KeePassXC – Cross-Platform Password Manager

Introduction to KeePassXC

KeePassXC is a free, open-source, cross-platform password manager that stores passwords and other sensitive information in an encrypted database. As a community-driven fork of KeePassX, KeePassXC offers a modern, feature-rich approach to password management while maintaining the security and compatibility of the KeePass database format (KDBX). The application runs natively on Windows, macOS, and Linux without requiring external frameworks or dependencies.

Unlike cloud-based password managers, KeePassXC stores your encrypted database locally, giving you complete control over your sensitive data. The database can be synchronized across devices using any cloud storage service or file synchronization tool of your choice. KeePassXC uses AES-256 or ChaCha20 encryption, Argon2 key derivation, and supports hardware security keys like YubiKey for additional protection.

Key Features and Capabilities

KeePassXC provides comprehensive password management including secure password generation, browser integration for auto-fill, TOTP (time-based one-time password) support, SSH agent integration, and secure note storage. The database format supports custom fields, file attachments, entry history, and group organization with icons. Password quality assessment helps users identify weak or reused passwords.

Advanced features include support for multiple databases, database merging, CSV import/export, KeeShare for secure credential sharing, and extensive keyboard shortcuts. The software includes a command-line interface for scripting and automation. Browser integration through KeePassXC-Browser extension enables seamless password filling across Chrome, Firefox, Edge, and other browsers.

Installation on Linux

KeePassXC is available for Linux through package managers and universal formats.

Installing on Ubuntu/Debian

# Add official PPA for latest version
sudo add-apt-repository ppa:phoerious/keepassxc
sudo apt update
sudo apt install keepassxc

# Or install from standard repositories
sudo apt install keepassxc

# Launch KeePassXC
keepassxc

Installing via Flatpak

# Add Flathub repository
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

# Install KeePassXC
flatpak install flathub org.keepassxc.KeePassXC

# Run KeePassXC
flatpak run org.keepassxc.KeePassXC

Installing via Snap

# Install KeePassXC via Snap
sudo snap install keepassxc

# Launch KeePassXC
keepassxc

Installing on Fedora

# Install KeePassXC
sudo dnf install keepassxc

Installing on Arch Linux

# Install from official repositories
sudo pacman -S keepassxc

Installing via AppImage

# Download from keepassxc.org
wget https://github.com/keepassxreboot/keepassxc/releases/download/X.X.X/KeePassXC-X.X.X-x86_64.AppImage

# Make executable
chmod +x KeePassXC-*.AppImage

# Run
./KeePassXC-*.AppImage

Installation on Windows

KeePassXC for Windows is available through multiple installation methods.

Installing via Direct Download

# Download from keepassxc.org
# Run KeePassXC-X.X.X-Win64.msi
# Follow installation wizard

Installing via Winget

# Install using Windows Package Manager
winget install KeePassXCTeam.KeePassXC

# Upgrade KeePassXC
winget upgrade KeePassXCTeam.KeePassXC

Installing via Chocolatey

# Install using Chocolatey
choco install keepassxc

# Upgrade KeePassXC
choco upgrade keepassxc

Portable Installation

# Download portable ZIP from keepassxc.org
# Extract to USB drive or desired location
# Run KeePassXC.exe
# Configuration stored in extracted directory

Installation on macOS

KeePassXC is available for macOS through Homebrew or direct download.

Installing via Homebrew

# Install KeePassXC
brew install --cask keepassxc

# Launch KeePassXC
open -a KeePassXC

Installing via Direct Download

# Download DMG from keepassxc.org
# Open DMG and drag KeePassXC to Applications
# Grant accessibility permissions when prompted

Getting Started

Creating and managing your password database.

Creating a New Database

# Create database:
Database > New Database (Ctrl+Shift+N)

# Steps:
1. Enter database name and description
2. Configure encryption settings:
   - Encryption Algorithm: AES-256 or ChaCha20
   - Key Derivation Function: Argon2id (recommended)
   - Transform rounds: Higher = more secure but slower
3. Set master password (strong, unique)
4. Optionally add key file or hardware key
5. Choose database location
6. Save database

Database Security Options

# Master password only:
# Single password protects database

# Password + Key file:
# Two-factor protection
# Key file can be stored separately

# Password + YubiKey:
# Hardware-based second factor
# Challenge-response authentication

# All three:
# Maximum security
# Password + Key file + Hardware key

Opening Database

# Open existing database:
Database > Open Database (Ctrl+O)

# Enter credentials:
# - Master password
# - Key file (if used)
# - Hardware key (if configured)

# Recent databases:
# Shown in welcome screen
# Quick access to frequently used databases

Managing Entries

Creating and organizing password entries.

