Free tools Windows power users keep installed
One-click scans. No signup required.
You can self-host KeePass safely on a VPS, but you do not run KeePass as a central password database. KeePass stores credentials in an encrypted .kdbx file; your VPS provides private remote storage, synchronization, backups and, if you need it, a browser interface.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest design keeps the authoritative file outside the web root, exposes only a tightly controlled WebDAV/HTTPS or SFTP endpoint, uses local copies on trusted devices, and maintains a versioned backup somewhere other than the VPS. A browser front end such as KeeWeb is optional and increases the number of components that must be patched.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What self-hosting KeePass on a VPS actually means
KeePass is an encrypted file format plus client applications. The VPS does not become a plaintext password server. It stores the encrypted database and makes that file reachable to your desktop, phone or tablet through a protocol those clients support.
When a client opens the database, it decrypts the contents in its own process memory. Anyone who obtains only the locked .kdbx file still faces the database’s encryption and your master credentials, but an unlocked device can expose the passwords to malware, another user or an unsafe export. Self-hosting therefore changes where the encrypted file and backups live; it does not remove the need to secure every client.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A practical target architecture
- A current Ubuntu Server VPS with a separate, non-root administrative account.
- SSH-key administration, a host firewall and automatic security updates enabled before any password service is published.
- The authoritative
.kdbxfile in a directory that is not web-browsable. - One private synchronization method: WebDAV over HTTPS, SFTP, or a separately managed synced folder.
- Optional KeeWeb in Docker behind an HTTPS reverse proxy such as Caddy.
- Local client copies on trusted devices and at least one independent, versioned backup.
This arrangement lets you use KeePass from multiple locations without handing the database to a third-party password-hosting service, while retaining the recovery features of the KeePass file format.
Choose the access method before you deploy
The protocol determines which clients can connect, what you must expose on the VPS and how much administration you take on.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Choice | Best for | Trade-off |
|---|---|---|
| WebDAV over HTTPS | Clients that can load and save a database by URL | Requires correctly configured TLS, authentication and WebDAV access control |
| SFTP | People already administering the VPS through SSH | KeePass desktop needs the IOProtocolExt plugin; support on other clients varies |
| Synced mounted folder | KeePassXC users who already operate a file-sync system such as Nextcloud or Syncthing | Adds another service, account set and conflict/backup policy |
| KeeWeb behind HTTPS | Occasional browser access | Adds a web application and another patching and authentication surface |
KeePass’s official protocol documentation distinguishes built-in and plugin-based access. Local and network files, FTP, HTTP, HTTPS and WebDAV work without an additional protocol plugin. SCP, SFTP and FTPS use the IOProtocolExt plugin. Confirm that every phone and desktop client you intend to use supports your selected method before putting the database on the server.
Prepare and harden the Ubuntu VPS
Perform the host-hardening work while the VPS has no public password service. Ubuntu’s security guidance emphasizes least privilege, SSH protection, firewalling and timely updates.
1. Create a non-root administrator
Log in once with the provider’s initial account, then create an ordinary account with administrative escalation:
sudo adduser kpadmin
sudo usermod -aG sudo kpadminChoose a unique passphrase for this account. Test a second SSH session as kpadmin before closing the original session so a typo does not lock you out.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute2. Install and test an SSH key
On your administration computer, create an Ed25519 key if you do not already have one:
ssh-keygen -t ed25519 -C "vps-administration"Copy the public key to the new account, then verify that key-based login works. After that test succeeds, disable password authentication and direct root login in the SSH daemon configuration. Keep a second, offline recovery key in a protected location if this VPS is important.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Turn on the firewall
Allow SSH from your administration address or trusted network where practical, allow HTTPS only if you will publish WebDAV or KeeWeb, then enable UFW:
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseDo not open a port for a service you have not chosen. If WebDAV is the only service, it needs HTTPS; SFTP uses the SSH port and does not require a separate public file-transfer port.
4. Apply security updates automatically
Install and enable Ubuntu’s unattended security updates, and still review update reports regularly. Automatic updates reduce the time a known host vulnerability remains unpatched, but they do not replace monitoring or an upgrade plan for Docker images, KeeWeb or a reverse proxy.
Store the database outside the web surface
Create a directory owned by the account or service that must read the database, with permissions that exclude unrelated users. Do not put the .kdbx file in a web server’s document root, a public Docker bind mount or a directory indexed by a reverse proxy.
A private endpoint should require authentication and should serve only the operations your clients need. For WebDAV, use HTTPS for every connection and restrict methods and paths to the database directory. For SFTP, create a dedicated account or restricted SSH key where possible; it should not have shell access or broad access to the rest of the VPS.
Never expose the Docker socket, WebDAV administration interface or an SSH password login to the public Internet. Administrative access and password-file access are separate trust decisions and should remain separate.
Recommended Free Tools
Option A: WebDAV over HTTPS
WebDAV is usually the smoothest choice when your clients can open and save a database by URL. KeePass and KeePassXC can address an HTTPS/WebDAV database directly, and many mobile clients offer a similar remote-file workflow.
