Bitwarden vs KeePass: cloud or local-file password manager

Bitwarden vs KeePass at a glance

KeePass and Bitwarden solve the same problem from opposite ends. KeePass, a Windows program written in .NET and licensed under the GPL, stores everything in one encrypted .kdbx file that never leaves your computer unless you move it. KeePassXC is a native cross-platform fork of the same idea, written in C++ and Qt, with built-in TOTP, a browser extension and support for the same file format. Neither has an account, a server or a company behind it; sync, backups and mobile access are your responsibility.

Bitwarden is a hosted service, also open source, with official apps for every desktop and mobile platform and extensions for every major browser. The vault is encrypted on your device and synced through Bitwarden’s servers in the US or EU, or through a server you host yourself. The free plan covers unlimited passwords and devices; Premium is about US$10 per year.

The choice is about control versus convenience. Technical users who already run Syncthing or a NAS often prefer KeePassXC. Almost everyone else, and anyone sharing passwords with other people, is better served by Bitwarden.

Comparison table

When KeePass or KeePassXC is the right tool

• Offline or air-gapped machines. A .kdbx file works on a computer that never touches the internet. Nothing in Bitwarden’s model fits that without running your own server.
• No account with anyone. There is no email address, no vendor, no terms of service and no company that can go out of business or change its pricing.
• Full control of the file. You decide where it sits, how many backups exist and which cloud, if any, ever sees the ciphertext. Key files and hardware key challenge-response (KeePassXC with YubiKey) add a second factor that lives entirely offline.
• Auto-type. KeePass and KeePassXC can type credentials into any window, including remote desktop sessions, terminals and old applications with no browser integration. Bitwarden’s autofill is browser and mobile-app based.
• Plugins. If you need a particular workflow, someone has probably written a KeePass plugin for it.
• You already run Syncthing, Nextcloud or a NAS. Sync is then a solved problem, and a .kdbx file is just another file in the shared folder.

When Bitwarden is better

• Sync you do not have to think about. Every device sees every change within seconds. With KeePass, two devices editing a file that has not synced produces conflicts, and merging them is manual.
• Sharing with other people. Bitwarden organisations give each person their own account and control who sees which collection. Sharing a .kdbx means sharing one master password with everyone and hoping nobody edits at the same time.
• Family use. Families is about US$40 per year for six people, each with a private vault plus shared collections, emergency access and Premium features.
• Mobile. Official apps with system-wide autofill on iOS and Android, biometric unlock and passkey support, maintained by the same team as the desktop apps.
• Browser autofill without configuration. Install the extension, log in, done. KeePassXC-Browser works well once paired, but pairing per browser profile and keeping the desktop app running are extra steps.
• A path for non-technical relatives. The one-command install and a free account are within reach of anyone; a .kdbx file on Dropbox with a third-party phone app is not.

The security trade-off, honestly

KeePass eliminates the server. There is no online target holding thousands of vaults, and a stolen file can only be attacked offline against your master password and key file. Recent versions default to Argon2 key derivation, which makes that slow. The risks that remain are the ones you own: losing the file with no backup, syncing it through a cloud account with a weak password, using an abandoned third-party mobile app, or a compromised computer reading the vault while it is unlocked. That last risk applies to every password manager.

Bitwarden is zero-knowledge. The vault is encrypted with AES-256-CBC on your device using a key derived from your master password with PBKDF2-SHA256 at 600,000 iterations or Argon2id. Bitwarden’s servers store ciphertext, so a server breach yields data that must still be cracked offline, the same position as a stolen .kdbx. The server is a target, but Bitwarden is audited every year, publishes the reports, and the code is on GitHub. Two-step login and new-device verification stop account takeover; a strong master password stops offline cracking. Read Is Bitwarden safe for the detail.

Neither design is strictly safer. KeePass trades a professionally run server for your own operational discipline. If you would not notice a missing backup for a month, Bitwarden’s model protects you better.

Moving from KeePass to Bitwarden

1. Install Bitwarden and create a free account.
2. KeePass 2.x: open the database, choose File, Export, select KeePass XML (2.x) and save the file. KeePassXC: choose Database, Export, CSV File.
3. In the Bitwarden web vault choose Tools, Import data. Pick KeePass 2 (xml) for the KeePass export or KeePassX (csv) for the KeePassXC export, select the file and click Import data.
4. Groups become folders. Custom string fields import as custom fields from XML; the CSV route keeps title, username, password, URL and notes only. TOTP seeds stored in KeePassXC’s TOTP field come across in XML exports as otp fields; check a couple of entries.
5. Attachments do not transfer. Re-add important ones to Bitwarden Premium, which allows 1 GB of encrypted attachments.
6. Delete the XML or CSV export and empty the trash. Both formats are plain text.

Moving from Bitwarden to KeePassXC

1. In the Bitwarden web vault choose Tools, Export vault, format .json (unencrypted), confirm with your master password and download.
2. In KeePassXC choose Database, Import, Bitwarden (available in recent releases), select the JSON file and create a new database with a strong password and, optionally, a key file.
3. Folders become groups, and TOTP seeds and custom fields are preserved. Attachments and passkeys are not included in the export.
4. Delete the JSON export and empty the trash, then set up your own sync and at least one offline backup of the new .kdbx file.

Frequently asked questions

Is KeePass more secure than Bitwarden?

Not in the encryption itself; both use AES-256 (KeePass also offers ChaCha20) with a key stretched by Argon2 or PBKDF2. KeePass removes the server from the picture, so there is nothing to breach online, but you take on backups, sync and mobile app choices yourself. Bitwarden is zero-knowledge, so a server breach yields only ciphertext.

What is the difference between KeePass and KeePassXC?

KeePass is the original Windows program written in .NET, with a large plugin ecosystem; it runs on Linux and macOS through Mono. KeePassXC is a native cross-platform rewrite in C++ and Qt with built-in TOTP, a browser extension and SSH agent support, and no plugins. Both open the same .kdbx files.

Can I use KeePass on my phone?

Yes, through third-party apps that read .kdbx files: KeePassDX or Keepass2Android on Android, Strongbox or KeePassium on iOS. You still have to get the file onto the phone and keep it in sync, usually with Syncthing, Dropbox, OneDrive or iCloud Drive. Bitwarden's official apps sync automatically.

How do I import KeePass into Bitwarden?

In KeePass 2.x choose File, Export, KeePass XML (2.x). In the Bitwarden web vault choose Tools, Import data, format KeePass 2 (xml), and select the file; groups become folders. From KeePassXC export a CSV and import it as KeePassX (csv). Delete the export afterwards because it is unencrypted.

Does Bitwarden work offline like KeePass?

Mostly. Bitwarden caches an encrypted copy of the vault on each device, so you can read and fill passwords without a connection. Edits sync when you are back online. Creating an account and the first login need the internet, and a fully air-gapped machine is a job for KeePass or a self-hosted server.