Creating Entries

# New entry:
Entries > New Entry (Ctrl+N)

# Entry fields:
# - Title: Descriptive name
# - Username: Login name
# - Password: Generate or enter
# - URL: Website address
# - Notes: Additional information
# - Tags: For organization
# - Expiration: Optional expiry date

# Custom fields:
# Add additional attributes
# Can be hidden or visible

Password Generation

# Generate password:
# Click dice icon next to password field
# Or Tools > Password Generator

# Generator options:
# Length: 16-32+ characters recommended
# Character types:
#   - Uppercase (A-Z)
#   - Lowercase (a-z)
#   - Numbers (0-9)
#   - Special characters (!@#$...)
# Exclude similar characters (0/O, 1/l)
# Include characters from each group

# Passphrase generation:
# Use word list
# Configure word count and separator

Entry Organization

# Create groups:
Groups > New Group (Ctrl+Shift+G)
# Organize entries hierarchically

# Move entries:
# Drag and drop to groups
# Or right-click > Move to Group

# Search entries:
# Use search bar (Ctrl+F)
# Search by title, username, URL, notes

# Tags:
# Add tags to entries
# Filter by tags in sidebar

Browser Integration

Auto-fill passwords in web browsers.

Setting Up Browser Integration

# Enable browser integration:
Tools > Settings > Browser Integration
# Check "Enable browser integration"
# Select browsers to enable

# Install browser extension:
# KeePassXC-Browser available for:
# - Firefox
# - Chrome/Chromium
# - Edge
# - Brave
# - Vivaldi

# Connect extension:
# Click extension icon
# Click "Connect"
# Name the connection in KeePassXC
# Approve in KeePassXC

Using Browser Integration

# Auto-fill:
# Extension detects login forms
# Click username field
# Press Ctrl+Shift+L or click extension
# Select entry to fill

# Save new credentials:
# Extension detects new logins
# Prompts to save to KeePassXC

# Update credentials:
# Extension detects password changes
# Prompts to update entry

Browser Integration Settings

# Entry matching:
# Settings > Browser Integration
# - Match URL scheme
# - Match URL host
# - Match URL port

# Entry-level settings:
# Edit entry > Browser Integration tab
# - Additional URLs
# - Skip auto-fill
# - Only match HTTP auth

TOTP Support

Managing two-factor authentication codes.

Adding TOTP

# Add TOTP to entry:
1. Edit entry
2. Click clock icon (TOTP button)
3. Enter setup:
   - Scan QR code (if supported)
   - Or enter secret key manually
4. Configure settings:
   - Algorithm (SHA-1/SHA-256/SHA-512)
   - Time step (usually 30 seconds)
   - Digit count (usually 6)
5. Save entry

# Import from URL:
# Paste otpauth:// URL

Using TOTP

# View current code:
# Select entry
# Code shown in entry details

# Copy code:
# Ctrl+T or right-click > Copy TOTP

# Auto-type with TOTP:
# Include {TOTP} in auto-type sequence

# Browser integration:
# TOTP auto-filled after password (if configured)

SSH Agent Integration

Using KeePassXC as SSH key manager.

Enabling SSH Agent

# Enable SSH Agent:
Tools > Settings > SSH Agent
# Check "Enable SSH Agent integration"

# Options:
# - Remove keys from agent on database close
# - Require user confirmation when using keys

Adding SSH Keys

# Add key to entry:
1. Create or edit entry
2. Go to Advanced > Attachments
3. Add SSH private key file
4. Go to SSH Agent section
5. Select private key attachment
6. Configure options:
   - Add to agent on database unlock
   - Remove from agent on database lock
   - Require confirmation

# Supported key types:
# RSA, DSA, ECDSA, Ed25519

Using SSH Keys

# Linux/macOS:
# KeePassXC replaces ssh-agent
# SSH commands use keys from KeePassXC

# Windows:
# Works with OpenSSH and PuTTY
# Configure SSH_AUTH_SOCK or Pageant

# Test:
ssh -T git@github.com
# Should authenticate with KeePassXC key

Auto-Type

Automatic credential entry in applications.

Basic Auto-Type

# Global auto-type:
Ctrl+Alt+A (default shortcut)
# KeePassXC matches window title to entries
# Types credentials automatically

# Entry-specific auto-type:
Ctrl+Shift+V
# Types selected entry's credentials

Auto-Type Sequences

# Default sequence:
{USERNAME}{TAB}{PASSWORD}{ENTER}

# Custom sequence (entry settings):
{USERNAME}{TAB}{PASSWORD}{TAB}{TOTP}{ENTER}

# Available placeholders:
{USERNAME}    Entry username
{PASSWORD}    Entry password
{TOTP}        TOTP code
{URL}         Entry URL
{NOTES}       Entry notes
{TAB}         Tab key
{ENTER}       Enter key
{DELAY X}     Wait X milliseconds
{CLEARFIELD}  Clear field first

Window Associations

# Add window association:
Edit entry > Auto-Type tab
# Add window title patterns

# Pattern matching:
# Exact: "Login - Firefox"
# Wildcard: "*Login*"
# Regex: //Login.*//

KeeShare

Secure credential sharing between databases.

