Selfhosted

It keeps your ass out of negligence I’d say

Girlfriend at the time noticed this on my phone and had some choice questions for me.

That's half the fun, well actually it's a utilitarian app so pretty much all the fun

Well you don't want your ass took, at least not without permission.

Passphrase generator, simplelogin/addy.io integration and sync.

This makes my life so much easier.

Same, and the apps work great.

I used to use keepassxc for years. Kept it synced with sync thing, though eventually work blocked networking with sync thing so I swapped to vaultwarden and never been happier.

it's so good, wish I'd found it sooner

I have the same setup. It's really neat.

Not bothered about the potential for keyloggers or even OS-level snooping on what is presumably your privacy-free Android device? Personally I would never type the master password into anything other than a computer running a FOSS stack that I control, but perhaps that is excessive caution.

Whats it called on ios? Keepassium?

Bitwarden for example does public reports and is pretty cheap at 10€ per year. But the base (free) offering is more than enough. The fee is only to have TOTP and a bit of encrypted cloud storage. https://bitwarden.com/help/is-bitwarden-audited/

I have both set up right now.

Things I like better about KeePass:

KeePass doesn't use the cloud, you don't have to worry about the server getting compromised or going down because there's nothing public-facing to hack. You always know where your password database is.

KeePass lets you encrypt the database with not only the master password but also using the challenge-response from a YubiKey. That means every time you save your DB the encryption key is rotated and the DB is actually encrypted by two authentication factors.

While both can add custom fields to an entry, I like that KeePass has the option to set fields as protected so their contents are hidden like the passwords.

Things I like better about VaultWarden:

Convenience.

You can log in to your VaultWarden account on any device from the browser. KeePass requires some software to access the DB.

The VaultWarden companion software is just better. It just does autofill better. KeePassXC/DX work well but just not as well as the BitWarden software.

Other thoughts:

Syncing passwords between devices with KeePass requires 3rd party software like SyncThing. If you break/lose/etc your VaultWarden server you could lose all your passwords with it.

Always make/test backups.

I switched from keepass to vaultwarden years ago and for my usage I wouldn't switch back.

I needed to be able to share some passwords with other people. I think the clients are much better. I like having a website available as a backup to access a password. All in one package that works well so I don't need separate mechanism to synchronize between different installations. I like the easy sharing secrets through links and not having to send in cleartext with emails or texts.

And for selfhosting I like that you only need the server only for syncing newly added secrets - if vaultwarden had to be online always I'd switch back.

because of the check against darkweb leaks or whatever type feature when you pay. That's seems like an anti privacy thing. I understand it's a good idea albeit seems to expose a lot of information about you

For the password leak checks, your passwords are never transmitted. They are one-way hashed locally, and then only the first few characters of the hash are checked against the API provided at https://haveibeenpwned.com which is run and designed by Troy Hunt, one of the most respected people in the cybersecurity industry. He collects major password breaches and makes them available to check against without actually exposing the data. It's perfectly safe and secure.

The bitwarden clients also work when there's no connection to the server, since they sync the vault. You just can't add any new entries. That means spotty internet is not that much of an issue in terms of using it. It also means, that every device that has a client installed and gets used regularly (to give the client a chance of syncing) is automatically a backup device.

Follow OP's approach. Use a Keepass file. It is offline and can be stored anywhere you can reasonably trust. You just need to sync it if you have many clients but syncthing is great for that.

I host vaultwarden at home. No real need for a vps since your passwords are synced to your phone or laptop(whatever client you're using) and you can just sync it when you're home if you make changes, or setup a VPN (I use wireguard) and sync on demand when needed.

That said, I do sync my database to a vps for dr purposes incase my home server suddenly vanishes... for critical services I follow a 3-2-1 backup rule but it's not absolutely essential.

No in my opinion its worse in every way

Main thing I prefer about KeePass is that it's a straightforward app that creates a file. Self-hosting a database seems just that much more complicated.

I used to be a KeePass user, but moved away because I was ultimately syncing the database using OneDrive, which I felt at that point it was a cloud password manager, which I didn't like for being open to the internet and entrusting the security of the company hosting it.

And yes, I moved to self hosted Vaultwarden with Tailscale and haven't looked back.