Skip to content
THREATWIRE

KeePassXC

Offline, cross-platform password manager

Community port of KeePass for Windows, macOS and Linux that stores passwords in an encrypted KDBX database file you control.

Open sourceGPL-2.0-only OR GPL-3.0-only
Alternative to1Password
Visit website View repository Docs
Homepage of KeePassXC
Official website (keepassxc.org), captured by ThreatWire.

What KeePassXC does

KeePassXC keeps credentials in a local, encrypted database in the KeePass KDBX format. It offers auto-type, a browser extension, TOTP codes, SSH agent integration, YubiKey challenge-response and passkey support, without any cloud service of its own.

Because the database is a file, users can sync it with their own storage. The project is community-developed and has been independently audited.

Key features

  • Encrypted KDBX 4 database
  • Browser integration and auto-type
  • TOTP, passkeys and SSH agent
  • YubiKey and hardware key support
  • Password health reports

Licence

GPL-2.0-only OR GPL-3.0-only · GNU GPL v2 or v3 · Open source

GitHub does not detect the licence; COPYING grants GPL version 2 or (at your option) version 3.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.

Security of KeePassXC itself

6 published advisories for KeePassXC in GitHub repository advisories. Keep the tool updated: security tools often run with broad access.

  • GHSA-rq29-wgrv-xgh4low2026-09-23

    Heap ouf-of-bounds via integer overflow in legacy .kdb import

  • GHSA-mffq-j98j-wfr2low2026-09-23

    Pageant SSH agent key sharing uses predictable shared memory name

  • GHSA-3448-gh8j-3227medium2026-09-23

    Out-of-bounds write in browser integration response encryption with oversized database responses

  • GHSA-2vm2-vmc3-vccrmedium2026-09-23

    Browser extension allows creating references to other entries enabling limited data exfiltration

  • GHSA-4642-49vv-4p43CVE-2026-69150medium2026-09-23

    Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map

  • GHSA-4gr2-cr97-q9fxCVE-2026-4158medium2026-03-09

    ZDI-CAN-29156: OpenSSL config exploitation

Sources: GitHub repository advisories · checked 2026-10-20.

Categories and tags

Passwords and credential auditingIdentity, access and secrets management#password-manager#desktop#offline#kdbx#keepassxc#keepass#linux#windows#cross-platform

Related tools

  • hashcat

    GPU-accelerated password recovery

    Password recovery and hash auditing tool that uses GPUs and CPUs to test passwords against hundreds of hash types.

    Stars
    27k
    Forks
    3.6k
    Last commit
    today
    MITOpen sourcePasswords and credential auditingDual-use

  • John the Ripper

    Offline password security auditing

    Openwall's long-standing password cracker; the community "jumbo" version supports hundreds of hash and cipher types on CPUs and GPUs.

    Stars
    14k
    Forks
    2.6k
    Last commit
    8 days ago
    GPL-2.0-or-laterOpen sourcePasswords and credential auditingDual-use

  • Keycloak

    Identity and access management for apps and services

    Identity provider with single sign-on, OpenID Connect, OAuth 2.0 and SAML, user federation, MFA and fine-grained authorisation. A CNCF project.

    Stars
    37k
    Forks
    9.1k
    Last commit
    today
    Apache-2.0Open sourceIdentity, access and secrets management
    Alternative toOktaAuth0

  • HashiCorp Vault

    Secrets management and encryption as a service

    Secrets manager that stores and issues credentials, certificates and keys, with dynamic secrets, encryption as a service and detailed audit logs.

    Stars
    36k
    Forks
    4.8k
    Last commit
    today
    BUSL-1.1Source-availableIdentity, access and secrets management

  • Infisical

    Secrets, certificates and access management platform

    Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.

    Stars
    30k
    Forks
    2.4k
    Last commit
    today
    MITOpen sourceIdentity, access and secrets management
    Alternative toHashiCorp Vault
Share on X@threatwire_https://www.threatwire.tech/tools/keepassxc