Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
You can self-host KeePass safely, but you do not install a central KeePass server. KeePass is an encrypted .kdbx database opened by client applications. Your VPS provides private remote storage, synchronization, backups and, if needed, a browser interface. The database remains encrypted at rest; an unlocked client decrypts entries in its own process memory.
A practical design is an Ubuntu Server VPS hardened for administration, a private WebDAV/HTTPS or SFTP endpoint for the database, trusted-device client copies, and at least one versioned backup stored somewhere other than the VPS. Add KeeWeb behind HTTPS only when browser access is worth the additional web surface.
What self-hosting KeePass on a VPS actually means
Self-hosting KeePass is primarily a storage and synchronization project. The VPS does not become a plaintext password database and does not automatically provide a login service for every device. Instead, you place an encrypted KDBX file on infrastructure you control, then open that file from KeePass-compatible applications on your computer or phone.
The master password unlocks the KDBX database in the client. While the file is stored on disk or transferred over an encrypted connection, its contents remain encrypted. Once you unlock it, passwords and notes necessarily exist in the client’s process memory, so device security, screen locking and safe handling of exports still matter.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
There are four common ways to make the file available:
| Choice | Best for | Trade-off |
|---|---|---|
| WebDAV over HTTPS | Clients that load and save a database through a URL | Requires careful HTTPS configuration and WebDAV access control |
| SFTP | People who already administer a VPS through SSH | KeePass desktop requires the IOProtocolExt plugin, and support varies among mobile clients |
| Synced mounted folder | KeePassXC users who already operate a file-sync service such as Nextcloud or Syncthing | Adds another service plus its own conflict, update and backup policies |
| KeeWeb behind HTTPS | Occasional browser access | Adds a web application and another surface that must be patched and protected |
KeePass documentation lists local and network files, FTP, HTTP, HTTPS and WebDAV as protocols that work without plugins. SCP, SFTP and FTPS use the IOProtocolExt plugin. Check each client’s current protocol support before choosing your endpoint.
Recommended Free Tools
Plan the architecture before provisioning the VPS
Keep the authoritative file private
Store the authoritative .kdbx file in a directory that is not web-browsable. A public URL that exposes directory listings, a static file path or a misconfigured download route can turn a storage mistake into a password compromise. The only public-facing service should be the protected endpoint your clients actually need.
Do not put the database in a web server’s document root. Do not expose a Docker socket, WebDAV administration interface or SSH password login to the Internet. Keep administration separate from the endpoint used to open the database.
Choose one working-copy model
For a small personal deployment, keep a local working copy on each trusted device and use the VPS as the shared remote location. Open the remote file, make an edit, save it, and allow the client to synchronize. Alternatively, use a mounted synchronized folder, but then you inherit the synchronization service’s conflict and retention behavior.
Do not assume that simultaneous editing is harmless. Two devices can save different changes before either sees the other. KeePassXC’s merge process matches entry UUIDs and modified timestamps, and older versions remain in entry history. That gives you a way to reconcile edits, but it is not a substitute for a backup or a deliberate save workflow.
Provision and harden an Ubuntu Server VPS
Use a currently supported Ubuntu Server release and create a non-root administrative account immediately. The exact VPS control panel differs by provider, but the security order is the same: establish key-based administration, restrict network access, enable security updates, then publish storage or browser services.
1. Create a non-root administrator
Log in for the initial provider-issued session, create a personal account, and grant only the administrative privileges you need. Ubuntu’s security guidance emphasizes least privilege: use and enforce the principle of least privilege rather than performing routine work as root.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
sudo adduser vaultadmin
sudo usermod -aG sudo vaultadminReplace vaultadmin with your own account name. Confirm that the account can open a new SSH session before closing the original administrative session.
2. Install and test SSH keys
Generate an SSH key pair on your trusted administration computer, copy the public key to the new account and verify a key-only login. Keep the private key off shared computers and protect it with a local passphrase.
ssh-copy-id vaultadmin@your-server-address
ssh vaultadmin@your-server-addressAfter testing, disable SSH password authentication and direct root login in the SSH server configuration. Make one change at a time and keep an existing session open while testing, so a configuration error does not lock you out.
3. Enable a host firewall
Allow SSH before enabling the firewall. Then allow only the HTTPS port required by your chosen endpoint and, if needed, the HTTP port used solely for certificate issuance or redirection. Do not open a database-specific port when WebDAV or SFTP can run through an already protected service.
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseIf you use SFTP through SSH, you generally need only the SSH port; avoid opening additional file-transfer ports without a specific requirement. Review the VPS provider’s network firewall as a second control, but do not treat it as a replacement for the host firewall.
4. Apply security updates automatically
Install updates before deploying the password service and enable unattended security updates or an equivalent scheduled process. Reboot when the operating system requires it, and schedule a maintenance window if a reboot could interrupt access.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →sudo apt update
sudo apt full-upgrade
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgradesKeep a record of the Ubuntu release, installed storage service, reverse proxy and KeeWeb image tag. Knowing what must be updated makes recovery faster after a failed upgrade.
