Best way to use KeePass, KeePassX or KeePassXC

Hello.
I’ve used Keepass for some years and switched reacently to KeepassXC 2.2.0, because of their community effort and because it is running much smoother on my Linux machines, than Keepass on Mono. On Android I’m using Keepass2Android, which is a very good app.

First things first: If you use Keepass (and derivates) everything is saved in one single file! And that is the the crux. Of course there is a database in it, but you don’t access just a database, you access and change one single file, its time stamp, …
Second: When you now look closer to file services like Seafile, Dropbox, etc. and the way they work, you will see, that even if they support delta sync (Seafile does, when using the desktop clients) the smallest entity for the user to see and for apps like Keepass to use is the file. So, there is always just one version of your keepass database at the same time available.
Conclusion: If you sync your Keepass database (remember: just one single file) over different devices (maybe not always in sync because of not always online; simultanious use; worst: more than one Keepass database user, …), you can/will very likely end up with different versions/file conflicts/overwrites and so for the worst case with password loss.
(Seafile has very good file versioning and okeyish conflict handling (Dropbox and Co. are not better in this point), so you might restore every version of you DB file, BUT in these use case scenario you first have to realize that you maybe have created some mistakes at all.)
So, to summerize: If you are a very careful user, syncing a keepass database with such services like Seafile over different devices, can work, but is very, yeah let’s say, dangerous. (Can be with a simple document file and a syncing services, too :wink: .)

For me I choose the following solution:

  • The Keepass database is synced by the Seafile client over my different PCs. In my case, I have one “main working machine” and I try to always change my keepass database only here. (If I change it elsewhere I make a note and check the sync, but it’s better to note the change and catch up with it later on the main machine.)
    So after all: Only one device writes changes, the other devices are read only. Mostly you just need your passwords and don’t add/change a lot, so this is ok.
    (In addition: This way of use will become much safer, when Seafile gets “read-only-sync” in later versions.)

  • On mobile, I deploy my Keepass database manually by just simply downloading the file via the Seafile Android App or at home in my network over samba. So, on my mobile phone the database can be outdated, but I always have one version on my phone and always can get the newest database version as long as I have internet access. So this is ok, too. I use Keepass on my phone also as read-only.
    If you want a decent sync on mobile, there are two main solutions:
    .1. Because the Seafile mobile app has no sync feature, you can use one of the many mobile sync apps which support sync ober Webdav and sync it over these apps and Seafile’s Webdav. (Remember: Webdav is not working with encrypted libraries.)
    .2. You can automate the sync at home in your network, via samba, ftp, … There are apps for this as well. As soon as your phone logs into your network, a new version of the database will be deployed if there is any.
    .3. You can directly access your database in the seafile cloud with Keepass2Android via Webdav and the app will provide you an offline version of the database as well in case you loose internet connection. (Thanks @epinez!)

I hope this will help you a bit! My clunky solution was the only way for me to have my passwords available on all my devices and not using services like lastpass. I would never give my passwords to an external. So I must live with this trade-off.

Let me know what your thoughts are.

Greets Nytrm

EDIT: @epinez mentioned that Keepass2Android will hold a offline version in case you access the keepass database via webdav.

3 Likes