KeePass

We all know about the existence of KeePass and talk about it. But I was surprised to see that it isn’t mentioned in the recommendations as password manager. Only some forks are listed (KeePassX, KeePassDX).

Although KeePass is mentioned in the Guides about MFA.

Why isn’t KeePass listed?

KeePassXC is mentioned, not KeePassX. But I think that the reason why KeePass isn’t mentioned is probably because most people prefer XC over the basic KeePass. It’s just a better client overall.

The other thing is that KeepassXC is in the Microsoft Store on Windows:

Which is a requirement of Windows S mode:

Latest version 2.53.1 of Keepass and possibly its fork are affected. Keepass 1.0, KeepassXC, and StrongBox do not appear to be impacted.

Another reason not to use KeePass:
This CVE from January 2023

So an attacker with write access to the KeePass XML configuration file, can trigger a cleartext password export on startup. And the lead developer refuses to fix it.

https://securityboulevard.com/2023/01/keepass-password-manager-leak-cve-richixbw/

That is probably the most useless piece of information I’ve read this week. Why would anyone want to install it from there?

PrivacyGuides aims to give people of all computer knowledge, the keys to better behave online and protect their privacy.
It’s useful for them to not only, get as many people enrolled, but also, for covering as many people which, as pointed out, could be stuck with a Windows 10/11 S operating system which restricts software from the Microsoft Store.

I’m not sure about what is the original but looking at his own personal website

he redirects to the Keepass official one

which is the v2 of Keepass with all the available clients

all the download there are quite good quality

but KeePassXC is the fully FOSS, most cross-platform compatible and probably the most secure solution of all

hence the best (and de-facto) PrivacyGuides’ recommendation[1] :+1:


If you want to decide on your own, you can always pick any other one that you deem good but PG just made that choice for you so that you can just pick the go-to without wondering too much about which one to pick. :slight_smile:

As for exactly why this one. I feel like he passed the flag to other folks in the FOSS community based on his current (non-)activity on Github

And that’s very much fine, you don’t need to be the maintainer of a thing for 20 years, you can just choose some nice healthy successor(s) to continue the project, which his own website subjects quite well too. :+1:


  1. as a reminder, PG rightfully chooses to have 1 nice pick rather than 3/4/5 good-enough ones because it is better to just have the best rather than decent as a bar to reach ↩︎

I’m not sure about what is the original but looking at his own personal website

My understanding is that KeePass is the original having commenced in 2003 ?

Probably yes. Not sure it does matter a lot tho.
The software could probably have been improved as most things in security realm and needs to be constantly patched, hence the v2 was released.
Then daily/weekly maintenance to align with the latest breaches/attack vectors was needed, hence why it’s safer to use the current v2 from keepass.info

Overall, using old-software is never the right call because of security reasons.
“Good old” only applies to hardware/appliances not software. :smiley:

I assume your idea was maybe to use the old v1? :thinking:
Hence why I directed my answer towards recommending not going that way.

But maybe I misunderstood the question/intention here?
Overall, there is no point listing the old maintainers/software versions because things move on and the legacy is usually not that important.
Most people also do not care the 12 maintainers and the lore/drama/fights around a project/tool before using it, they mostly want 1 job done well.

Moreover, KeePassXC just has an amazing website, they are super intense about security and transparent while keeping their tool up to date as shown in this thread

So definitely a good recommendation to me. :hugs:

KeePass is a .NET app, it works on platforms other than Windows but it doesn’t have a native looking UI or integrations. KeePassXC is a C++ Qt app with full native support for Linux and macOS.

That’s really the only significant difference, even according to KeePassXC themselves.

KeePass is a very proven and feature-rich password manager and there is nothing fundamentally wrong with it. However, it is written in C# and therefore requires Microsoft’s .NET platform. On systems other than Windows, you can run KeePass using the Mono runtime libraries, but you won’t get the native look and feel which you are used to.

KeePassXC, on the other hand, is developed in C++ and runs natively on Linux, macOS and Windows giving you the best-possible platform integration.

I’d say the main difference is that the original KeePass supports 3rd party plugins which can greatly enhance its functionality (and obviously introduce more risk in terms of security). KeePassXC has no plugin system, so you cannot add any functionality to it (unless you code it and build your own version of the whole application yourself).

I personally use KeePass over KeePassXC because the latter has some accessibility issues, e.g. hard-coded animations that cannot be disabled, and problems with high contrast OS themes. I reported the first issue 5 years ago, but it’s still open as of today, and the theme-related issues were found to be caused by Qt.