Bitwarden vs KeePassXC 2026: Cloud Sync or Local File
Bitwarden syncs a hosted or self-hosted vault across every device. KeePassXC keeps your vault as one local file with no server at all. Here's the real trade-off.
Published September 9, 2026· By Juan Martinez
Bitwarden and KeePassXC are both fully open source, both have a genuinely complete free tier, and both score well on trust — 8.7 against 8.0. What actually separates them is where your vault lives. Bitwarden is a cloud-first sync service: a hosted account by default, or your own server if you self-host it, with apps on every platform syncing automatically. KeePassXC has no server at all — your vault is a single encrypted file on your disk, and there’s no company, no account and nothing to breach because nothing is ever sent anywhere unless you choose to move the file yourself.
| Bitwarden | KeePassXC | |
|---|---|---|
| Rating | 8.7 | 8.0 |
| Hosting | self-hostable | local-only |
| Price (individual) | Free tier full; $1.65/mo Premium ($19.80/yr) | Free, no paid tier at all |
| Encryption | AES-256-CBC, PBKDF2 | AES-256, Argon2d |
| 2FA | full | hardware |
| Platforms | Windows, macOS, Linux, Android, iOS, Browser extension, CLI | Windows, macOS, Linux, Browser extension, CLI |
| Est. | 2016 | 2016 |
The real divide: a server you trust, or no server at all
Bitwarden’s vault lives on Bitwarden’s cloud infrastructure — Microsoft Azure, in the US or EU — encrypted on your device before anything leaves it. If you’d rather not trust that infrastructure at all, Bitwarden also ships official, extensively documented self-hosting: you run its own server software on your own machine, not a third-party reimplementation. Either way, there’s a server, an account, and automatic sync across every device you use.
KeePassXC removes the server from the equation entirely. The database is a .kdbx file on your disk. There’s no account to create, no company that holds your data even in encrypted form, and nothing that can be subpoenaed, breached or shut down, because there’s nothing centralized to target. The cost of that is sync: KeePassXC has no built-in way to get the file from your laptop to your phone. The documentation’s own suggestion is to drop the file in a Dropbox, Google Drive or Nextcloud folder you already use — which works, but it’s you assembling a sync pipeline out of parts, not a feature the product ships.
Where the ratings actually diverge
Security and Privacy & Trust are close for both — Bitwarden at 9.0 and 8.5, KeePassXC at 8.5 and 9.0. Both use modern, audited cryptography (Bitwarden’s AES-256-CBC with HMAC-SHA-256 and 600,000 PBKDF2 client iterations by default; KeePassXC’s AES-256 with Argon2d key derivation in the KDBX 4 format), and both have been through outside security review — Bitwarden with an unbroken run of third-party audits every year since 2018, KeePassXC with a 2025 French government certification (ANSSI CSPN) that included a full source-code review and penetration testing of every security function, on top of an independent 2023 review. KeePassXC actually edges Bitwarden on Privacy & Trust specifically because there’s no server at all to hold metadata — Bitwarden’s cloud vault keeps item names encrypted, but the server still knows which account an item belongs to and how many items you hold, something KeePassXC’s local-only design has no equivalent gap for.
The gap that decides the overall score is Usability & Platforms: 8.0 for Bitwarden against 6.0 for KeePassXC. That’s not a security judgment — it’s the direct cost of local-only design. Bitwarden has official mobile apps for iOS and Android with automatic sync built in. KeePassXC has no official mobile app at all; opening the same file on a phone means trusting a separate third-party project (KeePassDX or KeePass2Android on Android, Strongbox or KeePassium on iOS) and building your own sync path around it. Reviewers of both products report the predictable friction: version-conflict files when a KeePassXC database is left open on two devices at once, and a browser-extension autofill setup that can break after a browser update.
Features: what a server makes possible, and what it doesn’t
Bitwarden’s free tier already covers unlimited passwords and devices, passkey storage and use, encrypted export, Bitwarden Send for sharing a secret or file, and item sharing with one other person — all of which need a server to work. KeePassXC’s feature set is deep for a tool with no server behind it: TOTP codes, SSH key storage, breach checks against Have I Been Pwned, password and diceware generation, and an import wizard that reads Bitwarden’s and other managers’ exports. But anything that needs a server to coordinate — email aliases, link-based secret sharing, emergency access, family plans — simply isn’t there, and isn’t going to be, because it would mean building the server KeePassXC is designed not to have.
Passkeys land differently for each. Bitwarden can both store site passkeys and use a passkey to unlock the vault itself on PRF-capable hardware. KeePassXC can store and autofill passkeys for websites through its browser extension, but the vault itself still unlocks with a password, key file or hardware challenge-response — not a passkey.
Recovery: no company can help either of you
Both are absolute on this point in the same way. Bitwarden states plainly that its employees and systems have no way to know, retrieve or reset your master password; its only recovery aid is an Emergency Access contact you set up in advance. KeePassXC has no account at all, so there’s nothing for anyone — including the KeePassXC Team — to reset; lose your master password (and any key file or hardware token you added) and the vault is gone. Neither product’s design gives you a “call support and get back in” option, and that’s a deliberate choice on both sides, not an oversight on either.
What we didn’t compare, and why
Bitwarden’s self-hosting depth. Running Bitwarden’s own server software yourself is a genuinely self-hostable option, and it’s covered in the full Bitwarden review — but it isn’t a head-to-head axis here, because KeePassXC has no server to self-host in the first place. The comparison that actually matters for a self-hosting-minded reader is “run a small server” vs “don’t have one at all,” which the hosting row above already states directly.
Enterprise and Teams tiers. Bitwarden sells per-seat Teams and Enterprise plans; KeePassXC has no equivalent because it has no company selling anything. Neither review scores those tiers — this comparison stays on personal use.
Bottom line
Read the full Bitwarden review if you want a password manager that syncs itself across every device automatically, with official mobile apps, and you’re comfortable trusting either Bitwarden’s cloud or your own self-hosted server to hold your encrypted vault.
Read the full KeePassXC review if the idea of a company — any company — holding even encrypted vault data is the wrong trade for you, and you don’t mind building your own sync path and living without an official mobile app in exchange for a vault that never leaves your control.