What are the possible threat models when it comes to saving all credentials (passwords, TOTP and passkeys) into a single .kdbx database? This is assuming that: The master password is very strong. The .kdbx file is never exposed to the internet (always kept offline). Only two devices have access to…

[image] SomeRandomPrivacyUser: I’m not too worry about (1) as I always keep the database offline and share it between iPhone and Linux through USB cable. Off-topic but if these are your only 2 copies I strongly suggest creating a third backup on a flash drive stored somewhere away from your h…

[image] SomeRandomPrivacyUser: Also, what other thread models am I missing here? This one: [image] linux setups with comparable _security_ to macbooks? hear me out... person_raising_handQuestions There are many other relevant topics available on the Qub…

The point of your password manager is to allow you to use all your passwords while remembering one master password. If it’s encrypted (it is) and synced offline via USB then someone mostly needs full access to your device before it’s a problem (getting either both the file and ability to decrypt or …

[image] TheDoc: Off-topic but if these are your only 2 copies I strongly suggest creating a third backup on a flash drive stored somewhere away from your home. Thanks for the heads up, I’ll for sure do that. [image] TheDoc: If instead you stored your passkeys on actual hardware (smartpho…

[image] SomeRandomPrivacyUser: That’s if I store the passkeys on devices separate from my iPhone (like a YubiKey) but if my passkeys are stored in Apple’s password manager on my phone then malware can get the secret, couldn’t it? Passkeys can be stored in a secure element so it should be well…

[image] TheDoc: I believe Apple now defaults to storing passkeys in their password manager to provide better portability but you might still have the option to store it on hardware instead. I just tested trying to save a passkey offline on my iPhone. It forces me to either (a) use another dev…

[image] SomeRandomPrivacyUser: Thanks for the heads up, I’ll for sure do that. Be aware that data on flash drives that aren’t used frequently can degrade. It’s never happened to me but what I’ve read is that data can corrupt and degrade even as early as 2-4 years in if it’s not being powered …

I did not know that, I’ll make sure to keep that in mind. Thanks! EDIT: I also found this article by the KeePassXC team and might also print physical copies on paper just in case. (too risky).

Privacy Guides Community

Threat models for storing passwords, TOTP and passkeys in a single password manager?

Questions

FranklyFlawless May 9, 2026, 11:51am 2

This one:

Topic		Replies	Views
Suggestions for password manager (KeePass) setup Questions	4	422	July 16, 2026
Those of you using hardware security keys (e.g. yubikey) , which accounts (or if that is too personal, how many accounts) do you use them for? Questions	16	1703	December 18, 2023
Storing TOTPs in a Password Manager Questions	1	460	August 24, 2023
Should I use my password manager for storing TOTP codes? Questions	24	7113	January 13, 2024
How to approach passkeys / Should I replace my TOTPs with passkey? Questions	4	865	August 4, 2025

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

Threat models for storing passwords, TOTP and passkeys in a single password manager?

Related topics