Set up private storage for the KDBX file
Option A: WebDAV over HTTPS
WebDAV is the most direct choice when your desktop and mobile clients accept a URL for opening and saving a database. Deploy a WebDAV service in a private directory, require authentication, and place it behind HTTPS. Use a dedicated account with access only to the database directory rather than reusing your VPS administrator account.
Rank #3
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & convenient login: Plug in your YubiKey via USB-A and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most secure passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
- Create a directory outside the web document root and set ownership and permissions so only the WebDAV service account can read and write it.
- Configure the WebDAV endpoint to permit the methods required by your client, while denying directory browsing and administrative configuration from the public interface.
- Terminate TLS at a maintained reverse proxy and redirect plain HTTP to HTTPS. Use a certificate for the exact hostname your clients will use.
- Test downloading and saving a copy with a non-production test database before uploading your real KDBX file.
- Record the endpoint URL, account name and recovery procedure in a secure offline location.
WebDAV access control is as important as encryption. The KDBX file is encrypted, but an attacker who can replace it can still cause denial of access or attempt a malicious-file scenario against an outdated client. Restrict write access and keep versioned backups so you can restore a known-good file.
Option B: SFTP through SSH
SFTP fits an SSH-centric VPS because it can use the same hardened SSH service and does not require another public port. KeePass desktop needs the IOProtocolExt plugin for SFTP, SCP and FTPS. Some phone clients support SFTP directly, while others support only WebDAV, a local file or a synchronization provider.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Create a separate SFTP account or restricted SSH account for the database directory.
- Use public-key authentication and disable password authentication for that account.
- Limit the account’s shell and filesystem access if your SSH configuration and client workflow support it.
- Install IOProtocolExt only from a source you trust, verify that your KeePass desktop version supports it, and test opening and saving a test database.
- Use the SFTP URL or client-specific file picker rather than placing the KDBX file in a publicly served directory.
The main SFTP limitation is client compatibility. If your phone application cannot open SFTP URLs, choose WebDAV or a separate synchronization method instead of weakening SSH security.
Option C: A synchronized mounted folder
A file-sync system such as Nextcloud or Syncthing can present the KDBX file as a local path. This can feel natural in KeePassXC, but it adds another service, another account system and another set of conflict rules. Synchronization is not the same as backup: a corrupted or deleted file can propagate unless version history is enabled.
Use this model only when you understand how the sync service handles concurrent edits, deleted files and historical versions. Keep the database in a dedicated folder and configure retention separately from ordinary documents.
Add browser access with KeeWeb only if you need it
KeeWeb provides a browser interface for a KeePass database. Its Docker images and Compose deployment are documented by the project. A reverse proxy such as Caddy can provide HTTPS; Caddy documents both Ubuntu installation and a Docker image.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →A safe deployment separates the browser application from the database storage:
- Run KeeWeb in Docker with a pinned, maintained image version rather than an unreviewed floating image.
- Mount only the configuration or read path KeeWeb needs; do not mount the Docker socket into the application container.
- Place Caddy or another maintained reverse proxy in front of KeeWeb and obtain a certificate for a dedicated hostname.
- Restrict the application’s network exposure so the container is reachable through the proxy, not through an unnecessary public port.
- Patch the image, proxy and host regularly, and verify that a stopped or failed container does not expose the KDBX directory directly.
Browser access is convenient on an emergency or borrowed computer, but it expands the attack surface and leaves credentials in a browser process. Prefer trusted, updated devices for routine use and lock the browser session when finished.
Rank #4
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & Convenient Login: Plug in your YubiKey via USB-C and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most Secure Passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to Last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
Connect KeePass clients on desktop and phone
Desktop workflow
- Install a maintained KeePass-compatible client such as KeePassXC on the trusted computer.
- Open the client’s file or network location dialog and select WebDAV/HTTPS, SFTP through IOProtocolExt, or the local path provided by your synchronization service.
- Enter the long master password and, if configured, provide the separate key file or hardware credential.
- Save a small test entry, close the database, reopen it and confirm that the change appears from another client.
- Keep a local copy available for offline access, but ensure that it is protected by full-disk encryption and the same strong unlock policy.
When two devices have changed entries, allow KeePassXC to merge rather than blindly replacing one database with the other. The merge uses entry UUIDs and modified timestamps; inspect conflicts and use entry history to recover an earlier value.
Phone workflow
Choose a mobile KeePass client that supports your selected protocol. WebDAV/HTTPS is often the most portable URL-based option, while SFTP support varies. Download or cache the database only on a device protected by a strong screen lock, current operating-system updates and device encryption.
Configure the app to lock when it goes into the background or after a short idle interval. Avoid opening the database on a borrowed or rooted device. If the phone is lost, revoke its service credentials and restore access only after confirming that the remaining copies and backups are safe.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect the database and its unlocking factors
Use a strong master password
Choose a long, unique master password that is not reused anywhere else. KeePassXC warns that losing the database password can permanently lock the database. Store a recovery record in a secure place that is available when your normal devices are unavailable, but do not store the password beside an unencrypted copy of the KDBX file.
