KeePassXC on Android: Setting Up Offline Password Vault Sync Without Syncthing

If you use KeePassXC on your desktop and want your passwords on your phone without handing them to a cloud provider, you have probably run into the same wall many people hit: the official guidance points you toward Syncthing, and Syncthing is powerful but fiddly. It requires both devices to be online at the same time (or a relay), it asks you to understand folder IDs and device trust, and when something breaks, you are debugging a peer-to-peer file sync system just to read a password. For a lot of people, that is a lot of machinery for a single .kdbx file.

The good news is that you do not need Syncthing to keep an offline, encrypted KeePass database in step between a laptop and an Android phone. Several reliable routes exist, from a plain USB transfer to a self-hosted WebDAV folder to a file manager you already have. The catch is that every route trades convenience against risk in a different way, and the sync step is where most people make a mistake that either loses data or quietly leaves two diverging copies of their vault.

This article walks through how to set up a KeePassXC Android app workflow without Syncthing, what each method actually costs you in effort and exposure, and how to avoid the classic "which copy is the real one?" problem. We will cover a worked example with real numbers, a comparison of the realistic options, and a step-by-step setup you can follow end to end. If you are still deciding whether a local-first password manager is right for you at all, our piece on what the ETH Zürich study means for password managers is a useful companion read before you commit.

Key Takeaways

• Your database file (.kdbx) is already encrypted, so the sync channel does not need to be trusted with your secrets. It does need to be reliable.
• The real risk in any manual sync is divergence: two edited copies of the same vault that you later try to merge.
• For most people, a WebDAV or local-network folder sync via an Android app beats hand-carried USB copies on both speed and consistency.
• Always keep a dated backup before any sync operation, and verify the file opens on the target device before you trust it.
• Use a single "source of truth" device for edits, and treat the phone as a read-mostly client unless you have a merge plan.
• Syncthing is not the only option; it is simply the most automated one, which is also why it is the hardest to troubleshoot.

What "offline password vault sync" actually means

Offline password vault sync means keeping an encrypted password database current across devices without storing the database on a third-party password cloud. The vault lives as a file you control, and the sync process only moves that file (or its changes) between your own devices.

KeePassXC stores everything in a single file, typically with the .kdbx extension, encrypted with AES-256 or ChaCha20 and protected by your master password and optionally a key file. Because the encryption happens locally before anything touches a disk or network, the transport can be relatively dumb. A USB stick, a WebDAV share, or a file synced by any tool will carry the same ciphertext.

That separation is the entire reason this workflow is viable. The question is never "is my sync service trustworthy with my passwords?" because it cannot read them. The question is "will the right version of the file arrive on the right device at the right time?"

Why people look for an alternative to Syncthing

Syncthing is a genuinely good piece of software. It is open source, peer to peer, and encrypts traffic between devices. For a folder you change constantly, it is excellent. For a password vault that you change a few times a week, several friction points show up.

• Both devices need to see each other. If your laptop is asleep and your phone is on cellular, nothing syncs until they meet on a network or a relay.
• Configuration surface is large. Device IDs, folder IDs, ignore patterns, and versioning settings all need to agree.
• Silent conflicts. Syncthing creates .sync-conflict files when both sides change. You then have two .kdbx files and must figure out which to keep.
• Android battery and background limits. Modern Android aggressively restricts background network activity, which can stall sync until you open the app.

None of this makes Syncthing a bad choice. It makes it a choice that rewards people who enjoy infrastructure. If you want a simpler path, the methods below are worth knowing.

Comparing the realistic sync options

Here is how the most common non-Syncthing approaches stack up for a single user with one desktop and one Android phone.

