I just wonder how easy it would be to sync between clients, KeePass style, because you also have to send your GPG keystore around to all your clients too, right?

The issue I found with this approach is that the other big reason to use VaultWarden is for multi-user support. However, then each of your users need the same VPN setup, which can be hard to manage if you support a non-techie or Luddite.

Exposing it to the internet isnt safe, but it’s more accessible then setting up VPNs for everyone with proper routing and stuff. The actual Bitwarden service isn’t that expensive last time I checked, and I think it’s probably the best, simplest solution if you need to support multiple technophobes.

• If you only use Linux CLI and live in the terminal: pass
• If you also use a phone or windows desktop, and already use a reputable syncing service (nextcloud, synching, etc.): keepassXC
• If you have an always on server, internet accessible that maintains 5-9s of reliability and regular working backupa: host VaultWarden
• If nothing above applies: use Bitwarden SaaS.

My big problem with VaultWarden/Bitwarden is there are some things (making new passwords) that can only be done while connected. This means exposing your server to the internet and making it highly available. Also, since it’s a single point of failure, you need good backups. If your server goes down, you’re read only until you create a new instance, which might take a while.

I’ve been using KeepassXC for about 6 years, synchronized with Syncthing. The database is synced to all my devices and my wife’s, and a few satellite devices my friends own in encrypted Syncthing folders. It’s easy to merge conflicts if we both make entries at the same time. My database will likely outlive me at this point. I even got my Luddite in-laws using it (alas, synced through Google Drive). Highly recommended.