KDBX.
Key files
A key file adds a factor only when it remains secret and separate from the KDBX file. Storing the key file beside the database on the same VPS largely defeats that separation. Keep an encrypted backup of the key file in a different secure location, because KeePassXC also warns that losing it means losing access.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHardware challenge-response credentials
KeePassXC supports YubiKey and OnlyKey challenge-response credentials. A YubiKey 5 NFC is an optional physical factor for readers who want a hardware-backed unlock step. The recovery trade-off is significant: if the hardware key is lost or damaged and no replacement or recovery method exists, the database may be unrecoverable. Register and test a recovery device before relying on hardware-only access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Back up the database and plan for recovery
Keep a primary working copy and at least one independent, versioned backup outside the VPS. A single encrypted file on one server is vulnerable to deletion, disk failure, account compromise, and mistakes made during maintenance.
Use safe-save and version history
KeePassXC can create a backup before saving and supports on-demand database backups. Enable those options so a failed write or accidental edit leaves an earlier version. Retain multiple dated versions rather than overwriting one backup file repeatedly.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Store backups independently
Copy backups to storage that is not mounted continuously on the VPS. Protect the backup location with its own authentication and encryption. Do not rely on the same WebDAV account, VPS disk, or synchronization service for both the live copy and every backup generation.
Recommended Free Tools
Run a recovery drill
- Download a dated backup to a clean, trusted device.
- Install a compatible KeePass client.
- Confirm that you have the master password and, if used, the separate key file or hardware credential.
- Open the backup without overwriting your working database.
- Check several representative entries, attachments, and the database’s modification history.
- Record the date and result, then remove the temporary unlocked copy and any exports.
This drill proves that your backup is readable and that your credentials are available. It also exposes a common failure mode: a backup can be intact while the person who needs it no longer has the key file or hardware token.
Resolve edits made on more than one device
Do not let two devices write different versions of the same KDBX simultaneously when you can avoid it. Close the database on one device, wait for its upload or synchronization to finish, and then open it elsewhere.
When concurrent edits do happen, KeePassXC’s merge process matches entries by UUID and modified timestamps. It can preserve changes made on both devices, and prior versions remain in each entry’s history. Make a backup of both files before merging, open the merge operation deliberately, and inspect entries that changed on both sides. Never delete one copy until you have verified the merged result and created a new backup.
Protect unlocked data and exports
The KDBX is encrypted while stored, but an unlocked client decrypts data in process memory. Lock the client when idle, enable automatic locking where available, and avoid using the database on shared or unmanaged computers.
Exports require special care. KeePassXC warns that paper and HTML exports expose passwords to other components; CSV and similar exports are equally sensitive. Create an export only for a specific purpose, keep it in a restricted temporary location, transfer it through an encrypted channel, and delete it securely as soon as the task is complete. Do not place exports in a public web directory or leave them in a downloads folder.
Troubleshoot the common failure modes
Authentication succeeds but the file will not save
- Check that the account has write permission to the directory, not merely read permission to the file.
- Verify that the endpoint allows the write methods required by the client and that a reverse proxy is not blocking them.
- Check disk space and filesystem ownership on the VPS.
- Try a harmless edit with one client only, then inspect the server and client logs.
The client reports a certificate or HTTPS error
- Confirm that the hostname in the URL matches the certificate.
- Check DNS resolution and that inbound HTTPS reaches the reverse proxy.
- Ensure the system clock on the client and VPS is accurate.
- Do not bypass certificate validation to make the connection work.
SFTP is unavailable in the KeePass client
Install and enable IOProtocolExt, restart the client, and verify plugin compatibility with the installed KeePass version. If the plugin is unavailable on a mobile device, use WebDAV/HTTPS or a synchronized folder supported by that client instead of weakening SSH security.
A newer device shows an old version
Wait for synchronization to finish, check the file’s modified time, and confirm that both devices use the same endpoint. If both contain legitimate edits, make separate backups and use KeePassXC’s UUID-and-history-aware merge rather than replacing one file blindly.
You lost the master password, key file, or hardware credential
There is no safe administrative shortcut around the KDBX encryption. Locate a documented recovery copy or alternate credential. If none exists, preserve the encrypted file and your backups, but expect that the data may remain inaccessible.
Quick Recap
Operational checklist
- Ubuntu Server is current and unattended security updates are enabled.
- A named, non-root administrator uses SSH keys; root and SSH password login are disabled.
- UFW denies unsolicited inbound traffic and exposes only required ports.
- The KDBX resides outside web roots with restrictive filesystem permissions.
- WebDAV/HTTPS or SFTP is authenticated, encrypted, and limited to the required path.
- Any KeeWeb container is patched, privately bound, and reached only through an HTTPS reverse proxy.
- The master password is long and unique.
- Any key file is secret, separate from the KDBX, and backed up safely.
- At least one versioned backup is stored outside the VPS.
- A clean-device recovery drill has succeeded.
- Clients lock when idle, and temporary exports are deleted promptly.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
