See: http://keepass.info/help/v2/sync.html http://keepass.info/help/v2/sync.html From what I understand, the encryption is done client-side per individual item

See: http://keepass.info/help/v2/sync.html http://keepass.info/help/v2/sync.html From what I understand, the encryption is done client-side per individual item (e.g. if you use a cloud provider, unencrypted data never touches them), but there's some generally questionable stuff in how it handles secure things: https://news.ycombinator.com/item?id=9727297 https://news.ycombinator.com/item?id=9727297