Add a key file only when you can protect and recover it
A key file is an additional factor only when it remains secret and separate from the KDBX file. Keeping both on the same VPS or in the same cloud folder reduces the benefit. KeePassXC also warns that losing the key file means losing access, so maintain a safe backup and test that backup.
Consider hardware challenge-response
KeePassXC supports YubiKey and OnlyKey challenge-response credentials. A YubiKey 5 NFC is an optional physical factor for people who want a hardware device involved in unlocking. The recovery trade-off is strict: if the required hardware credential is lost and no recovery path exists, the database may be inaccessible. Keep a documented spare or alternative recovery method where your threat model allows it.
Lock clients and avoid unsafe exports
Lock the database whenever you step away and configure automatic locking. An unlocked client decrypts data in process memory, so a VPS backup does not protect you from malware on an already-compromised endpoint. Avoid shared computers and delete temporary exports securely.
CSV, HTML and paper exports expose passwords to other components or people. KeePassXC specifically warns about the risk of paper and HTML exports. If an export is unavoidable, create it for the shortest possible time, protect it during handling and destroy every copy afterward.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Back up, version and test recovery
Keep a primary working copy and at least one independent, versioned backup outside the VPS. A second copy on the same server does not help when the VPS account, disk or host is compromised. Automatic backups and database version history are useful, but verify that they are actually being created and can be downloaded.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Recommended backup pattern
- Keep the current KDBX file in the private storage directory.
- Enable the client’s safe-save or pre-save backup option where available.
- Copy encrypted database versions to storage independent of the VPS.
- Retain multiple historical versions so accidental deletion or corruption is reversible.
- Protect backup access with separate credentials and avoid placing the master password in the backup location.
Because the KDBX file is already encrypted, an offline backup can be stored without decrypting it. The backup still requires strong access controls: an attacker can attempt password guessing, delete versions or replace the file.
Perform a recovery drill
- Download a backup to a clean, trusted device that is not the VPS.
- Install a compatible KeePass client.
- Confirm that the master password is available and correct.
- Retrieve the separate key file or hardware credential if your database requires one.
- Open the backup, inspect several entries and verify that historical versions are present.
- Document the result and update the procedure if any step depended on an unrecorded detail.
This drill is a recommended procedure, not a guarantee that every client or backup system behaves identically. Repeat it after changing clients, storage protocols or unlocking factors.
Troubleshoot common failures
The client cannot connect
- Confirm that the hostname resolves to the VPS and that HTTPS presents a valid certificate.
- Check the VPS firewall, provider firewall and reverse-proxy listener.
- Verify the service account’s permissions on the private database directory.
- For SFTP, confirm that the client supports SFTP or that IOProtocolExt is installed and compatible.
- Test with a disposable KDBX file before changing the production database.
The database opens but will not save
- Check write permission for the WebDAV or SFTP account.
- Confirm that the endpoint allows the save methods required by the client.
- Check available disk space and inode usage on the VPS.
- Look for a stale lock or a second device that saved a newer copy.
- Save a local copy, then merge deliberately instead of overwriting the remote file.
Changes from two devices conflict
Do not delete either copy immediately. Preserve both, let KeePassXC compare entries by UUID and modification time, and inspect entry history for the prior value. Once the correct result is confirmed, save the merged database and create a new backup version.
You lost the key file or hardware credential
Stop experimenting with production copies. Locate the protected backup of the key file or the documented spare hardware credential. If none exists, the master password alone may not unlock a database configured to require the missing factor; this is why recovery must be tested before an emergency.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security checklist before going live
- Ubuntu is current and automatic security updates are enabled.
- Daily administration uses a non-root account with least privilege.
- SSH keys work, password login is disabled and direct root login is disabled.
- The firewall exposes only the services you deliberately chose.
- The KDBX file is outside any web-browsable directory.
- WebDAV or SFTP uses a dedicated account and protected credentials.
- HTTPS is valid and renewed automatically where supported.
- Docker socket access is not exposed to KeeWeb or other public containers.
- At least one versioned backup exists outside the VPS.
- The master password, key file and hardware-factor recovery paths have been tested.
- Clients lock when idle and sensitive exports are not left on disk.
When self-hosting is the right choice
A VPS-based KeePass setup is a good fit when you want control over where the encrypted file resides, already maintain a server, and accept responsibility for patching, access control and recovery. It is not maintenance-free: the VPS, endpoint, reverse proxy, browser client and backups all become your responsibility.
The smallest defensible deployment is a hardened Ubuntu VPS with private WebDAV/HTTPS or SFTP storage, trusted local clients and an independent versioned backup. Add KeeWeb only for a clear browser-access requirement. Whichever design you choose, keep the KDBX file encrypted, keep unlocking factors recoverable but separate, and test restoration before you need it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
