KeePass is an encrypted password database format. It is an alternative to online password managers and is supported on all major platforms.
There are two versions of the format: KeePass 1.x (Classic) and KeePass 2.x
There are three major implementations of KeePass available in the official repositories:
- KeePass — A cross-platform password manager that has autotype and clipboard support when respectively and are installed. It lets you import many formats and has many plugins.
- KeePassXC — Fork of KeePassX that is actively maintained and has additional features like browser integration, support for SSH agent, secret service, Yubikey, finger-print reader, TOTP generator and KeeShare. Also provides a CLI.
- — A modern GNOME password manager built on top of of KeePass.
Other lesser-known alternatives can be found in the AUR:
- keepassc — A curses-based password manager compatible to KeePass v.1.x and KeePassX. It uses
xselfor clipboard functions.
- kpcli — A command line interface for KeePass database files
- keepmenu — Dmenu/Rofi frontend for Keepass database files.
- AuthPass — KeePass compatible password manager based on Flutter. Comes with default sync suport for Gdrive, Dropbox, and WebDav.
- https://authpass.app || AUR
- keeweb — A web app (online / Electron) compatible with KeePass 2.x. KeeWeb comes with default Sync support for major cloud services, Gdrive, Onedrive, Dropbox etc. No active development since release of 1.18.7 on July 18th 2021.
- https://keeweb.info || AUR AUR AUR
- KeePassX — Started as a Linux port of KeePass. AUR uses the KeePass 2.x format, but can import 1.x databases. It also lets you import PwManager and KWallet XML databases. It does not support plugins.  No active development since 2016. 
- https://www.keepassx.org/ || AUR AUR
Many plugins and extensions are available for integrating KeePass to other software. KeePassX and KeePassXC do not have a plugin interface, but KeePassXC has various integrations built-in.
Plugin installation in KeePass
KeePass is by default installed at
plugin.plgx to a plugins sub-directory under the KeePass installation directory as demonstrated below:
# mkdir /usr/share/keepass/plugins # cp plugin.plgx /usr/share/keepass/plugins
keepassxc-browser for KeePassXC
keepassxc-browser is the browser extension of KeePassXC’s built-in browser integration using native-messaging and transport encryption using libsodium. It was developed to replace KeePassHTTP, as KeePassHTTP’s protocol has fundamental security problems.
The developers provide the browser extension on
- Firefox Add-ons (for Firefox and Tor Browser) and
- in the chrome web store (for Chromium, Google Chrome, Vivaldi and Brave).
Support for Firefox and Chromium forks is available. For
keepassxc-browser for KeePass
KeePassRPC and Kee
The KeePass plugin is available from GitHub or from the AUR ( AUR).
Via autotype feature
An alternative to having a direct channel between browser and KeePass(XC) is using the autotype feature.
To enable the autotype feature on Wayland, edit
/usr/share/applications/org.keepassxc.KeePassXC.desktop and change the value of
keepassxc -platform xcb. Alternatively, set the
QT_QPA_PLATFORM=xcb environment variable before launching KeePassXC. However, native Wayland applications will not work with autotype. For example, autotype works when running Firefox without Wayland, but not with.
There are browser extensions which support this way by putting the page URL into the window name:
- Keeweb for Nextcloud ( AUR)
- Open Keepass stores inside Nextcloud
YubiKey can be integrated with KeePass thanks to contributors of KeePass plugins. KeepassXC provides built-in support for Yubikey Challenge-Response without plugins.
Configuration with KeePass
- Configure one of Yubikey slots to store static password. You can make the password as strong as 65 characters (64 characters with leading "!"). This password can then be used as master password for your KeePass database.
- one-time passwords (OATH-HOTP)
- Download plugin from KeePass website: https://keepass.info/plugins.html#otpkeyprov
- Use AUR to setup OATH-HOTP
- In advanced mode untick OATH Token Identifier
- In KeePass additional option will show up under Key file / provider called One-Time Passwords (OATH HOTP)
- Copy secret, key length (6 or 8), and counter (in Yubikey personalization GUI this parameter is called Moving Factor Seed)
- You may need to setup Look-ahead count option to something greater than 0, please see this thread for more information
- See this video for more help
- Challenge-Response (HMAC-SHA1)
- Get the plugin from AUR: AUR
- In KeePass additional option will show up under Key file / provider called Yubikey challenge-response
- Plugin assumes slot 2 is used
KeePassXC offers SSH agent support, a similar feature is also available for KeePass using the KeeAgent plugin.
The feature allows to store SSH keys in KeePass databases, KeePassXC/KeeAgent acts as OpenSSH Client and dynamically adds and removes the key to the Agent.
The feature in KeePassXC is documented in its FAQ. First configure SSH agent to start on login and make sure the
SSH_AUTH_SOCK variable is set. Then logout and log back in. Now, in KeePassXC settings, enable SSH agent integration. The
SSH_AUTH_SOCK value exposed in the UI should correspond to what you configured earlier.
ssh-add -D, therefore KeePassXC/KeeAgent cannot remove them when locking the database.  
KeePassXC contains a Freedesktop.org Secret Service integration. It can be enabled by going into the settings (under the Tools menu).
KeePassXC will refuse to enable its integration if it detects that another program (such as GNOME/Keyring) is already providing that service. You should first stop that program; for example, for , stopping
gnome-keyring-daemon.service user unit.
Note that you will likely want to disable the program permanently, otherwise KeePassXC's integration will fail on the next reboot. Again, for disabling the
gnome-keyring-daemon.socket (still for the systemd/User).
[D-BUS Service] Name=org.freedesktop.secrets Exec=/usr/bin/keepassxc
Tips and tricks
Disable your clipboard manager
If you are an avid user of clipboard managers, you may need to disable your clipboard manager before you launch Keepass and then re-start your clipboard manager afterwards.
KeePassXC implementations has the option to auto-clear the clipboard manager after an amount of time, enough to paste copied items.
To enable the dark theme for KeePass, install
User interface scaling issues with KeePassXC 2.6
Some options like Start minimized and locked may appear greyed-out. According to a discussion on SourceForge, since version 2.31, KeePass has disabled two options because of their broken behaviors on Mono.
To force these features to be enabled, launch KeePass with the
Wrongly scaled tray icons
Keebuntu contains three plugins to provide desktop integration:
- Cinnamon and MATE; AUR: For
- Plasma and GNOME with ; AUR: For
- keepass2-plugin-launcher: For Unity and dock.
After installing one of these plugins, it is sometimes necessary to hide the original tray icon to prevent duplicate icons in the system tray.