Self-host KeeWeb

deployed & timed by usprices checked · Aug 2026

A self-hostable web and desktop client for KeePass kdbx vault files — not a sync server. You host a single-page app behind your own domain and point it at a vault stored on local disk, WebDAV, or a cloud drive, so there is no database and no account system to run.

Key facts

CategoryPassword manager

LicenseMIT

StackJavaScript

Min RAM256 MB

Dockeryes

Difficulty

Our recommendation

KeeWeb solves a different problem from everything else in this category, and getting that straight is the whole decision: it is a client, not a server. It opens KeePass kdbx files that you already keep on disk, WebDAV, or a cloud drive, and it stores nothing itself — no accounts, no server-side vault, no sync of its own. Self-host it when you are already committed to the kdbx format and want a good browser and desktop client on your own domain instead of someone else's. If what you actually want is a vault your devices sync through, none of this applies and Vaultwarden is the pick.

What you need

Any VPS with at least 256 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
Under an hour if you've used Docker before

Install

Run these commands on your server:

# KeeWeb — official container, serves the app over HTTPS on 443
docker run -d --restart=unless-stopped -p 443:443 \
  --name keeweb -v ${PWD}/keeweb:/config \
  ghcr.io/keeweb/keeweb:latest
# No database — your kdbx file lives on disk, WebDAV, or a cloud drive

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

It is the cheapest thing here to run, which makes it easy to overlook what you're taking on:

non-negotiableNo stable release since 2021. Commits still land and newer tags exist, but they are marked as prereleases, so the last release upstream actually calls stable is years behind the code a latest container pulls. Read the repository's recent activity yourself before you put it in front of your only vault, and pin whatever you deploy.

non-negotiableSync is entirely your storage backend's problem. KeeWeb reads and writes one file, so concurrent edits from two machines are a conflict it cannot resolve for you — whatever WebDAV share or cloud drive holds the kdbx is your sync layer, your versioning, and your backup, and none of that comes with the app.

non-negotiableYou own the integrity of the app you serve. Decryption happens in the browser, so anyone who can alter the JavaScript you're serving can read what your users unlock. Put it behind TLS, restrict who can write to the container's files, and treat the hosting itself as security-relevant rather than as a static site.

An alternative to

1Password →

More in Password manager

Password managerBitwarden

The official self-hostable Bitwarden server — full vendor support and enterprise SSO. Heavier than Vaultwarden, but the right pick when you need a supported, on-prem deployment.

C#SQL Server

moderateRead guide →

Password managerPassbolt

A team password manager built on OpenPGP — every secret is encrypted to each user's own key and shared through folder-level permissions, so the server only ever holds ciphertext. The community edition is free to self-host; SSO, LDAP provisioning, audit logs, and password policies are pro-only.

PHPCakePHPMariaDB

moderateRead guide →

Password managerPsono

An end-to-end encrypted password manager aimed at IT teams, pairing a Django/PostgreSQL server with browser extensions and a built-in admin portal. The community edition has no user cap; SSO, audit logging, and policy enforcement live in the enterprise build.

PythonDjangoPostgreSQL

hardRead guide →

Password managerTeamPass

A shared credential vault built for IT teams rather than individuals, organised as a folder tree with per-folder access rules, per-user encryption keys, and a full audit trail. One of the longest-running projects in this category, and it runs on the boring, familiar PHP plus MariaDB stack.

PHPMariaDB

easyRead guide →

Common questions

Is KeeWeb a self-hosted password server?

No — KeeWeb is a client, and that distinction matters before you deploy it. It opens and edits existing KeePass kdbx files (or creates new ones), but it stores nothing itself: there is no user database, no sharing model, and no server-side vault. Self-hosting KeeWeb means hosting the app, not your passwords.

Where does KeeWeb store my vault?

Wherever you point it: a local file you open in the browser, a WebDAV share, or a cloud drive such as Dropbox, Google Drive, or OneDrive. Sync is whatever that storage backend already does, so two people editing the same kdbx concurrently is on you to avoid.

Can I use KeeWeb with KeePass and KeePassXC?

Yes — it reads and writes the standard kdbx format, so the same file works across KeeWeb, KeePass, and KeePassXC. That is the main reason to pick it: it is a nicer front end for a vault format you may already be committed to.

How much does it take to run KeeWeb?

Very little — the container is a static web app plus a service worker for offline use, so a 256 MB box is comfortable and the smallest VPS tier will do. Put it behind TLS anyway, since it handles vault contents in the browser.