K
- Category
- Passwords · Self-host
- Cost
- Free
- Country
- community
- Licensing
- FOSS
- Platforms
- Windows · Linux · macOS
Pros and cons
+ what works
- +Native on Windows, GPLv2 or later, source open since 2003
- +Originated the .kdbx format read by the whole KeePass family: KeePassXC, KeePassDX, Strongbox, KeePassium, KeeWeb
- +Strong crypto (AES-256, ChaCha20, Twofish) with Argon2 KDF, key files, and YubiKey HMAC-SHA1 challenge-response
- +Vast plugin ecosystem covers browser integration, auto-type extensions, cloud sync, and more
− watch out for
- −Linux and macOS run via Mono with documented UI lag, font issues, and occasional crashes
- −Plugins are unsandboxed and run with full app permissions: every install is a trust decision
- −Single-maintainer project (Dominik Reichl ships only the Windows build); other platforms rely on third parties
- −ANSSI CSPN certification was for KeePass 2.10 in 2010 and has long since lapsed: do not read it as current
Privacy notes
KeePass is local-first software with no server, no account, and no cloud sync. The vault is a single encrypted .kdbx file on disk, protected by a master password and optionally a key file or hardware token. The Windows build checks for updates by default; the check is a version lookup and can be disabled via an enforced config file. Dominik Reichl has maintained the project since 2003 as the sole upstream author of the Windows binary, which is a real bus-factor risk to weigh against the long track record.
Tags
#foss · #local-first · #gplv2 · #kdbx · #yubikey · #windows-first
Comments (0)
No comments yet. Be the first.