How to Use KeePass: Setup, Daily Use, and Backup and Sync That Does Not Go Wrong

Key takeaways

• KeePass stores an encrypted.kdbx file you control; you manage sync and backup.
• Use a long unique master passphrase; a lost master password cannot be recovered.
• Use Auto-Type or KeePassXC browser integration and generate unique passwords per site.
• Keep two backups, avoid editing on two devices at once and use Synchronize to merge conflicts.

What is KeePass?

KeePass is a free, open-source password manager that stores your logins in one encrypted file on your own device, rather than on a company's servers. You unlock that file with a master password, and optionally a key file. Because the database is just a file (with the extension.kdbx), you control where it lives and how it is backed up. The trade-off is that you must handle sync and backup yourself.

The original KeePass 2.x is a Windows application. Several compatible programs read the same file format: KeePassXC for Windows, macOS and Linux, KeePassDX on Android and KeePassium or Strongbox on iOS. Download from the official sites only: keepass.info and keepassxc.org.

Step 1: create your database

1. Install KeePass (or KeePassXC) from the official site and verify the download if the site offers a checksum or signature.
2. Choose File, New and save the database somewhere you can back up, for example Passwords.kdbx.
3. Set a master password. Make it a long passphrase of several unrelated words that you have never used elsewhere. Length matters more than symbols. It is the only thing between an attacker with your file and every password inside, and it cannot be recovered if you forget it.
4. Optionally add a key file (a small file stored separately, for instance on a USB drive). An attacker then needs both the file and the password. Back up the key file, because losing it locks you out.
5. In database settings, check the encryption and key derivation. Current versions offer AES or ChaCha20 for encryption and Argon2 for key derivation. Argon2 makes guessing the master password slower. Increase the iterations until unlocking takes about a second on your computer.

Step 2: organise and add entries

• Make groups such as Email, Banking, Work and Social.
• Add an entry for each account with the title, username, password and URL.
• Use the built-in password generator to create a unique password per site. Twenty random characters is a sensible default unless the site limits length.
• Use the notes field for security question answers. Make those random too, since real answers can be guessed.
• Set an expiry date for entries you want to review.

Step 3: use it day to day

• Auto-Type types the username and password into the window you are logging in to. In KeePass 2.x the global shortcut is Ctrl+Alt+A by default. Check that the window title matches the right site before you trigger it.
• Copy and paste works too. KeePass clears the clipboard after a short time.
• Browser integration. KeePassXC has a browser extension that fills logins. It checks the site address, which helps against phishing pages.
• Set the database to lock after inactivity and when the screen locks.

Step 4: back up and sync, the part that goes wrong

A password manager you cannot restore is a risk. Plan this on day one.

1. Keep at least two backups of the.kdbx file in different places, such as an external drive and another cloud account. The file is encrypted, so a cloud copy is protected by your master password.
2. Sync through a shared folder (for example a cloud drive folder, Syncthing or similar) so each device opens the same file.
3. Avoid editing on two devices at the same time. If two copies change before they sync, the sync tool may create a "conflicted copy". Instead of deleting one, use KeePass's Synchronize feature (File, Synchronize, With File) to merge the two safely.
4. Close the database after editing so the sync tool uploads a clean file.
5. Test a restore now and then: open the backup on another device.
6. Keep the master password somewhere safe offline, such as written and stored securely, in case you forget it.

How is KeePass compared with cloud password managers?

Neither is "best". KeePass suits people who want control and are happy to manage backups. A cloud manager suits people who want convenience. Using any password manager is far better than reusing passwords.

What are the security tips?

• Turn on two-factor authentication on the accounts that matter, especially email. Prefer passkeys or hardware keys where offered.
• Keep the software updated and install plugins only from trusted sources, since plugins run with access to your database.
• Do not use KeePass on a computer you suspect is infected. Malware can capture the master password as you type.
• Keep the database small enough to back up easily and do not store the master password in the database.

Next steps

To build wider security habits, see the Cyber Security course. Related reading: KeePassXC for cybersecurity professionals and how to secure your social media accounts.