KeePassXC

What Is KeePassXC?

If you don’t want your passwords living on somebody else’s server, you end up with the same problem every time: you need a vault that’s secure, works across devices, and doesn’t quietly turn into a cloud account you can’t audit.

KeePassXC solves that by keeping your password database as a local file (the KeePass-compatible KDBX format). You decide where it’s stored and how it’s synced (or not synced). There’s no required online account, no mandatory subscription, and no “we’ll hold your hand if you give us your email.” That local-first design is the core differentiator.

It’s built for people who care about control: privacy-focused users, power users who can handle a bit of setup, and teams who want a vault they can manage like any other sensitive file (with their own storage, their own backups, their own threat model). If you’re looking for “install and forget” cloud sync with easy sharing and admin controls, KeePassXC can work, but it won’t do the work for you.

KeePassXC Features and Performance

KeePassXC’s day-to-day experience is built around a few key workflows: generating strong passwords, storing credentials/notes/attachments, and retrieving them quickly without leaking them. The official Getting Started Guide explicitly describes that when you access your database, the data is decrypted and held in your computer’s memory while in use—normal for desktop password managers, but it’s a reminder that endpoint security still matters.

Browser integration (autofill + password generation)

The biggest “modern password manager” feature is browser integration via the KeePassXC-Browser extension. KeePassXC’s documentation states it supports this extension, and the official guide lists availability for Chrome/Chromium-based browsers (including Brave and Vivaldi), Firefox (including Tor Browser), and Microsoft Edge. (keepassxc.org)

The connection model is explicit: you enable browser integration in the desktop app, connect the extension, and then authorize access between a specific browser instance and a specific database (with an optional “Remember” choice when confirming access). That design is less “silent autofill everywhere” and more “approve what the browser can see,” which privacy-minded users tend to prefer. (keepassxc.org)

There are real platform caveats. On Linux, the docs warn that Flatpak and Snap-based browsers are generally not supported (with Ubuntu’s Firefox Snap called out as an exception). If you run sandboxed browsers, expect troubleshooting. (keepassxc.org)

Passkeys support (via browser integration)

KeePassXC’s documentation also covers passkeys support, and it’s not a standalone magic trick: passkeys are supported through the KeePassXC browser extension and a connected database. If you want passkeys, you’re in “desktop app + extension” territory, not “mobile-only cloud vault.”

Database format compatibility + crypto options

KeePassXC works with KDBX databases (KeePass-compatible), and the official Getting Started Guide lists additional encryption choices including Twofish and ChaCha20.

If you care about how KDBX evolves, KeePass (upstream) documentation explains that using KDFs like Argon2 requires KDBX 4, and that selecting ChaCha20 as the file encryption algorithm also enforces KDBX 4 in KeePass. That matters because “KeePass ecosystem” compatibility is real, but older clients may lag on newer KDBX 4 features.

SSH agent integration (seriously useful for developers)

One feature many cloud-first managers still don’t do well: SSH agent integration. The KeePassXC User Guide states that on Windows the SSH Agent integration supports PuTTY Pageant and OpenSSH for Windows 10.

The ANSSI CSPN security target document (published as part of the certification set) also describes this feature as KeePassXC directly adding/removing SSH private keys in an ssh-agent or Pageant process, and notes the main use case is single-user.

“Simultaneous connections” (VPNSpotter spec)

Your database lists simultaneous connections: 999 and pricing model: free (verified by VPNSpotter). For a local password manager, “connections” isn’t a standard metric the way it is for VPNs; practically, KeePassXC’s usage is constrained by your device resources and how many client integrations you’ve paired (for example, browser-extension pairings), not by an account-based connection limit.

Performance: what’s actually “slow”

KeePassXC is generally fast in normal use because it’s local: there’s no network round-trip to unlock or retrieve entries. The time you’ll feel is the unlock cost, which depends heavily on your KDF settings (e.g., Argon2 memory/iterations) and your hardware. KeePassXC’s own audit report (Molotnikov review) includes explicit recommendations around choosing stronger KDF parameters (notably Argon2id with high memory), which can increase unlock time—this is a deliberate trade-off between brute-force resistance and convenience.

