Then use Keepass, which is literally just a local app.

Would you be okay with synchronizing only when you're on your own Wi-Fi network? If that's the case, you don't have to try exposing anything to the Internet.

You can also purchase a server online to install it on, but you're going to get saddled with some kind of monthly fee there.

I've had my VPS exposed to the internet for a while and never been pwned. No professional experience. Use SSH keys, not password authentication. Use FDE if physical access is in your threat model. Use a firewall to prevent connection on internal-only ports.

Vaultwarden will store your passwords encrypted (obviously) so even if your database does get stolen, the attacker shouldn't be able to read your passwords without your master password.

Use Tailscale. Don't expose the port to the public. You're good to go. On iOS, the Tailscale app allows for on demand joining of your Tailscale network (when you're off from your home network for example). This makes it easy. On Android it's not as direct, can use Tasker to achieve this, it's not great. But there's a feature request on their repo too.

Alternatively, there's Netbird which behaves similarly. I haven't tried it, but have read good things about it.

Neither are US based as well if that's a concern for you. Tailscale is Canadian, and Netbird is German. Netbird is completely open source. With Tailscale, the CLI and Android apps are open source, and there's an open source alternative to the control server called Headscale. But honestly, using their free tier is probably enough (for both services).

This might be a good option for you: https://elfhosted.com/