KeePassXC

Is KeePassXC safe?

Yes. KeePassXC is one of the safest password managers you can use, as long as you are willing to look after one file. Your passwords sit in an encrypted database on your own computer, nothing is sent to the developers, and there is no account or server that could be breached. An independent review in 2023 found no major problems, and in November 2025 France's national cybersecurity agency, ANSSI, gave it a security certification. We score it 89/100, level with Proton Pass (89) and just ahead of Bitwarden (88).

The trade-off is convenience. KeePassXC runs only on Windows, macOS and Linux, it has no built-in sync, and on a phone you need someone else's app.

How does KeePassXC protect your passwords?

Everything lives in one file in the KDBX format, which the original KeePass also uses. KeePassXC's FAQ says the file is encrypted with AES-256 or Twofish, and that your master password is put through a configurable number of key transformations to slow down guessing. You can add a key file or a YubiKey, which answers a challenge from KeePassXC to strengthen the key. Without the password, and the key file or YubiKey if you set one, the file is just noise.

Because there is no KeePassXC server, the kind of breach that hit LastPass in 2022, when attackers copied encrypted vault backups, would need someone to steal your own file. That is why the strength of your master password matters more here than anything else.

Who has checked the code?

More people than for most free apps. The code has been public under the GPL-3.0 licence since 2016. In January 2023 Zaur Molotnikov, an independent consultant who worked for free, finished a review of version 2.7.4. He wrote that KeePassXC "provides sufficient cryptographic protection" with a strong password and the latest file format, and that he "could discover no major problems". His one caution was that memory could be cleared better after the database is locked.

On 17 November 2025 ANSSI awarded version 2.7.9 for Windows 10 a first-level security certification (CSPN, report ANSSI-CSPN-2025/16), valid until November 2028. Germany's BSI also recognises it. A certification covers one version on one system, so it is a signal, not a guarantee for later releases.

Flaws still turn up. In March 2026 version 2.7.12 fixed CVE-2026-4158, a medium-rated issue that let a malicious OpenSSL configuration file load code on Windows. KeePassXC 2.8.0, released on 21 October 2026, fixed five more, rated low to medium, in old-format imports, the browser link and SSH key sharing on Windows; NATO's cyber security centre found two of them. The team says none touched its core functions or cryptography. Researchers report bugs through GitHub, Matrix or email. There is no paid bug bounty.

What does KeePassXC know about you?

Nothing it can send anywhere. The privacy policy says stored data is never sent to the team or a third party, "Period." The desktop app only connects to the internet when you ask, for example to download a website's icon for an entry, and the FAQ says you can even build it without any networking code. The browser extension checks GitHub for new versions, which you can switch off. The team's website uses a self-hosted analytics tool with shortened IP addresses, but that covers visits to keepassxc.org, not the app.

The catches: phones and sync

KeePassXC has no mobile app. Its team points Android users to KeePassDX or KeePass2Android and iPhone users to Strongbox or KeePassium, all made by other developers, with their own code and records. You also have to move the database between devices yourself, usually by keeping it in a cloud folder such as Dropbox, Google Drive or Nextcloud. That is safe because the provider sees only the encrypted file, but two devices editing at once can cause conflicts, and nobody can restore your vault if you lose the file and every backup.

KeePassXC's November 2025 post on AI drew attention too. The maintainers said they use Copilot to draft small fixes and as an extra reviewer, that every change is still reviewed by a human maintainer, and that the app itself has no AI features.

How to use KeePassXC safely

1. Pick a long master password you have never used elsewhere, such as five or six random words.
2. Keep backups of the database in at least two places, and test that one opens.
3. If you use a key file, never store it in the same cloud folder as the database.
4. Install the browser extension and let it fill passwords, so a look-alike phishing page gets nothing.
5. Keep two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary codes in a separate app such as Aegis, as KeePassXC's own FAQ suggests.
6. Update to 2.8.0 or later to get the 2026 fixes.

How we scored it

Privacy (94) is near the top of our scale: no account, no telemetry and no data sent to the team. Security (85) rests on strong encryption, a 2023 audit and the 2025 ANSSI certification, held back by six low- or medium-rated flaws fixed in 2026 and no paid bounty. Transparency and control (89) loses a little because sync and mobile access depend on you and on other developers' apps. For a hosted manager with apps everywhere, Bitwarden is the closest alternative.