If you have a password manager, chances are you rely on an online account that tracks and stores all of your passwords. It’s convenient, but you can actually keep your passwords stored off the internet while still syncing across devices.
The trick here is that I’m using a network to sync my passwords—my private network, only. It’s not open to anyone outside my home, even myself whenever I leave. This works for me because I work from home and rarely travel, and therefore I rarely need to add or edit credentials when I’m away from my home network.
But Why Sync Your Passwords Yourself?
To be clear, the main reason I do this simply that I like feeling in control of my digital life. When I keep my passwords out of the cloud, I’m not relying on any third-party organization to handle my passwords for me. Just look at the fallout of the 2022 LastPass breach to understand what kind of disasters I’m trying to avoid.
That’s not to say other cloud-based password managers aren’t worth your time. In fact, if you aren’t tech-savvy, I’d recommend using one of those. I enjoy building my own systems, though. So if I can take full control of my passwords—a linchpin of cybersecurity—I will do that.
It also just made sense if you go through the process of setting up your own cloud storage. I’ll explain that more later, but if you’re able to roll your own private cloud storage, you might as well take full advantage of it.
I Start With an Offline Password Manager
The password manager I use is the free and open source KeePassXC, and it stands apart from competitors by operating entirely offline. It has a relatively minimal set of features, and most of them don’t need the internet to work.
In contrast, most of the popular password managers you know are cloud-based. Your stored passwords are kept and synced via a remote server you connect to when you log in.
KeePassXC stores everything in a vault, a KDBX file, that you keep on your local device. If you want to access the same vault of passwords on another computer, tablet, or phone, you need to manually move that file to that device.
There are counterparts you could use instead, like the original KeePass, but I use KeePassXC specifically to open my vault because it’s cross-platform. I use both Windows and Linux, and KeePass isn’t supported on Linux. On Android I use KeePassDX, and there are KeePass-compatible apps for iPhone too if you need one.
The trouble is, because there’s no built-in syncing service, you can easily end up with multiple vaults that have different or conflicting sets of passwords. If you make changes to one version of the vault, you have to copy it over to the other to make sure you can access it there too. That’s where Nextcloud comes in.
I Host My Own Cloud Storage Service
I have a Raspberry Pi that I set up to host an instance of Nextcloud “at home.” If you’re not familiar, Nextcloud is a cloud storage service similar to Google Drive that you can operate and manage yourself.
For your benefit, I’ll recommend getting a regular Raspberry Pi OS or maybe an RPi OS alternative like DietPi and installing Nextcloud through Docker. I chose to get my instance through NextcloudPi, and I regret it. Over the years, I’ve had multiple technical issues with my Nextcloud that I learned would have been easier to fix or totally avoidable if I’d just installed Nextcloud using Docker. Learn from my mistakes.
I’ve stopped short of making my Nextcloud public to the broader internet, though. Knowing what I’ve learned over the years about cybersecurity and privacy, I don’t feel safe doing that. Staying on my local network fits my needs well enough, and the convenience of an internet-connected Nextcloud just doesn’t outweigh the risks for me.
Hardware You’ll Need
If you’re going to do this, you do need some dedicated gear. This is a project ideal for a Raspberry Pi kit or a similar SBC (Single Board Computer). It’s also a great way to repurpose an old laptop or to put a mini PC to work for you. A laptop might take up more space than other options, but it has the benefit of a built-in monitor and keyboard.
Raspberry Pi 3 B
The Raspberry Pi 3 B is a single-board computer (SBC) with a 1.2GHz quad-core processor and 1GB RAM. With Gigabit Ethernet and HDMI output, it makes for a great small, low-power device to run smart home or homelab services like Home Assistant, Homebridge, Pi-Hole, or other software on.
Whatever you choose, I recommend connecting via an Ethernet cable too. Relying on Wi-Fi to keep your cloud in service introduces a lot of latency that will slow everything down.
I Sync Across Devices
On every device I set up for myself, the first thing I install is the Nextcloud client app. I log in to my Nextcloud account, sync my KDBX file, and with KeePassXC or KeePassDX I immediately have access to all my passwords. If I make any changes to the KDBX file, it’s immediately synced across all devices connected to my Nextcloud server.
Since Nextcloud is a full file hosting service, I can keep a ton of other important files in sync this way. If I have a file I know I’ll be using a lot no matter what device I’m on, I’ll drop it in the “Universal” folder in Nextcloud, and I’ll have it wherever I need my password vault too.
Occasionally, I’ll have a device where I need just a few passwords, but I don’t want my entire collection on it. An example would be a laptop for work. In that case, I can just make copy of my vault, delete all but the accounts I need for that device, and sync only that vault to it.
It Isn’t a Perfect System
My system admittedly has its limitations. The fact I don’t make my Nextcloud available outside my home can limit me. If I need to add or edit passwords, those changes to my KDBX file don’t get synced immediately. Since I’m the only one who needs them, though, that’s rarely a problem. Setting up a home VPN server might solve this, but I haven’t gotten that far in my homelab journey.
Annoyingly, the KeePassDX app on my phone sometimes takes a minute or so to open the vault when I’m away from my home network. I’m not sure why this is, but I’m going to try making tweaks to my setup to see if I can solve that issue.
There Are Other Ways to Do This
On that note, this isn’t the only way to self-host a synced password manager. Bitwarden is open source and has a guide to hosting your own Bitwarden instance. I’ve been trying out DietPi on one of my Pi’s recently, and I noticed it offers a preconfigured Vaultwarden server, so I might try experimenting with that. Either of those setups would eliminate the need for Nextcloud.
Of course, you could keep a KDBX vault synced using Google Drive or OneDrive as well. At that point, though, you’re again relying on a third-party to keep your vault from falling into the wrong hands.
Related
5 Awesome and Free Offline Password Managers for Android
Take your passwords off the internet with these apps (and why you should.)
Another option that I’ve seen folks using alongside KeePassXC is Syncthing. It isn’t cloud storage, but rather a simple file syncing service that can run on your devices. Since it’s simpler, it might be a better option if you don’t feel a need for fully self-hosted cloud storage.
Whatever you end up doing, make sure you choose a strong master password. Don’t forget to follow sound cybersecurity practices and confirm that you’re avoiding easily cracked passwords.