Method	Setup effort	Needs both devices online?	Auto-sync	Conflict risk	Best for
Manual USB or cable copy	Very low	No	No	High if you forget a step	Occasional, air-gapped users
WebDAV server (self-hosted or NAS)	Medium	Yes, to the server	Via app	Low with a single editor	Home-lab and NAS owners
Local network share (SMB/FTP)	Low to medium	On the same network	Partial	Medium	Home Wi-Fi only users
Syncthing	Medium to high	Not necessarily, with a relay	Yes	Medium, needs monitoring	Users who want full automation
Generic cloud drive (encrypted file only)	Low	No	Yes	Low to medium	Users comfortable with the file in a cloud

A note on that last row: storing the encrypted .kdbx in a cloud drive is a legitimate choice, because the file is still ciphertext. But the metadata (file size, modification times, access patterns) is visible to the provider, and a weak master password is still a weak master password. Before choosing that route, it is worth reading our walkthrough on what to check before trusting files to a cloud backup service.

A worked example: the "47 passwords" scenario

Consider a realistic setup. Say you have 47 entries in your KeePassXC database covering email accounts, banking, work VPN, a few side-project hosting logins, and streaming services. You edit the database on your Windows laptop roughly four times a week, adding or rotating about two entries each time. Your Android phone is where you need the passwords most, usually while you are out.

Over one month, that is about 16 edits on the laptop. If the phone never writes back, the phone copy is simply a read-only mirror, and the only risk is staleness. Suppose you rotate a banking password on the laptop on a Tuesday, then need it on the phone on Thursday, and the phone copy is still from the previous Sunday. You are locked out of the app at the worst moment.

Now suppose you also make a quick edit on the phone on Wednesday to add a new Wi-Fi password. You now have two divergent files. Merging them by hand means opening both, comparing 47 entries, and copying the new one across. That is a manageable chore once. Done every few weeks, it becomes the reason people abandon the setup entirely. The fix is a rule: pick one device as the editing source, and let the other pull. We will build that rule into the steps below.

How to set up the workflow, step by step

The steps below use WebDAV because it is the most robust non-Syncthing option, and because many people already have a NAS or a home server that speaks it. If you do not run one, the same principles apply to a folder you copy manually.

Prerequisites

1. KeePassXC installed on your desktop (Windows, macOS, or Linux) with a working .kdbx database.
2. An Android app that can open KeePass databases. KeePassDX and Keepass2Android are both mature options. Pick one and stay with it, because each stores its own internal copy path and settings.
3. A WebDAV endpoint you control, such as a NAS, a home server running Nextcloud or a plain WebDAV service, or a hosted WebDAV provider you trust.
4. A current, verified backup of your .kdbx file, stored somewhere that is not the sync target.

Step 1: Create a dated backup and verify it

1. On the desktop, close KeePassXC so the file is not locked.
2. Copy passwords.kdbx to a folder named with today's date, for example vault-backup-2026-03-14/.
3. Open the copy in KeePassXC using the same master password. Confirm you can see all your entries and that the entry count matches what you expect (47 in our example).

Do not skip the verification. A backup you have never opened is a hope, not a backup.

Step 2: Set the desktop as the editing source

1. Decide that the laptop is the only device that writes the canonical database.
2. Rename nothing yet. Simply make a habit of editing only in KeePassXC on the desktop.
3. Commit to this rule for two weeks as a trial. If you find yourself wanting to edit on the phone often, you need a merge plan, not a looser sync.

Step 3: Upload the database to WebDAV

1. Create a folder on your WebDAV server, for example /vault/.
2. Upload passwords.kdbx into it using the server's web interface or a WebDAV client on the desktop.
3. Note the full URL, which typically looks like https://your-server.example/remote.php/dav/files/you/vault/passwords.kdbx on Nextcloud-style servers.

Step 4: Point the Android app at the WebDAV file

1. Open your chosen Android KeePass app and go to the database settings or storage options.
2. Add a new storage location and select WebDAV.
3. Enter the server URL, your username, and an app-specific password if your server supports them. Avoid reusing your main account password here.
4. Browse to /vault/passwords.kdbx and open it.
5. Enter the master password. If you use a key file, supply it the same way.
6. Confirm the entry count matches the desktop.

Step 5: Pull changes deliberately

1. After you edit on the desktop, save in KeePassXC, then re-upload the file to WebDAV, overwriting the previous version.
2. On the phone, trigger a sync or reload in the Android app before you need an entry.
3. Keep a hab