Setting Up KeeShare

# Enable KeeShare:
Tools > Settings > KeeShare
# Generate or import signing key

# Export group:
1. Right-click group
2. Select "KeeShare settings"
3. Choose export type:
   - Unsigned (insecure)
   - Signed (verify source)
4. Set export path
5. Configure sync settings

Importing Shared Credentials

# Import shared group:
1. Create group for imports
2. Right-click > KeeShare settings
3. Set as import location
4. Select shared file path
5. Set trust level:
   - Trust all
   - Ask before import
   - Reject unsigned

Command Line Interface

Using KeePassXC from terminal.

Basic Commands

# Show entry:
keepassxc-cli show database.kdbx entry-path

# List entries:
keepassxc-cli ls database.kdbx /group-path

# Get password:
keepassxc-cli show -s database.kdbx entry-path
# -s: show password

# Get specific attribute:
keepassxc-cli show -a password database.kdbx entry-path

# Copy to clipboard:
keepassxc-cli clip database.kdbx entry-path

Entry Management

# Add entry:
keepassxc-cli add database.kdbx entry-path
# Prompts for password

# Edit entry:
keepassxc-cli edit database.kdbx entry-path

# Delete entry:
keepassxc-cli rm database.kdbx entry-path

# Move entry:
keepassxc-cli mv database.kdbx source-path dest-path

Password Generation

# Generate password:
keepassxc-cli generate -L 32
# -L: length
# -l: lowercase
# -U: uppercase
# -n: numbers
# -s: special characters
# -e: exclude similar

# Generate to clipboard:
keepassxc-cli generate -L 24 | xclip -selection clipboard

Database Operations

# Create database:
keepassxc-cli create new-database.kdbx

# Merge databases:
keepassxc-cli merge database.kdbx other-database.kdbx

# Export to CSV:
keepassxc-cli export database.kdbx

# Import from XML:
keepassxc-cli import database.kdbx import.xml

Keyboard Shortcuts

Essential shortcuts for efficient operation.

Database Operations

Ctrl+N              New entry
Ctrl+Shift+N        New database
Ctrl+O              Open database
Ctrl+S              Save database
Ctrl+W              Close database
Ctrl+L              Lock database
Ctrl+Q              Quit

Entry Operations

Ctrl+B              Copy username
Ctrl+C              Copy password
Ctrl+Shift+T        Copy TOTP
Ctrl+U              Copy URL
Ctrl+Shift+U        Open URL
Ctrl+E              Edit entry
Delete              Delete entry
Ctrl+Shift+V        Auto-type selected
Ctrl+Alt+A          Global auto-type

Navigation

Ctrl+F              Search
Ctrl+G              Search groups
Escape              Clear search
F5                  Refresh
Ctrl+Tab            Next database tab
Ctrl+Shift+Tab      Previous database tab

Security Best Practices

Maximizing database security.

Master Password Guidelines

# Strong master password:
# - Minimum 16 characters
# - Mix of character types
# - Not used elsewhere
# - Consider passphrase (4+ random words)

# DO NOT:
# - Use personal information
# - Use common passwords
# - Write it down digitally
# - Share with others

Key Derivation Settings

# Configure key derivation:
Database > Database Security

# Recommended settings:
Algorithm: Argon2id
Memory usage: 64-256 MB
Iterations: 10-50
Parallelism: 2-4

# Higher values = more secure but slower unlock

Additional Security

# Enable additional features:
Tools > Settings > Security

# Auto-lock:
# Lock database after inactivity
# Lock when screen locks

# Clipboard:
# Clear after timeout (10-30 seconds)
# Never save to clipboard history

# User interface:
# Hide passwords by default
# Hide entry preview panel

Backup and Sync

Backing up and synchronizing databases.

Backup Strategies

# Automatic backups:
# KeePassXC creates .old backup on save

# Manual backup:
# Regularly copy .kdbx file to secure location

# Backup key file separately:
# Store key file and database in different locations

Cloud Synchronization

# Using cloud storage:
# Store database in synced folder:
# - Dropbox
# - Google Drive
# - OneDrive
# - Nextcloud

# Conflict resolution:
# KeePassXC detects conflicts
# Can merge changes from multiple sources

# Alternative: Syncthing
# Peer-to-peer sync without cloud

Troubleshooting

Common issues and solutions.

Browser Integration Issues

# Extension not connecting:
# 1. Verify browser integration enabled in settings
# 2. Ensure KeePassXC is running
# 3. Remove and re-add connection
# 4. Check for extension updates

# Auto-fill not working:
# 1. Check entry URL matches site
# 2. Verify entry is in browser integration group
# 3. Check entry-level browser settings

Database Issues

# Cannot open database:
# - Verify master password is correct
# - Check key file is correct
# - Ensure database file not corrupted
# - Try opening backup (.old file)

# Merge conflicts:
# Database > Database Security > Merge Changes
# Review and resolve conflicts manually

Conclusion

KeePassXC provides a secure, feature-rich password management solution that puts users in complete control of their sensitive data. Its local storage model eliminates concerns about cloud breaches, while still allowing synchronization through your preferred methods. With browser integration, TOTP support, SSH agent functionality, and robust encryption, KeePassXC offers everything needed for comprehensive credential management without subscription fees or privacy concerns.