I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers.
I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup drives once in a while.
I recently did a bunch of research into password managers, and went with Keepassxc as well. I'm using Syncthing to sync the password archive across Linux, Mac, Android, and Windows devices. The whole setup is working very well and is all open source.
I don't, and wouldn't, use dropbox or any other non-free non-self-hosted system to manage the storage or synchronisation of my secure data, so it's unison(rsync) and/or ssh'd between desktop and laptop.
Why not use dropbox? It is only used for sync databases, not access them,
I always though if someone found my keypass database encrypted it would be useless.
Yeah, the KeePass database is encrypted and I secure it with both password and keyfile, but I still want something that won't leave my database "out there" available for bruteforce attempts or other attempts at it.
It's hardly "out there" though. A hacker would still need to hack dropbox before they could access your keepass db and begin brute forcing. What makes your own private server more secure than dropbox's network?
What is the cause for your paranoia about keeping your keyfile in your Dropbox? I have used and advocated this model for years with no ill effects.
My Dropbox is secured by MFA, with the Dropbox password itself being a random password within the KeePass keyfile. I store the whole Keepass program for Windows inside the same Dropbox account, feel free to indicate that as a security gap. On mobile I use the KeePass2Android app.
You meant the kdbx file right? not the separate keyfile you can use to secure the kdbx file with.
I think the feeling is the same as the feeling of just leaving your SSH private key "out there". Sure, it's protected with a passphrase, but I still don't want to do that.
Some people will not be satisfied so long as the keyfile, KDBX, and password reside in the same version of our shared reality, as it's still mathematically possible to decode the numbers into something they personally value.
I use the standard keepass 2 client on my windoes machines, and keepass2android on my phone. Clients only access the file via ssh to my server at home so it doesn't require storing the database on other machines.
I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup drives once in a while.