Pricing and Plans

KeePassXC is free (VPNSpotter verified), and its official site positions it as a download with no paid tiers shown in the download flow. (keepassxc.org)

There is no evidence in official documentation of monthly/annual subscriptions, family plans, or built-in paid upgrades. Because there’s no purchase, there’s no standard “refund window” to evaluate. If you donate to the project (not covered in the sources above), that’s not the same thing as a subscription contract.

Practical implication: you’re not paying money, but you are paying with responsibility. You own the file, the backups, and the sync method.

Privacy and Security Assessment

Jurisdiction and data exposure model

KeePassXC’s strongest privacy attribute is structural: it doesn’t require an online account or hosted vault. Your database is a local (or user-synced) file, so there’s no central service that can log vault access by default.

That also changes the jurisdiction conversation. With cloud password managers, jurisdiction often means “where is the company incorporated and where are the servers.” With KeePassXC, jurisdiction is mostly about the software project and distribution, because the sensitive data storage location is chosen by you.

Open source + published security work

KeePassXC publishes a dedicated page listing security audits and certifications. It states that KeePassXC 2.7.9 (Windows 10) received an ANSSI CSPN security visa dated November 17, 2025, valid until November 17, 2028, and it also lists an application security review dated January 19, 2023 (Molotnikov report) for version 2.7.4. (keepassxc.org)

The ANSSI/Synacktiv certification materials go beyond “we’re open source, trust us.” For example, the Synacktiv technical report describes the KeePassXC browser-integration communication model (proxy, named pipe, key exchange, and message encryption using NaCl/libsodium). That’s not a guarantee of perfection, but it’s serious third-party scrutiny and documentation. (keepassxc.org)

Known vulnerabilities / advisories (recent)

KeePassXC maintains GitHub Security Advisories. Two examples published September 23, 2026 (both rated low severity):

• A heap out-of-bounds read issue via integer overflow in the legacy .kdb importer, described as denial-of-service and patched in 2.8.0. (github.com)
• A Windows Pageant SSH agent key sharing issue where a predictable shared memory name could allow interception by a malicious local application under the same user; patched in 2.8.0 by randomizing the mapping name (with limitations noted). (github.com)

Takeaway: the project does disclose issues and ship fixes, but “local-first” does not mean “invulnerable.” If you use niche features like SSH agent integration, keep the app updated.

Critical realism: your endpoint is the real boundary

KeePassXC can encrypt your vault strongly, but once you unlock the database, secrets exist in memory and can be exposed by malware running as you. The official Getting Started Guide spells out that your info is decrypted and stored in your computer’s memory while you’re accessing the database. That’s true of most password managers, but it’s the part people forget.

Strengths and Limitations

Strengths

• Local-first by design: no required cloud account, no forced hosted vault.
• KeePass ecosystem compatibility via KDBX format, letting you choose alternative clients on different platforms.
• Browser integration exists and is well-documented, including explicit pairing and per-database authorization flows. (keepassxc.org)
• Advanced features for technical users, especially SSH agent integration (Windows support includes Pageant and OpenSSH for Windows 10).
• Real security work is published, including ANSSI CSPN certification details and a separate independent review report. (keepassxc.org)

Limitations

• No built-in “cloud vault”: you must handle sync/backup yourself (which is either a feature or a chore).
• Browser extension caveats on Linux: Flatpak/Snap browsers are generally unsupported (Ubuntu Firefox Snap noted as an exception). (keepassxc.org)
• Some features are power-user oriented (SSH agent integration, KDF tuning). Misconfiguration can hurt usability.
• Vulnerabilities happen: recent low-severity advisories show that edge-case features can have local-attack surface (patched in 2.8.0). (github.com)

Who Should Use KeePassXC?

Good fit if you are:

1. Privacy-first and cloud-averse: you want a password manager that doesn’t require a hosted account and lets you control storage and syncing.
2. A technical user or developer who benefits from features like SSH agent integration and wants a desktop-first workflow.
3. Someone who wants ecosystem flexibility: you can keep one KDBX vault and choose different compatible clients on different OSes.

Not a great fit if you are:

1. Looking for effortless multi-device sync and sharing with permissions, recovery flows, and admin controls built in.
2. Stuck in sandboxed-browser land on Linux and unwilling to troubleshoot extension/native messaging limitations. (keepassxc.org)
3. Expecting a support contract: this is a free, community-driven tool with published docs and security work, but it’s not a paid enterprise service.