KeePassDX

Is KeePassDX safe?

Yes, for Android users who are happy to look after their own password file. KeePassDX stores your passwords in an encrypted KeePass database on your phone, asks for no internet access and, according to its Google Play listing, collects no data at all. There is no account, no company server and nothing to leak in a breach. We score it 87/100, just behind KeePassXC (89), the desktop app it is most often paired with, and Bitwarden (88).

The catch is assurance. Nobody outside the project has published an audit of the code, and one developer, Jeremy Jamet, wrote most of it.

What does KeePassDX collect?

Nothing it can send. Google Play's data safety section says the app collects no user data and shares none, and the privacy policy linked from the listing says no information "is collected, stored, used or shared". The F-Droid build backs this up in a way a label cannot: its permission list includes notifications, biometrics and background tasks for saving the database, but no network access. An app without internet permission cannot quietly upload anything.

This is the strongest privacy setup in our password-manager group, a little ahead of KeePassXC, which goes online when you ask it to fetch website icons.

How does it protect your passwords?

KeePassDX reads and writes KDBX files, the open format used by KeePass and KeePassXC. The current version, KDBX 4, encrypts the file with AES, Twofish or ChaCha20, and stretches your master password with Argon2, which makes each guess slow and expensive. You can add a key file or a YubiKey, so that a stolen file and a guessed password are still not enough. Biometric quick unlock saves you typing the master password every time, but the master password remains the real key.

The app also blocks taps when another app draws a see-through layer over it, a trick called tapjacking. In January 2026 a user reported that text selected in the app could end up in Android's clipboard history; the developer fixed it within three days by blocking text selection in those views.

What is missing is outside review. The code has been public under the GPL-3.0 licence since 2017, and anyone can check it, but no firm has published an audit. The repository has no security policy and no bug bounty, and reports go through ordinary GitHub issues. The only entry in the US vulnerability database is from 2018: an XML flaw in a beta version's file reader. That is a long quiet record, but it is quiet partly because few people are paid to look. KeePassXC, by contrast, has a 2023 audit and a 2025 French government certification.

Free or libre: which build to pick

KeePassDX comes in two builds with the same features and security. The Google Play "free" build is signed by the developer and adds two things that do not fit strict free-software rules: Steam one-time codes and Google's list of approved browsers for passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary. The "libre" build on F-Droid is compiled and signed by F-Droid from the public source code. Both are also on GitHub, where the README explains how to check that an APK was signed by the developer.

Paying is optional. A donation or the paid KeePassDX Pro app, listed on Google Play as KeePro Support, unlocks extra themes, and the developer says it "does not improve safety". There are no ads.

What you have to manage yourself

Like every KeePass app, KeePassDX leaves sync and backups to you. You open the database through Android's file picker, so the file can live on the phone, on a memory card or in a cloud app such as Nextcloud, Google Drive or Dropbox. The cloud provider only sees the encrypted file. If you lose the file and every backup, nobody can restore it, and if you forget the master password, nobody can reset it.

There is no iPhone version. If you also use an iPhone, Strongbox and KeePassium open the same file, but they are separate apps with their own records.

How to use KeePassDX safely

1. Choose a long master password you use nowhere else, such as five or six random words.
2. Make sure the database uses KDBX 4 with Argon2, the default for new databases.
3. Keep at least two backups of the database file in different places, and test one.
4. If you use a key file, do not store it in the same cloud folder as the database.
5. Turn on autofill in Android settings, so logins are offered only for the matching app or site.
6. Install from Google Play, F-Droid or the developer's GitHub page only, and keep the app updated.

How we scored it

Privacy (95) ties for our highest score among security tools: no data collected, no account and no network permission. Transparency and control (88) is strong because your vault is an open file you own, held back only by sync and backups being your job. Security (79) is the weakest factor, not because of any breach, but because the app has no published audit, no security policy and depends largely on a single maintainer. For a desktop companion with a stronger audit record, see KeePassXC; for a hosted manager that syncs for you, Bitwarden.