This is my first post here, but I have been a regular reader of PG for some time now. I would like to ask about the password managers. I have used Bitwarden for most of the time. This is until last year when I made a switch to Proton Pass. My subscription to PP + SimpleLogin is going to expire this month. I would like to use KeePass as I feel it will bring more control over my data. Also, I could place KeePass DB in a folder which would be backed up by my backup software regularly with version control. I have mainly 3 systems - macOS + ipadOS + GOS with 2 main profiles. But, I make changes to vault via macOS only, very rarely I had to change anything via other 2 devices.
I am planning to use KeePassXC on macOS and sync DB via newly released Proton Drive CLI, if any change is detected. That DB then could be downloaded on other devices and could be used via respective KeePass clients. I know this is a one-way sync, but from my usecase so far - I think this will work for me.
What are few suggestions/thoughts for this setup? Also, could any totally offline password manager user tell me things that I am overlooking right now?
Hello! I run a similar setup to yours. I’ve been a long-time user of KeePassXC, and I’ve used the original ‘KeePass’ project as well.
On mobile, I would recommend that you might want to try setting your mobile KeePass-compatible client to ‘read-only mode’ for your KDBX? Since most of your edits could be done from the computer instead and to avoid duplicates of KDBX having different entries, etc.
I also use Proton Drive myself (only from the website though), and I prefer to upload manually to sync between my devices. I’m curious about your choice for preferring the CLI version—are you planning to automate the sync process?
Thanks for reply and thanks for pointing out that I could setup a KeePass client in read-only mode.
I recently integrated Proton Drive CLI in my habits trackers setup, getting few plots and logs on the drive that I could read on other devices. This setup up is nothing but few shell and python scripts running together, creating plots and markdowns to add in Obsidian vault, again 99.9% changes are expected to be done via computer and one-way sync is working totally fine. I was thinking doing the same for KeePassXC DB - maybe writing a small script to setup a watch folder or to compute SHA256 of DB, if it is changed then rename old DB on Proton Drive and upload new one, otherwise skip. I can experiment with intervals when the script should run itself.
On browser, I am not always logged into my account. I could setup a Firefox profile for it, but feels tedious instead of running a small script. On iPadOS and GOS, Proton Drive apps feel slow. But then again, just to download few files, it is fine and serves the purpose well.
For clients,
iPadOS - I think there are no other good choices than KeePassium. I have looked the free version’s feature-set and everything looks good on the surface. The only thing I may require from premium features is to have ability to have more than 1 DB. I could test for few days before purchasing premium.
GOS - I am open for suggestions. I have looked at Keepass2Android and KeePassDX. What are your thoughts on these 2?
KeePassium is alright – I’m not aware of a better alternative to it that is fully open-source. You may want to read its PrivacyGuides’ review, specifically the part about synchronization, there is a word of caution there about Proton Drive; I don’t know if that is still up-to-date though – according to recent news, the iOS Files integration of Proton Drive has suddenly disappeared, which means it can’t be accessed by KeePassium at all.
For Android I recommend KeePassDX – it is a very sleek app and I actually like it better than KeePassXC on desktop.
I know you’ve said one-way sync is sufficient for your use case, but Syncthing really sounds like the best solution for syncing files across platforms. If you’re wondering which apps to use, then there is BasicSync on Android, and I vouch for Sushitrain on iOS.
I used to use KeePass synced over the cloud for everything but I eventually stopped because it’s extra hassle for virtually no benefit. If you’re depending on the cloud to sync/backup your “offline” password manager, it loses pretty much all of the benefits of being an “offline” password manager while retaining much of the inconvenience. If you’re worried about putting too many eggs into the Proton basket, you’re probably better off going back to Bitwarden.
Setting repeating reminders to manually create encrypted local backups of your Bitwarden or Proton Pass database every few weeks will give you about as much control as KeePass + cloud syncing without any of the inconveniences that come with KeePass.