KeePassXC

What KeePassXC does

KeePassXC is a desktop application for Windows, macOS and Linux that keeps all your logins, notes, attachments and custom fields in one encrypted database file. There is no account, no company server and no subscription. You decide where the file lives, and the database uses the KeePass KDBX format, so the same file opens in KeePass itself and in mobile apps such as KeePassDX, Keepass2Android and KeePassium.

Day-to-day use goes through the KeePassXC-Browser extension, which talks to the desktop app to fill logins in Chrome, Firefox, Edge, Brave, Vivaldi, Chromium and Tor Browser and can handle passkeys. Auto-Type types credentials into any desktop program. Beyond that, KeePassXC stores and generates TOTP codes, reports weak, reused or breached passwords (via Have I Been Pwned), keeps entry history, and includes a command-line tool, an SSH agent integration and a FreeDesktop Secret Service provider that can stand in for GNOME Keyring on Linux.

Security and encryption

The whole database is encrypted at rest, with AES-256 by default and Twofish or ChaCha20 as alternatives, and the master key goes through a configurable key derivation to slow down guessing. You can combine the password with a key file or a YubiKey or OnlyKey challenge-response. The only network use is optional, opt-in favicon downloading, and the project notes the app can be compiled with no networking code at all.

The FAQ reports an external audit by independent consultant Zaur Molotnikov, completed on 19 January 2023, and links the report. The project also points out that an audit only covers the code at that point in time.

Self-hosting KeePassXC

There is nothing to host. Official builds exist for Windows 10 and 11 and macOS 12 or later, and on Linux the project recommends Flatpak, with AppImage, Snap and distribution packages as alternatives. To use the vault on several devices, the FAQ suggests placing the file in a folder synced by Dropbox, Google Drive, OneDrive, Nextcloud or similar. The project chose not to build in cloud sync to keep the code simple and provider-neutral. Because the file is encrypted before it reaches the sync service, that service only stores ciphertext.

Hosted version

The project does not offer a hosted service: KeePassXC is local software, and your vault stays a file you control.

Limitations

KeePassXC has no mobile version, so phones need a separate KDBX app, and you must set up and trust a file sync method yourself. There is no multi-user sharing, admin console or recovery: if you lose the master password and key file, the data is gone. Moving from a cloud manager means exporting and importing; KeePassXC reads 1Password, Bitwarden, Proton Pass and CSV exports directly.

Who it suits

KeePassXC suits people who want full control and no third party: developers, Linux users and anyone who prefers a file over an account. It pairs naturally with a mobile KDBX app and a sync folder. Families and teams that need shared vaults and permissions will find Bitwarden or Passbolt easier.