Deployment sequence
- Install a WebDAV-capable HTTPS service on the VPS, using a dedicated virtual host and a directory outside any general-purpose website root.
- Issue a valid TLS certificate for the hostname and redirect plain HTTP to HTTPS. Do not send database credentials over an unencrypted connection.
- Create a dedicated WebDAV account with a long, unique password. Avoid reusing your VPS administrator credentials.
- Restrict the WebDAV location to the database path and disable directory listing. If the server supports method restrictions, allow only what the client needs for reading, locking and saving.
- Upload the initial encrypted database through an authenticated connection. Open the URL from a desktop client, make a harmless test entry, save, and confirm that the updated file can be downloaded from a second trusted device.
WebDAV gives you URL-based loading and saving, not a shared editing engine. Two clients can still edit separate copies at the same time. Use KeePassXC’s merge behavior and database history rather than assuming the server will resolve concurrent writes.
Rank #3
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & convenient login: Plug in your YubiKey via USB-A and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most secure passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
Option B: SFTP through SSH
SFTP is attractive when you already operate SSH and prefer not to deploy WebDAV. It uses the VPS’s SSH service and can be restricted with a dedicated key, account and directory.
What to configure
- Create an SFTP-only account or a key restricted to the database directory.
- Disable interactive shell access for that account and prevent it from reading unrelated files.
- Keep SSH key administration separate from the key used to transfer the database.
- Use a client that supports SFTP. On KeePass desktop, install the IOProtocolExt plugin because SFTP is not one of the built-in protocols.
Support varies on phones and other clients. Test opening, saving and reconnecting after a network change before treating SFTP as your only route. If a mobile application cannot write SFTP files reliably, use WebDAV or a managed synced folder for that device instead of weakening SSH restrictions.
Option C: A synced folder
A third pattern is to synchronize a private folder to each trusted device with a system such as Nextcloud or Syncthing, then point KeePassXC at the local file. This can provide offline access and lets the sync system maintain its own version history.
The extra service is also the drawback. You must patch it, secure its accounts, decide which devices may sync, and understand how it handles simultaneous edits. Keep one client as the normal writer when possible. If two devices do edit, let KeePassXC merge the databases rather than replacing one file with the other.
Optional browser access with KeeWeb
Use KeeWeb only if you genuinely need a browser interface. It is not required for desktop or mobile KeePass clients, and it creates an additional web application that must be updated and protected.
Run KeeWeb in Docker
Use the image and Compose pattern documented by the KeeWeb project. Keep the container’s configuration in a controlled volume, avoid mounting the host’s Docker socket, and do not mount your database into a public static-file directory. KeeWeb should reach the encrypted file through the private WebDAV/HTTPS endpoint or another deliberately configured backend.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPut it behind HTTPS
Place KeeWeb behind a reverse proxy such as Caddy. A minimal Caddy site concept looks like this, with your own hostname substituted:
passwords.example.net {
reverse_proxy keeweb:80
}Terminate TLS at the proxy, forward only the required application traffic, and keep Docker’s internal service port off the public interface. Protect the browser application with its own authentication controls and restrict who can reach the hostname. A browser session that has unlocked the database is still a sensitive endpoint, even though the file itself remains encrypted at rest.
Rank #4
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & Convenient Login: Plug in your YubiKey via USB-C and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most Secure Passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to Last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
Set up desktop and phone clients
Desktop workflow
- Install KeePass-compatible software such as KeePassXC on a trusted, fully updated computer.
- Keep a local working copy of the
.kdbxfile. Configure the client to open the remote URL or synchronized local path according to the protocol you selected. - Enable the client’s safe-save and automatic-backup options, choosing a protected local backup directory.
- Make a small test edit, save, close the database, reopen it and verify the change from another trusted device.
- Lock the database whenever you step away. Do not leave an unlocked session on a shared or unattended computer.
KeePassXC’s merge process compares entry UUIDs and modification timestamps. When two copies contain different edits, merge instead of overwriting. Older versions remain in an entry’s history, which gives you a way to recover a prior value after an accidental change.
Phone and tablet workflow
- Choose a KeePass-compatible mobile client that supports your selected protocol or can open a synchronized local copy.
- Import the database by its HTTPS/WebDAV URL, SFTP location or local sync path.
- Store any key file in the device’s protected storage, not beside a publicly reachable database URL.
- Enable the app’s auto-lock and biometric convenience features only after setting a strong device passcode.
- Test offline viewing, saving after reconnecting and re-locking before relying on the phone while traveling.
Mobile support is not uniform: an app may read a remote file but fail to save it, or support WebDAV but not SFTP. Treat an unsuccessful save as a synchronization failure, not as proof that the server lost data. Preserve the local copy and compare it with the server version before trying again.
