KeePassXC: A Local, Offline-First Password Manager
/keepassxc
KeePassXC is worth installing if you want your passwords in a file you actually own, not locked inside a vendor's cloud account. There's no built-in sync β that part is on you. Pair it with Syncthing or a cloud folder and you get the control of a local vault without giving up multi-device access. If self-managing that setup sounds like a hassle, a hosted manager will feel easier to live with.
What is KeePassXC?
KeePassXC is a free, open-source password manager for Windows, macOS, and Linux, built as a community-driven port of the Windows-only KeePass Password Safe. It stores usernames, passwords, URLs, notes, and file attachments inside a single encrypted KDBX database file that stays wherever you put it β no account or server required. Entries sit in customizable groups with built-in search, and the database is encrypted at rest.
Core features: passwords, TOTP, and encrypted storage
- βReads and writes the KDBX3 and KDBX4 database formats, so it opens files created by the original Windows KeePass without conversion.
- βGenerates and stores TOTP codes directly inside an entry, so the two-factor code sits next to the password it belongs to.
- βSupports YubiKey and OnlyKey challenge-response as a second challenge-response factor alongside the master password.
- βBrowser integration covers Chrome, Firefox, Edge, Chromium, Vivaldi, Brave, and Tor Browser, plus passkey support through that same integration.
- βAuto-Type punches credentials into any desktop window, not just a browser form.
- βShips a command-line tool, keepassxc-cli, plus SSH agent integration and FreeDesktop.org Secret Service support for Linux desktops.
- βDatabase reports flag weak, reused, or breached (HIBP) passwords.
- βTwofish and ChaCha20 are available as alternate encryption ciphers.
Getting KeePassXC on Windows, macOS, and Linux
Pre-compiled binaries for Windows, macOS, and Linux are on the KeePassXC downloads page, and the project's QuickStart Guide walks through first setup on each OS. Many Linux distributions package KeePassXC directly, so checking your distro's package list first can save a manual download. Building from source is documented separately in the Build and Install page and the project wiki. Beyond grabbing the installer, KeePassXC does not require an account, server, or activation step to start using it.
Strengths
- βThe database format (KDBX3/KDBX4) is the same one KeePass uses, so you're never locked into KeePassXC specifically β any compatible client can open the file.
- βTOTP, YubiKey challenge-response, and password health/HIBP reports are built in, not bolted on as paid add-ons.
- βAuto-Type and the CLI (keepassxc-cli) cover workflows browser-only managers don't touch, like desktop apps and scripts.
- βEverything happens locally β the encrypted file never has to touch a server you don't control unless you put it there yourself.
Limitations of KeePassXC
- β³There's no built-in cloud sync β the README frames the database as a file you place anywhere, including a cloud folder, but KeePassXC itself doesn't push or pull updates between devices; syncing is on you.
- β³Neither the README nor the feature list mentions an official mobile app, so using the same database on a phone means finding a separate KDBX-compatible app.
- β³Browser integration needs both the desktop app and a separate browser extension installed and paired per browser β it's not a single-click setup.
- β³Advanced features like SSH agent integration, field references between entries, and the Secret Service replacement require reading the docs first; they aren't obvious from the UI.
KeePassXC alternatives
Frequently asked questions
KeePassXC is free and open source, licensed under GPL-2 or GPL-3 per the project's own license file, with the source code hosted publicly on GitHub.
KeePassXC opens KDBX3 and KDBX4 database files, the same formats used by the original KeePass Password Safe, so an existing KeePass database works without conversion.
KeePassXC supports YubiKey, and OnlyKey, challenge-response as a second factor for opening a database, on top of the master password.
KeePassXC integrates with Chrome, Firefox, Edge, Chromium, Vivaldi, Brave, and Tor Browser through its browser integration feature, which also supports passkeys; the project's User Guide covers setup for each browser.
KeePassXC encrypts the database at rest and lets you choose Twofish or ChaCha20 as the cipher, keeping the file unreadable without the master password.
KeePassXC generates and stores TOTP codes directly inside an entry, keeping the two-factor code next to the password it belongs to rather than in a separate authenticator app.
The problem it solves
Most password managers ask you to trust a company's servers with your entire vault, syncing it through their cloud whether you want that or not. KeePassXC solves the narrower problem of keeping a single encrypted database file that only you hold, in a format (KDBX) open enough that it isn't locked to one vendor's app. That matters most to people who already distrust handing credentials to a third-party service but still want more structure than a spreadsheet or a text file.
Best use cases
- β’Keeping a single portable password database that you sync yourself via Syncthing, Dropbox, or a similar tool, instead of trusting a vendor's cloud.
- β’Storing TOTP secrets alongside the account they belong to, so two-factor codes don't live in a separate authenticator app.
- β’Decrypting a database with a YubiKey or OnlyKey in addition to a master password.
- β’Auto-filling credentials into desktop apps that don't have a browser, via Auto-Type, not just web forms.
- β’Running everything from the command line with keepassxc-cli, for scripting or headless servers.
Who should try it β and who should skip
Try KeePassXC if you're comfortable managing your own file sync and want a password manager that isn't tied to one company's servers, including anyone already used to tools like Syncthing or a personal cloud drive. Skip it if you want zero setup: people who just want an app that syncs on install and don't want to think about where the database file lives will be better served by a hosted manager. It's also a poor fit for a household that needs shared vault access without everyone first learning a sync tool.
Related repositories
Is keepassxc worth your time?
ChatGPT, Claude and Perplexity can all read this page. Ask one of them what it makes of keepassxc.