An offline password vault that lives on your own hardware
KeePassXC is a desktop password manager that stores credentials in a single encrypted file instead of a hosted service. The database uses the KDBX format shared with KeePass, so several compatible programs can open it, and it is protected by a master password, a key file, or both. Because the application itself uploads nothing, there is no account to create, no subscription to maintain and no vendor server that can be breached. That property is the main reason people choose it: the vault is a file, and the file is yours.
What goes into the database
Beyond usernames and passwords, KeePassXC holds one-time password (TOTP) seeds, passkeys, SSH keys, file attachments, custom fields and free-form notes. Entries can be grouped, tagged and found with advanced search queries, given expiry dates, and kept with a revision history so an accidental overwrite can be rolled back. TOTP entries generate six-digit codes on the spot, and the built-in SSH agent can hand keys stored in the database to other programs. On Windows the program also offers global auto-type: press a hotkey on a login form and KeePassXC types the matching credentials into the active window, avoiding the clipboard entirely. Browser integration runs through the KeePassXC-Browser extension, which talks to the desktop application over a local connection rather than through a cloud account.
The daily workflow
Typical use is a master password to unlock, a search or an auto-type hotkey to fill a login, and a short automatic lock timeout when the keyboard goes quiet. New credentials are captured in the entry editor, where a random password can be generated at a chosen length and character set before saving. Because the vault is an ordinary file, syncing is the user's job: place the KDBX file in a folder that a file-sync client already replicates, or keep it on removable storage. A merge function exists for the case where the same database was edited on two machines, but it should be treated as a recovery tool rather than a substitute for a sync routine.
Configuration choices and hard limits
The database offers AES-256 or ChaCha20 encryption and a choice of Argon2 or AES key derivation, with the KDF parameters tunable so that unlocking stays slow enough to frustrate offline guessing on your own hardware. Two-factor unlocking is supported with a YubiKey challenge-response slot. The limits are structural rather than technical: there is no server component, so nothing syncs automatically; a forgotten master password cannot be reset by anybody; and two devices writing to the same file at the same time can produce conflicting copies. Attachments and very large databases also increase the time each save takes.
When a different tool fits better
Choose a hosted manager such as Bitwarden if you want automatic sync, web access and shared collections without maintaining files or sync folders. Rely on a browser's built-in vault only if you accept that recovery and export are tied to that vendor. KeePassXC suits people who are comfortable keeping a backup of one important file and who want the vault to work offline, on a machine that never sees the internet, or straight from a USB stick.
- Best for
- People who want a free, offline password manager with auto-type, browser fill-in, TOTP codes and SSH keys, and who will keep their own backups of the database file.
- Good to know
- The vault is a file, not a service. Test a restore from backup before you need it, use a strong master password plus a key file or hardware key where possible, and never edit the same database from two devices at once.
KeePassXC turns a password list into one encrypted file that never leaves your devices.
How to get started
- Run the Windows MSI, create a new database and choose a master password that is long but memorable. Add a key file or a hardware key if you want a second unlock factor.
- Save the database somewhere that is already backed up, and export a copy to offline media right away.
- Add your first entry, generate a random password for it, and save the database.
- Install the KeePassXC-Browser extension if you want logins filled in the browser, then approve the connection from the desktop application.
- Practise auto-type once: focus a login field, press the hotkey, and confirm the credentials land in the right window.
Questions & answers
Does KeePassXC sync my passwords?
No. It never uploads the database. Sync happens only if you put the KDBX file in a folder that another tool already replicates between machines.
What happens if I forget the master password?
There is no recovery service. Without the master password and any key file you configured, the database cannot be opened by anyone, including the developers, so keep the credentials safe.
Can two computers use the same database?
Yes, through a sync folder or a shared drive, but avoid editing on both at once. If that happens, use the merge feature and check the result entry by entry.