Protect the master credentials
Use a strong master password
Choose a long, unique master password that is not used for the VPS, WebDAV account, email or any other service. KeePassXC warns that losing the database password can permanently lock the database. There is no support reset that bypasses the encryption.
Add a key file only when you can recover it
A key file is an additional factor when it is kept secret and stored separately from the .kdbx file. Keeping both on the same VPS or in the same unprotected folder defeats much of that separation. KeePassXC also warns that losing the key file means losing access, so maintain a safe backup that is not publicly reachable.
Consider hardware challenge-response
KeePassXC supports YubiKey and OnlyKey challenge-response credentials. A YubiKey 5 NFC can therefore serve as an optional physical factor for readers who want a hardware credential, provided they keep a recovery method and a spare or backup plan. Hardware does not eliminate the need for the master password, backups or a secure client.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Backups, version history and recovery
The encrypted database should exist in more than one place, and at least one copy should be independent of the VPS. A mirrored copy is not enough if a mistaken deletion, ransomware event or account compromise propagates to every mirror.
Use layered backups
- Keep the primary working copy on your normal trusted device.
- Enable KeePassXC’s backup-before-save and on-demand database backup features.
- Keep a versioned backup outside the VPS, with access controls separate from the WebDAV or SFTP account.
- Retain enough history to recover from a bad edit discovered days later.
- Back up the key file and recovery credentials separately, because a database backup without them may be unusable.
Do not treat exported HTML or CSV files as harmless. KeePassXC warns that these formats expose passwords to other components. If you must export for a migration, use a temporary protected location, remove the export immediately after use and check that it is not being synchronized or indexed.
Run a recovery drill
- Download a versioned backup to a clean, trusted device.
- Install a compatible KeePass client.
- Confirm that the master password, key file and any hardware credential needed for that backup are available.
- Open the backup and inspect several entries, attachments and recent history records.
- Only after validation, restore or promote that copy to the working database.
This procedure exposes missing keys, forgotten passwords and damaged backups before an emergency makes them critical.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Understand synchronization conflicts
Remote storage does not serialize edits. If a desktop and phone both open the database, go offline and save different versions, the next upload may create a conflict or overwrite a newer file depending on the client and sync layer.
Before editing after a long offline period, download or refresh the latest copy. When KeePassXC reports differences, merge using entry UUIDs and modification timestamps. Inspect the entry history for the previous password, URL or note, then preserve the correct value and save a new version. Never resolve a conflict by deleting both files and keeping whichever one has the newest filename.
Operational security checklist
- Use a separate administrative account and SSH keys; disable root and password-based SSH login after testing key access.
- Allow only required firewall ports, normally SSH for administration and HTTPS for WebDAV or KeeWeb.
- Keep the
.kdbxfile outside web-browsable directories. - Patch Ubuntu, the reverse proxy, Docker images, KeeWeb and client applications.
- Use unique credentials for VPS administration, file transfer and database access.
- Keep at least one versioned backup outside the VPS.
- Store key files separately and maintain a recoverable copy.
- Lock clients when idle and avoid unlocking the database on shared computers.
- Delete temporary HTML, CSV or plaintext exports immediately after use.
- Review access logs and investigate unexpected downloads, failed logins or new SSH keys.
Troubleshooting common failures
The client cannot open the remote database
Check DNS, the firewall and the TLS certificate first. Then verify the exact URL or SFTP path and confirm that the account has read permission. A WebDAV endpoint that shows a login page in a browser may still reject the HTTP methods a KeePass client uses to save.
The file opens but will not save
Confirm write permission, WebDAV method support and available disk space. For SFTP, verify that the client has a compatible IOProtocolExt installation and that the restricted account can create a temporary file and rename it. Do not grant broad permissions as a quick fix; correct the service’s path and account policy.
Two devices show different passwords
Stop editing both copies. Preserve each file, identify which one was last known to be correct, then use KeePassXC’s merge and entry-history features. After saving the merged database, reopen it from every device and discard only the obsolete working copies.
You lost the master password or key file
There is no safe server-side reset. Locate your documented recovery copy, backup key file or hardware-credential plan. If none exists, assume the encrypted database cannot be recovered and replace the affected credentials through their individual services.
Which design should you choose?
Choose WebDAV over HTTPS when several clients need straightforward URL-based loading and saving and you are willing to maintain a properly authenticated HTTPS service. Choose SFTP when SSH is already your operational center and every required client supports SFTP, including the desktop plugin requirement. Choose a synced folder when offline work is important and you already have a trusted file-sync system with clear conflict and retention rules. Add KeeWeb only for a real browser-access requirement; otherwise, omitting it reduces your attack surface.
Bottom line
A VPS can be a dependable home for an encrypted KeePass database if you treat it as private storage and synchronization infrastructure, not as a magic password server. Harden Ubuntu first, expose one narrowly scoped protocol, keep the database out of the web root, protect master credentials and key files, preserve versioned backups off the VPS, and test recovery. The encryption protects the file at rest; disciplined access control and secure, locked clients protect it while you use it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
