I've been using keepass for years. If someone gets a hold of the vault file, the passphrase could potentially be found.

Unless you do selfhost correctly, yeah you want to trust somebody else.