Синхронизация паролей через Syncthing: как заменить серверный менеджер файлами

When I started self-hosting, I quickly realized that many of the services I use actually depend on a server. A few exceptions exist, and one that has become indispensable for my setup is my password manager, KeePassXC. Its vault remains an ordinary encrypted file, and with Syncthing, I can move it across devices. While it trades some convenience for not running a password-manager server, it also removes the need for a reverse proxy, an updating password-manager container, and a web UI that had to stay reachable. The first sync was almost boring My vault didn't need the sync tool to understand what it was carrying After changing a password on my laptop, I locked the screen. Just a minute later, when I picked up my phone, that same password entry was updated. This happened seamlessly without any notification or confirmation dialog. In the background, Syncthing moved that file while the devices were connected to the network. So when KeePassXC opened the encrypted file on my phone, it accessed the updated version. That .kdbx vault keeps the entries, their history, custom fields, and the other database metadata in the file itself. When Syncthing moves this file, it doesn't even know that it's moving passwords. In fact, to the sync engine, it's nothing different from moving a JPEG. And even though I didn't have a server for this process, the basics of a password manager worked as I expected. Browser autofill is an example; I didn't have to copy and paste any passwords by hand. So far, this setup felt basic. Up to this point, I'd only ever changed one device at a time. Then I made two devices disagree Syncthing saw a conflict, and KeePassXC understood it I tried something that felt like it might create problems in my setup: editing the same entry on the laptop and on the phone before they had a chance to talk to each other. When the two devices connected, my syncing system kept both copies rather than picking one. One remained as the primary copy while the other appeared beside it, including in its name "sync-conflict" and a timestamp. This was very revealing. Syncthing knew the files didn't match, even though it couldn't see their exact content. It has no concept of a password entry, so it didn't know which change to keep and which to overwrite. Syncthing had no idea that the disagreement was between password entries; it simply knew the two databases didn't match. By keeping a sync-conflict copy, it resolved the conflict at the file level. However, KeePassXC understood the content. It compared UUID entries and modification times after I merged the two databases and left the previous version in the entry's history while it kept the newer one. When I made these changes, resolution didn't take more than a minute. After opening both files and allowing the vault to reconcile the differences, the clean version synced back out once I had saved the results. Aside from the rare occasions when two devices have diverged, the rest of the time, the syncing mechanism goes unnoticed. It took me a while to actually accept that a general file-sync tool had replaced a purpose-built password service. Deleting the vault taught me what "backup" doesn't mean A second copy is only a safety net if it isn't listening to the first one I wasn't done with testing this new system, so I deleted the database on one device. And it acted like a sync tool, propagating that deletion. It took just a short moment for the second device to lose its copy. This revealed an important lesson: synchronized copies are not a backup. They mirror each other, so actions like deletions propagate to all devices. If you really need to preserve an older state, what you need is a backup. Syncthing has a setting to keep version history, but it's off by default. Even if you enable it, I wouldn't treat that as a replacement for a separate backup. So, you may be assuming you already have protection when you don't. I restored an older copy of my password vault outside the synced folder just to test recovery, and opening it was seamless. However, Syncthing treated it as a change and started distributing the data when I dropped it back into the shared directory. Reintroducing data in this setup needs care. KeePassXC's merge function also lets me bring an entry from an older database into the current one without replacing the entire vault. The replication features of this setup are free, but I had to handle recovery myself. What actually changes when you skip the password-manager server You may be wondering what you trade for not running robust password management systems like Vaultwarden. The core principle is the same in the sense that encryption still happens on the device before any data moves. But there are a few practical differences: One of the biggest differences is that synchronization is handed over to a general file-sync tool — and to me — in my current setup, while Vaultwarden leaves this to a purpose-built service. If you don't mind being your own IT department on the few days when a conflict surfaces, you'd enjoy KeePassXC + Syncthing. The goal isn't to push you towards one or the other. Self-hosting a password system without having to think of other complexities associated with running a server just feels different.