So long KeeWeb and thanks for all the secured keys

KeeWeb and NextCloud

I have been a long-time user of the KeeWeb password manager. Although it’s an Electron app, it has been a convenient option that works across any desktop operating system. As its name suggests, it is basically a web application wrapped in a desktop shell.

Having a single password file synced across platforms and devices is something that I really like. No need for a central server, no hassle to host an additional solution or rely on a cloud provider. Just store it on a Nextcloud server and you get propagation everywhere 😉

Unfortunately, the KeeWeb project is not maintained, and the time came when it stopped working on Ubuntu 24.04.1 (quite a while ago). I found a way to hack the Debian package, but it was just a question of time before new problems would emerge.

Long story short, later on I was not able to get it up and running in a (for me) reasonable amount of time on Arch Linux, and thus I had to move on.

Alternative desktop app

I chose to use the nice and fast desktop alternative KeePassXC. The project lacks a plugin ecosystem, but for good reasons. As a Nextcloud and simplicity fan, I missed the seamless integration with it, either as a native plugin or via WebDAV.

A little pause here. What does seamless mean?

When I changed an entry on desktop with KeeWeb or on mobile with KeePass2Android, the changes were synchronized magically without any intervention. KeeWeb’s native integration and KeePass2Android’s merge mechanism worked flawlessly. Basically, you don’t want to end up with a messy key database stored in an encrypted binary file.

I looked for an appealing alternative called pass, but although the simplicity and UNIX architecture are there, the project’s ecosystem is not there and maybe never will be. So I had to explore cloud options or go with a self-hosted one. Vaultwarden is a lightweight alternative to the Bitwarden server solution, with an existing ecosystem that includes desktop and mobile clients, a synchronized database, and even a browser plugin. But still, the additional burden of hosting and maintaining wasn’t something I liked.

Conclusion

But is there another way? When you have synchronization set up already across all the devices with Nextcloud, which part would not work as expected between KeePassXC and KeePass2Android? It turned out that the majority of the problems are not there when you are a bit more careful.

So here is what I did. I stored the key database (kdbx) file in a folder on Nextcloud. I selectively decided to sync it on a desktop computer in the Nextcloud client settings. And then I just opened it from KeePassXC.

NextCloud “passwords” directory sync

KeePass2Android is able to synchronize and merge the databases easily. However, the desktop client might report a conflict when changes happened on mobile. That creates an additional key database file. KeePassXC refreshes the version synced from the server automatically, but the conflicting version must be merged manually afterward. There is a menu item Merge From Database for that.

KeePassXC merge from another database file

Be aware that it replaces conflicting entries with the ones from the database you selected for the merge. Therefore, I tend to avoid parallel modifications without prior sync across mobile and desktop.

And that’s it. All the mentioned products and projects are great and deserve, IMHO, the attention and support.