What Is KeePassXC? An Offline, Open-Source Password Manager Explained

Key takeaways

• KeePassXC keeps your vault in a local encrypted file (KDBX), so you decide where it is stored and how it is backed up.
• Strong security needs a long master password; consider adding a key file or YubiKey.
• Syncing and recovery are your job. Lose the file and the password and there is no reset.
• It also generates passwords and TOTP codes and can integrate with browsers.
• Cloud managers are easier for families and teams; KeePassXC suits people who want control and offline storage.

What is KeePassXC?

KeePassXC is a community-developed password manager for Windows, macOS and Linux. It is a continuation of the KeePassX project and uses the same database format as the KeePass 2 family (KDBX). Its source code is public, so independent people can inspect it. You can read the official guides on the KeePassXC documentation site.

How does KeePassXC work?

All your entries (site, username, password, notes, attachments) live inside one file with the extension .kdbx. The file is encrypted with a key derived from your master password and any extra factors you add. Without those, the file is unreadable. The application reads and writes this file locally. There is no account and no server unless you choose to copy the file somewhere.

The key derivation function matters because it slows down password guessing. Modern KeePassXC databases use Argon2, and let you choose how much memory and time unlocking takes. A longer unlocking time makes brute force harder, so on a normal laptop an extra second is a fair trade for much stronger protection.

What can KeePassXC do?

• Generate passwords and passphrases with length and character options.
• Browser integration through an extension that fills credentials in supported browsers.
• TOTP codes for sites that use authenticator apps. Keeping the password and the one-time code in the same file reduces the benefit of two-factor authentication, so many security teams keep them apart for high-value accounts.
• Key files and hardware keys as extra unlock factors.
• Auto-Type for desktop applications.
• SSH agent integration so keys can be loaded from the database.
• Password health checks to flag weak or reused passwords.

How do you set up KeePassXC safely?

1. Download it from the official project site or your Linux distribution's package repository. Do not use a download link from an advert or a forum.
2. Create a new database and choose a long master passphrase you have never used elsewhere. Four or more random words is a good starting point.
3. Optionally add a key file or hardware key. Store the key file separately from the database.
4. Raise the key derivation settings until unlocking takes around one second on your slowest device.
5. Save the database in a folder that is backed up, and make a second copy on a different device.
6. Write the master passphrase on paper and store it somewhere safe. There is no recovery service.
7. Turn on auto-lock after inactivity and clipboard clearing.

How do you sync KeePassXC across devices?

KeePassXC does not sync by itself. People copy the database to a file-sync folder or use a tool that syncs files between devices. The risk is conflict: if two devices edit the file at the same time, you can end up with two versions. Open the file on one device, close it, then use it on another. KeePassXC can merge a database with another copy, which helps when conflicts happen.

KeePassXC versus cloud password managers

My view, offered as an opinion: for a single person or a small technical team that is comfortable with files and backups, KeePassXC is a good fit. For a family or a company that needs sharing, audit logs and easy onboarding, a cloud manager is usually more practical.

Common mistakes

• Using a short master password because "the file is local". An attacker who copies the file can guess offline.
• Keeping the key file in the same folder as the database.
• Having only one copy of the database.
• Forgetting that browser autofill extensions widen the attack surface; keep the browser updated.
• Locking yourself out after changing the master password on one device and not another.

Next steps

Password hygiene is the first topic in most security courses. If you want to build on it, see our cyber security course. For a practical walk-through of the older KeePass application, read how to use KeePass for secure password management.

Related reading

• How to Set Up and Connect Metasploit with PostgreSQL on Kali Linux for Advanced Penetration Testing
• Metasploit Framework | The Ultimate Ethical Hacking and Penetration Testing Tool with Database Setup and Real-World Attack Scenarios