KeeWeb is a free, open-source password manager that runs in your browser and works with KeePass database files (KDBX format). It gives you a clean, modern web interface for managing passwords without relying on third-party cloud services. The project is developed by antelle on GitHub and can be self-hosted using Docker in minutes.

Note: KeeWeb is currently in maintenance mode – the last release (v1.18.7) was in July 2021. The application is still fully functional and KeePass-compatible, but do not expect new features or frequent updates. For a self-hosted password manager, it remains a solid option if you want something lightweight with KDBX support.

Key features of KeeWeb:

  • Full KeePass KDBX format compatibility – open and save .kdbx files directly
  • Browser-based interface – no desktop client installation needed
  • Built-in password generator with customizable rules
  • Support for file attachments, custom fields, and entry history
  • Offline capable – works entirely in the browser after loading
  • Self-hosted with Docker for full control over your data

Prerequisites

Before you begin, make sure you have:

  • Ubuntu 24.04 or 22.04 server with root or sudo access
  • SSH access to your server – see Install and Configure SSH Server on Ubuntu if needed
  • At least 512 MB of free RAM and 1 GB of disk space
  • A working internet connection to pull Docker images

Step 1: Update System Packages

Start by updating the package index and upgrading installed packages on your Ubuntu system.

sudo apt-get update && sudo apt-get upgrade -y

Step 2: Install Docker on Ubuntu

Docker is available directly from the Ubuntu repositories. Install it with a single command.

sudo apt-get install -y docker.io

Enable Docker to start on boot and start the service immediately:

sudo systemctl enable --now docker

Verify that Docker is running:

sudo systemctl status docker

Check the installed Docker version:

docker --version

If you want to run Docker commands without sudo, add your user to the docker group:

sudo usermod -aG docker $USER

Log out and log back in for the group change to take effect. Refer to our SSH Commands Cheat Sheet for quick session management.

Step 3: Run KeeWeb Container

Pull and run the official KeeWeb Docker image from antelle/keeweb. This image bundles the KeeWeb web application with an Nginx web server.

sudo docker run -d \
  -p 8080:80 \
  --name keeweb \
  --restart unless-stopped \
  antelle/keeweb

Here is what each flag does:

  • -d – Run the container in the background (detached mode)
  • -p 8080:80 – Map port 8080 on the host to port 80 inside the container
  • –name keeweb – Assign a name to the container for easy management
  • –restart unless-stopped – Automatically restart the container after a reboot unless you manually stop it

Confirm the container is running:

sudo docker ps

Step 4: Configure Firewall

If UFW is enabled on your server, allow port 8080 so you can reach the KeeWeb interface:

sudo ufw allow 8080/tcp
sudo ufw reload

Verify the rule was added:

sudo ufw status

Step 5: Access KeeWeb Web Interface

Open your browser and navigate to your server’s IP address on port 8080:

http://your-server-ip:8080

You should see the KeeWeb landing page with options to open an existing database or create a new one.

Step 6: Create a New Password Database

Click the “+” (New) button on the KeeWeb start screen to create a new password database. KeeWeb creates a KDBX file – the same format used by KeePass, so your database is portable across any KeePass-compatible application.

Set a strong master password for your database. This is the only password you need to remember – it encrypts and protects all other entries.

Step 7: Add Password Entries

Once inside the database, you can start adding entries. Click the “+” button to create a new entry. Each entry supports:

  • Title and username
  • Password (with built-in generator)
  • URL
  • Notes and custom fields
  • File attachments
  • Tags for organization

Fill in the details for your entry. Click the dice icon next to the password field to use the built-in password generator.

Step 8: Use the Password Generator

KeeWeb includes a configurable password generator. You can set the length, choose character types (uppercase, lowercase, numbers, symbols), and generate passwords that meet your security requirements.

Step 9: Organize Entries with Groups

KeeWeb lets you organize entries into groups (folders). This is useful when managing passwords for different categories – servers, databases, web applications, personal accounts, and so on. Right-click in the groups panel to create new groups.

Step 10: Save and Export Your Database

KeeWeb stores the database in your browser session by default. To save it as a file, click the save icon or use Ctrl+S. The file is saved in KDBX format, which you can open in KeePass, KeePassXC, or any other compatible application.

You can also configure KeeWeb to sync with cloud storage providers like Dropbox, Google Drive, or WebDAV servers for automatic backups.

Setting Up HTTPS with a Reverse Proxy

For production deployments, you should never expose KeeWeb over plain HTTP. Use Nginx as a reverse proxy with a Let’s Encrypt SSL certificate to secure the connection.

Install Nginx and Certbot:

sudo apt-get install -y nginx certbot python3-certbot-nginx

Create an Nginx configuration file for KeeWeb:

sudo vi /etc/nginx/sites-available/keeweb.conf

Add the following content:

server {
    listen 80;
    server_name keeweb.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable the site and obtain an SSL certificate:

sudo ln -s /etc/nginx/sites-available/keeweb.conf /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d keeweb.example.com

Replace keeweb.example.com with your actual domain name. After Certbot completes, your KeeWeb instance will be accessible over HTTPS.

Managing the KeeWeb Container

Here are common Docker commands for managing your KeeWeb deployment:

Stop the container:

sudo docker stop keeweb

Start the container:

sudo docker start keeweb

View container logs:

sudo docker logs keeweb

Remove the container completely:

sudo docker stop keeweb && sudo docker rm keeweb

Update to the latest image version:

sudo docker pull antelle/keeweb
sudo docker stop keeweb && sudo docker rm keeweb
sudo docker run -d \
  -p 8080:80 \
  --name keeweb \
  --restart unless-stopped \
  antelle/keeweb

KeeWeb Settings and Customization

KeeWeb offers several settings you can adjust from within the web interface. Click the gear icon to access settings where you can configure:

  • Auto-lock timeout – lock the database after a period of inactivity
  • Theme and appearance – multiple themes including dark mode
  • Clipboard clear timeout – automatically clear copied passwords from clipboard
  • Backup settings – configure automatic backup behavior

Conclusion

KeeWeb is a practical self-hosted password manager that works with the widely supported KDBX format. Running it with Docker on Ubuntu 24.04 takes just a few commands. While the project is in maintenance mode since 2021, it remains stable and fully functional for day-to-day password management.

For production use, always put KeeWeb behind a reverse proxy with HTTPS. Keep regular backups of your KDBX database files, and use a strong master password since it is the single point of protection for all your stored credentials.

Related Guides

RELATED ARTICLESMORE FROM AUTHOR

LEAVE A REPLY

Please enter your comment!
Please enter your name here