How I Self-Host a Synced Password Manager

If you person a password manager, chances are you trust connected an online relationship that tracks and stores each of your passwords. It's convenient, but you tin really support your passwords stored disconnected the net portion inactive syncing crossed devices.

The instrumentality present is that I'm utilizing a web to sync my passwords—my backstage network, only. It's not unfastened to anyone extracurricular my home, adjacent myself whenever I leave. This works for maine due to the fact that I enactment from location and seldom travel, and truthful I seldom request to adhd oregon edit credentials erstwhile I'm distant from my location network.

But Why Sync Your Passwords Yourself?

To beryllium clear, the main crushed I bash this simply that I similar feeling successful power of my integer life. When I support my passwords retired of the cloud, I'm not relying connected immoderate third-party enactment to grip my passwords for me. Just look astatine the fallout of the 2022 LastPass breach to recognize what benignant of disasters I'm trying to avoid.

That's not to accidental other cloud-based password managers aren't worthy your time. In fact, if you aren't tech-savvy, I'd urge utilizing 1 of those. I bask gathering my ain systems, though. So if I tin instrumentality afloat power of my passwords—a linchpin of cybersecurity—I volition bash that.

It besides conscionable made consciousness if you spell done the process of mounting up your ain unreality storage. I'll explicate that much later, but if you're capable to rotation your ain backstage unreality storage, you mightiness arsenic good instrumentality afloat vantage of it.

I Start With an Offline Password Manager

The password manager I usage is the escaped and unfastened root KeePassXC, and it stands isolated from competitors by operating wholly offline. It has a comparatively minimal acceptable of features, and astir of them don't request the net to work.

In contrast, astir of the fashionable password managers you cognize are cloud-based. Your stored passwords are kept and synced via a distant server you link to erstwhile you log in.

KeePassXC stores everything successful a vault, a KDBX file, that you support connected your section device. If you privation to entree the aforesaid vault of passwords connected different computer, tablet, oregon phone, you request to manually determination that record to that device.

There are counterparts you could usage instead, similar the archetypal KeePass, but I usage KeePassXC specifically to unfastened my vault due to the fact that it's cross-platform. I usage some Windows and Linux, and KeePass isn't supported connected Linux. On Android I usage KeePassDX, and determination are KeePass-compatible apps for iPhone excessively if you request one.

The occupation is, due to the fact that there's nary built-in syncing service, you tin easy extremity up with aggregate vaults that person antithetic oregon conflicting sets of passwords. If you marque changes to 1 mentation of the vault, you person to transcript it implicit to the different to marque definite you tin entree it determination too. That's wherever Nextcloud comes in.

I Host My Own Cloud Storage Service

I person a Raspberry Pi that I acceptable up to big an lawsuit of Nextcloud "at home." If you're not familiar, Nextcloud is simply a unreality retention work akin to Google Drive that you tin run and negociate yourself.

For your benefit, I'll urge getting a regular Raspberry Pi OS oregon possibly an RPi OS alternate similar DietPi and installing Nextcloud done Docker. I chose to get my lawsuit done NextcloudPi, and I regret it. Over the years, I've had aggregate method issues with my Nextcloud that I learned would person been easier to hole oregon wholly avoidable if I'd conscionable installed Nextcloud utilizing Docker. Learn from my mistakes.

I've stopped abbreviated of making my Nextcloud nationalist to the broader internet, though. Knowing what I've learned implicit the years astir cybersecurity and privacy, I don't consciousness harmless doing that. Staying connected my section web fits my needs good enough, and the convenience of an internet-connected Nextcloud conscionable doesn't outweigh the risks for me.

Hardware You'll Need

If you're going to bash this, you bash request immoderate dedicated gear. This is simply a task perfect for a Raspberry Pi kit oregon a akin SBC (Single Board Computer). It's besides a large mode to repurpose an aged laptop oregon to enactment a mini PC to enactment for you. A laptop mightiness instrumentality up much abstraction than different options, but it has the payment of a built-in show and keyboard.

Whatever you choose, I urge connecting via an Ethernet cable too. Relying connected Wi-Fi to support your unreality successful work introduces a batch of latency that volition dilatory everything down.

I Sync Across Devices

On each instrumentality I acceptable up for myself, the archetypal happening I instal is the Nextcloud lawsuit app. I log successful to my Nextcloud account, sync my KDBX file, and with KeePassXC oregon KeePassDX I instantly person entree to each my passwords. If I marque immoderate changes to the KDBX file, it's instantly synced crossed each devices connected to my Nextcloud server.

Since Nextcloud is simply a afloat record hosting service, I tin support a ton of different important files successful sync this way. If I person a record I cognize I'll beryllium utilizing a batch nary substance what instrumentality I'm on, I'll driblet it successful the "Universal" folder successful Nextcloud, and I'll person it wherever I request my password vault too.

Occasionally, I'll person a instrumentality wherever I request conscionable a fewer passwords, but I don't privation my full postulation connected it. An illustration would beryllium a laptop for work. In that case, I tin conscionable marque transcript of my vault, delete each but the accounts I request for that device, and sync lone that vault to it.

It Isn't a Perfect System

My strategy admittedly has its limitations. The information I don't marque my Nextcloud disposable extracurricular my location tin bounds me. If I request to adhd oregon edit passwords, those changes to my KDBX record don't get synced immediately. Since I'm the lone 1 who needs them, though, that's seldom a problem. Setting up a location VPN server mightiness lick this, but I haven't gotten that acold successful my homelab journey.

Annoyingly, the KeePassDX app connected my telephone sometimes takes a infinitesimal oregon truthful to unfastened the vault erstwhile I'm distant from my location network. I'm not definite wherefore this is, but I'm going to effort making tweaks to my setup to spot if I tin lick that issue.

There Are Other Ways to Do This

On that note, this isn't the lone mode to self-host a synced password manager. Bitwarden is unfastened root and has a guide to hosting your ain Bitwarden instance. I've been trying retired DietPi connected 1 of my Pi's recently, and I noticed it offers a preconfigured Vaultwarden server, truthful I mightiness effort experimenting with that. Either of those setups would destruct the request for Nextcloud.

Of course, you could support a KDBX vault synced utilizing Google Drive oregon OneDrive arsenic well. At that point, though, you're again relying connected a third-party to support your vault from falling into the incorrect hands.

Another enactment that I've seen folks utilizing alongside KeePassXC is Syncthing. It isn't unreality storage, but alternatively a elemental record syncing work that tin tally connected your devices. Since it's simpler, it mightiness beryllium a amended enactment if you don't consciousness a request for afloat self-hosted unreality storage.

Whatever you extremity up doing, marque definite you choose a beardown maestro password. Don't hide to travel sound cybersecurity practices and corroborate that you're avoiding easily cracked passwords.