Skip to content
Lattice PM

Peer-to-peer KeePass sync

Sync KeePass vaults directly between your devices

Lattice PM is a Unix daemon and CLI that synchronizes supported KeePass KDBX vaults between mutually trusted peers. It merges vault state field by field instead of copying whole files, and it fails closed when a KeePass feature cannot be preserved.

DownloadRead the docsSource on GitHub
  • No account
  • No server-held keys
  • Linux and macOS
  • MIT OR Apache-2.0

How it works

Each device runs the same daemon and holds the same vault. Pairing grants access through a signed membership document. After that, peers exchange signed revisions and converge without a central server.

  1. Register the vault

    Point the CLI at a supported KDBX4.1 vault. Password-only, key-file, and combined credentials are supported.

  2. Pair a device

    Create an invite, scan the terminal QR or enter the pairing code, then confirm the short code over a separate channel.

  3. Edit anywhere

    Peers exchange signed revisions and merge changes. Concurrent edits surface as conflicts with a signed resolution path.

What it does

The synchronization core is the product. Everything else is optional.

Semantic KDBX merge

Groups, entries, fields, tags, history, attachments, and custom icons synchronize as typed records over a signed revision graph.

Fails closed

Unknown or unmodeled KeePass elements stop the write. Lattice does not silently drop data it cannot round-trip.

Conflict handling

Concurrent edits become redacted conflict descriptors. Resolution commits a signed, journaled revision, and stale peers cannot resurrect it.

Signed membership

Access comes from admin-signed membership documents. Discovery alone grants no access, and removal rotates repository and epoch secrets.

Recovery paths

Admin identity backup, a secondary recovery authority, same-key recovery, and fresh-key replacement cover device and state loss.

NAT traversal

mDNS, scoped rendezvous, AutoNAT, Circuit Relay v2 fallback, and DCUtR hole punching connect peers across networks.

Start in three commands

The default rendezvous origin is https://pair.latticepm.net. It stores only encrypted, opaque pairing envelopes.

lattice vault add /path/to/personal.kdbx
lattice vault init personal
lattice sync        # leave the daemon running

Direct by default, optional services when needed

Peers try direct TCP and QUIC first. Relay, rendezvous, mailbox, and object storage are separate processes that carry encrypted data and hold no vault keys.

Lattice PM peer-to-peer synchronization architectureTwo devices run the Lattice daemon and synchronize an encrypted KDBX vault directly. Optional relay, rendezvous, mailbox, and object-storage services carry encrypted opaque data only.Device ALattice daemon + CLIpersonal.kdbxDevice BLattice daemon + CLIpersonal.kdbxNoise over TCP, TLS 1.3 over QUICsigned membership requiredOptional untrusted servicesRendezvousRelay + AutoNATMailboxObject storageencrypted opaque data only
The optional services are untrusted for confidentiality and correctness. Paired devices remain the authority for vault state.

Platform status

Lattice PM is at version 0.2.0. Released behavior and in-progress work are listed separately.

  • Linux release target
  • macOS release target
  • Windows bounded port in progress
  • Desktop GUI status shell only
  • Mobile companion in progress

Security model

Sync traffic is encrypted and peer-authenticated with libp2p Noise over TCP or TLS 1.3 over QUIC. The protocol sends decrypted logical vault items only to mutually trusted peers for that vault. Local IPC and status output never include vault passwords, KDBX paths, or decrypted entry fields.

Read the security modelIdentity and keys