KeePassXC

KeePassXC is the password manager for people who do not want a password manager company in the loop at all. Your vault is a single encrypted file on your own disk. There is no account, no cloud, no subscription, and no server that can be breached, subpoenaed, or shut down. That design is also the catch: syncing between your laptop and your phone is a problem you have to solve yourself, and there is no official mobile app to solve it with. If that trade sounds right, KeePassXC is excellent. If it sounds like work, it will feel like work.

Security

KeePassXC encrypts your database with AES-256 by default — Twofish and ChaCha20 are also on the menu — in the current KDBX 4 format, with an HMAC-SHA-256 check that detects if the file has been tampered with or corrupted. The master key is stretched with Argon2d by default, a memory-hard function that makes large-scale GPU and ASIC brute-forcing expensive; the older AES-KDF is still selectable for compatibility. This is a modern, conservative cryptographic setup, and because the database never leaves your machine unless you move it, there is no server-side attack surface to worry about.

The unlock secret can be more than a password. KeePassXC supports a composite master key that combines a password, a key file, and a hardware token — a YubiKey or OnlyKey in HMAC-SHA1 challenge-response mode. Adding a key file or hardware challenge-response is the closest thing here to a “second secret”: an attacker with your password still cannot open the database without the other factor. There is no separate account-recovery secret because there is no account. FIDO2/U2F is not supported for opening the database — the project’s reasoning is that it needs online components that an offline file cannot provide.

Security has been examined by outside parties twice. In November 2025 KeePassXC 2.7.9 on Windows passed France’s First-level Security Certification (CSPN): the evaluator, Synacktiv, reviewed the entire product source code, ran penetration tests against every security function, and analysed the cryptographic mechanisms and the random-number generator. Its verdict was that no security function had an exploitable vulnerability at the targeted attacker level, and that potential issues it did find proved non-exploitable within the defined threat model. The certification report, certificate and security target are all public PDFs. Earlier, in January 2023, an independent security consultant published an unpaid review of the KDBX read/write core and its cryptography in version 2.7.4, found “no major problems,” and recommended tightening how memory is wiped after the database locks and steering users off older, weaker file formats. That review left several helper features — TOTP, the SSH agent, browser-extension messaging, KeeShare — out of scope, so it is a lighter-weight assessment than the 2025 certification.

The recovery model is the strict, unforgiving kind. Lose the master password (and any key file or hardware token you set), and the vault is unrecoverable — there is no company that can reset it because there is no company that ever had it.

Privacy & Trust

This is where the local-only design pays off. KeePassXC collects nothing — it is an offline desktop application with no analytics and nothing phoning home. The optional Have I Been Pwned check and the browser integration make network requests, but only when you ask them to. The code — the whole application, in C++ and Qt — is on GitHub under GPL-2.0/GPL-3.0, and both outside reviews worked directly from that source. The project does not advertise reproducible builds, which is the one verifiability gap worth naming.

There is no owner in the corporate sense. KeePassXC is a volunteer, community-run project under the keepassxreboot organization, funded by donations, with no company and no venture money behind it. It began in 2016 as a fork of the stalling KeePassX project, which was itself a cross-platform fork of the original Windows KeePass from 2003. Nobody has an incentive to change the business model, add a paid tier, or get acquired, because there is no business model to change.

There has never been a confirmed security incident affecting KeePassXC user data.

Features

For a free tool the feature set is deep. KeePassXC stores passwords, passphrases, TOTP seeds, attachments, SSH keys and arbitrary custom fields; generates passwords and diceware passphrases; reports weak, reused and expired entries; checks entries against Have I Been Pwned; and has an import wizard that reads other major managers’ exports as well as CSV. Since version 2.7.7 it can also store and autofill passkeys for websites through its browser extension, and a passkey saved via one browser’s extension is available in the others once each is connected.

The gaps are structural. There are no built-in email aliases. Secure sharing exists only as KeeShare — a shared KDBX file you distribute yourself — not a send-someone-a-link feature. There is no emergency access, no family organization, and no hosted anything, because all of those need a server. Autofill is handled by the KeePassXC-Browser extension talking to the desktop app; it works, but it is a two-piece setup rather than one integrated app.

Usability & Platforms

KeePassXC runs on Windows, macOS and Linux as a native Qt application, ships packages for essentially every Linux distribution, and includes an official command-line tool, keepassxc-cli, that can do most of what the GUI does. Browser extensions cover Firefox, Chrome, Edge and other Chromium browsers.

Mobile is the real limitation, and it is scored here deliberately, not by accident: there is no official KeePassXC app for Android or iOS. You can open the same KDBX file with third-party apps — KeePassDX or KeePass2Android on Android, Strongbox or KeePassium on iOS — but that is a separate project’s software you have to choose and trust, and syncing the file to the phone is on you (a cloud-storage folder, Syncthing, a USB cable). Users in the wild report exactly this friction: version-conflict copies when a database is left open in two places, a dated-looking interface, and browser autofill that can break after a Chrome update or misbehave in Firefox. None of this is a security problem. It is the difference between a tool you configure and maintain and a service that just works on every device you own.

Price & Value

KeePassXC is free — genuinely, completely free, with no paid tier, no accounts, and no feature held back for a subscription. It is funded by donations. On pure cost there is nothing to weigh against it.

The value question is really the effort question. What you save in money you spend in setup and maintenance: choosing a sync method, installing and trusting a third-party mobile app, keeping the browser extension talking to the desktop app. For someone who wants that control and does not mind the upkeep, the value is enormous. For someone who wants to install one app on every device and have it sync itself, a hosted manager will be worth its yearly fee.

Pros

• Vault is a local encrypted file — no account, no cloud, no server to breach, subpoena or shut down
• AES-256 with Argon2d key derivation by default, in the modern KDBX 4 format with tamper detection
• Composite master key can add a key file and a YubiKey/OnlyKey challenge-response on top of the password
• Passed France’s ANSSI First-level Security Certification in 2025 (full source review + penetration testing by Synacktiv), report public
• Fully open source (GPL), volunteer-run, donation-funded — no company, no paid tier, nothing to monetize
• No telemetry; network features (breach check, browser integration) are opt-in only
• Free with no limits: TOTP, SSH agent, breach checks, passkey storage, an import wizard for other managers, a full CLI

Cons

• No official mobile app — Android and iOS rely on separate third-party projects that open the same file
• No built-in sync; you set up and maintain your own, and left-open databases can create version-conflict files
• No email aliases, no link-based sharing, no emergency access, no family organization (all need a server)
• Autofill is a desktop-app-plus-extension setup that can break after browser updates, especially on Firefox
• Recovery is all-or-nothing: lose the master key and the vault is gone, with nobody able to reset it
• Reproducible builds are not offered, so binaries can’t be independently matched to the public source
• Dated interface; it is a tool to configure, not a service that works out of the box

Our Rating

KeePassXC earns its score on security and trust: a modern local cipher stack, a genuine 2025 government-lab certification, a fully open codebase, and a volunteer project with nothing to sell you. It loses ground on the everyday experience — no official mobile app, no sync you don’t build yourself, autofill that needs tending. Treat it the way you’d treat a specialist tool: if “my vault is a file I control and nobody else can touch” is the point, this is the best free way to do it. If you want a manager that quietly follows you across every device, this is not that, and it is not trying to be.

Rating: 8.0/10