Self-hosted local password manager

2. KeePassDX

Android

Open-source and designed for local password storage. Its encrypted vault uses the KeePass file format, and an internet connection isn't required for normal password management.www.keepassdx.com+1

Official website

3. Strongbox

iPhone · iPad · Mac

A good Apple-device option for working with KeePass-compatible encrypted vaults. You can use a locally stored database rather than relying on cloud synchronization. Check the app's storage and sync settings during setup.

Official website

How to keep your passwords genuinely local

Even with a local-first password manager, a device's backup or file-sync settings can copy its database to a cloud service. Here's how to avoid that:

• Save the vault locally: For KeePassXC, create a .kdbx database in a local folder, not a Dropbox, OneDrive, Google Drive, or iCloud-synced folder.
• Use a strong master password: Make it long and unique.
• Make an offline backup: Keep an encrypted backup on an external drive or USB device, stored securely and updated regularly.
• Check browser and mobile settings: Disable any separate password-sync feature you don't want. A browser extension for KeePassXC connects to your local application; it doesn't require a cloud password vault.keepassxc.org+1

My recommendation: Start with KeePassXC if you're using a computer. It is a particularly good fit for someone who wants control over the encrypted password file without a password-manager company's cloud service.

One question so I can narrow this down: What device will you primarily use it on?

1. Your device

Windows PC

Mac

iPhone or iPad

Android

Multiple types of devices

2. How will you use it?

One device only, completely local

Multiple devices, with manual transfer only

3. Budget

Free and open-source preferred

Willing to pay for a polished app

[Find my best option]

Instead of traditional cloud 2FA, these offline managers use a Challenge-Response mode. Your hardware key acts as an indispensable physical decryption component: the local database cannot be unlocked unless the physical YubiKey is plugged in and queried.[yubico.com](https://www.yubico.com/works-with-yubikey/catalog/keepassxc/)[[2](https://www.yubico.com/works-with-yubikey/catalog/keepassxc)](https://keepassxc.org/docs/)

Top local-only password managers with hardware key support include:

• KeePassXC : A modern, cross-platform (Linux, macOS, Windows) native implementation of the KeePass database format. It features native, seamless YubiKey Challenge-Response integration where your hardware key acts as a physical key file protecting your .kdbx database.[yubico.com](https://keepassxc.org/docs/)[[2](https://www.yubico.com/works-with-yubikey/catalog/keepassxc)](https://www.yubico.com/works-with-yubikey/catalog/keepassxc/)
• KeePass (Classic / Professional) : The original Windows-based open-source password manager. It supports hardware-backed YubiKey integration (via KeePass YubiKey Provider ), though the interface feels more utilitarian compared to KeePassXC.[yubico.com](https://www.yubico.com/works-with-yubikey/catalog/keepass/)[[2](https://www.yubico.com/works-with-yubikey/catalog/keepassxc)](https://www.yubico.com/works-with-yubikey/catalog/keepass/)
• Strongbox : An exceptional, native client for iOS and macOS that opens standard local KeePass (.kdbx ) databases and supports YubiKey hardware unlocking (via YubiKey OTP or Challenge-Response depending on the platform/NFC setup).
• KeePassDX : An open-source, highly secure native Android client that can read your local .kdbx vault file and supports NFC or USB hardware key integration.

How Local + Hardware Key Works

1. Your passwords live in a single .kdbx file stored completely offline on your hard drive, phone, or local NAS.[yubico.com](https://keepassxc.org/docs/)[[2](https://www.yubico.com/works-with-yubikey/catalog/keepassxc)](https://www.yubico.com/works-with-yubikey/catalog/keepass/)
2. You configure your database in KeePassXC to require both a Master Password and a YubiKey Challenge-Response slot.[yubico.com](https://www.youtube.com/watch?v=7UdBxoPlDwE&t=405)
3. To open your vault, you must type your master password and plug in your YubiKey (and optionally touch it). If the key isn't present, decryption is mathematically impossible.[yubico.com](https://keepassxc.org/docs/)[[2](https://www.yubico.com/works-with-yubikey/catalog/keepassxc)](https://www.youtube.com/watch?v=FFF-7d9aZsE)
4. Backup warning: Because there is no cloud account to reset your credentials, if you lose your physical YubiKey and forget your master password, your vault is gone forever. Always keep a secure backup of your database file and a secondary hardware key configured identically or stored safely.

Would you like help setting up KeePassXC with a YubiKey , or do you need recommendations tailored to a specific operating system (like mobile-heavy vs. desktop)?

1. Bitwarden — probably the closest match

Bitwarden explicitly supports Emergency Access, where you designate another Bitwarden user as an emergency contact who can request access to your vault. Its Families plan supports up to six users and includes Emergency Access.Bitwarden+1

More importantly for your second requirement, Bitwarden supports self-hosting the server, so your vault synchronization infrastructure can reside on hardware you control rather than Bitwarden's cloud. Bitwarden says its self-hosted deployment is compatible with its end-user clients.Bitwarden

bitwarden.com

Caveat: self-hosting means you become responsible for server availability, backups, updates, TLS, remote access, and disaster recovery. For a family, that's a meaningful operational burden.

2. KeePassXC + an encrypted vault — best if "no cloud" is the priority

KeePassXC can keep the actual password database as a local encrypted file. You can put that file on a USB drive, NAS, or other storage you control.

The tradeoff is that it doesn't give you the polished "designate Jane as emergency contact → Jane requests access → vault becomes available after a waiting period" workflow that Bitwarden does. You'd need to build the break-glass procedure yourself.

A robust setup can actually be quite simple:

• KeePassXC database on your computer/NAS.
• Two or more encrypted backups.
• One backup physically held by the family member.
• Separate instructions explaining how to unlock/recover it.
• A mechanism for transferring the master password/key material only under your defined emergency conditions.

This is particularly attractive if the password database must never live on a password-manager company's servers.

3. 1Password — excellent recovery, wrong fit for strict no-cloud

1Password Families has a sophisticated family recovery model: you can designate additional family organizers, who can help recover another family member's account. It also provides an Emergency Kit containing the information needed to regain access.1Password+1

You can keep the Emergency Kit itself offline—for example, printed or on an encrypted USB drive.1Password+1

But that doesn't make the vault itself local. If your requirement is specifically "I don't want my encrypted password database stored/synchronized through a cloud password-manager service," I'd exclude 1Password.

My practical recommendation

If you mean:

"I want something my spouse/child can access if I'm incapacitated or unavailable, but I also want the option to run the infrastructure myself." I'd look hardest at Bitwarden self-hosted.

If you mean:

"The password database should never leave my own physical infrastructure, even if that means sacrificing convenience." I'd look at KeePassXC with a deliberately designed family recovery procedure.

One important distinction: "encrypted in the cloud" and "not stored in the cloud" are different requirements. If you tell me which of those you actually mean, I can narrow this to 2–3 setups and explain exactly how the break-glass process would work in each.