SoftNexi

Windows · Privacy & Encryption

KeePassXC for Windows

Open-source, offline password manager that stores credentials in a local encrypted KDBX database with no cloud account.

Updated July 22, 2026 · Reviewed by SoftNexi Safety Desk, Download sourcing and safety review

Download

Overview

KeePassXC is a community-maintained password manager that keeps your vault as a single encrypted file on your own disk. There is no vendor account, no subscription, and no server that could be breached on your behalf.

That design is also its main trade-off: syncing between devices is your responsibility. Most people put the KDBX file in a cloud folder, which works because the file is encrypted before it ever leaves the machine.

It supports hardware keys as a second factor, browser integration through an official extension, TOTP codes, and password auditing against known-weak entries.

Key features

  • Local KDBX 4 database with AES-256 or ChaCha20 encryption
  • Argon2 key derivation to resist brute-force attacks
  • Browser integration via the official KeePassXC-Browser extension
  • Built-in TOTP generator for two-factor codes
  • Hardware key support as an additional factor
  • Password health report for weak and reused entries
  • CSV and 1Password/Bitwarden import paths

System requirements

Operating system
Windows 11, Windows 10, and current macOS releases
Architecture
x64 on Windows; universal or architecture-specific DMG on macOS
Disk space
Around 100 MB installed
Optional hardware
YubiKey or OnlyKey for challenge-response second factor

How to install KeePassXC

  1. 1. Download for your platform

    Use keepassxc.org/download and pick the Windows MSI or macOS DMG.

  2. 2. Install

    Run the installer; on macOS drag the app into Applications.

  3. 3. Create your database

    Choose a long passphrase, keep the default Argon2id settings, and save the KDBX file somewhere you back up.

  4. 4. Add browser integration

    Install the official KeePassXC-Browser extension and enable browser integration in the app's settings.

How to use it

  1. 1. Add an entry

    Use the generator to create a long random password instead of typing one, and store the site URL so autofill can match it.

  2. 2. Set up TOTP

    Right-click an entry, choose TOTP > Set up, and paste the secret from the service's 2FA screen.

  3. 3. Audit your vault

    Open the health report to find reused, short, or expired passwords and fix them one at a time.

  4. 4. Back it up

    Copy the KDBX file to a second location on a schedule. The file is encrypted, so cloud storage is acceptable.

Safety and privacy

  • Downloads and signatures are published on keepassxc.org; the project also publishes checksums and GPG signatures you can verify yourself.
  • Source code is public and the project documents its cryptographic choices.
Bundled software
None.
Privacy
No account, no telemetry, no server-side component. Your database never leaves your device unless you sync it yourself.

Known risks

  • If you lose the master password or key file, the database cannot be recovered — there is no vendor reset.
  • Syncing the same KDBX file from two devices at once can create conflicted copies.

What's new

  • 2.7.x series

    The 2.7 line added passkey support work, interface refinements, and continued Argon2id and browser integration improvements. Full change logs are published on the project's releases page.

Pros and cons

Pros

  • No cloud account or subscription
  • Open source with documented cryptography
  • Hardware key and TOTP support
  • Cross-platform with a shared database format

Cons

  • You manage sync and backups yourself
  • No account recovery if the master password is lost
  • Mobile use requires a separate compatible app
  • Setup takes longer than a hosted manager

Verdict

KeePassXC is the strongest choice if you want your credentials to stay on hardware you control. Accept that sync and backup are your job, and it is hard to beat.

Frequently asked questions

Is KeePassXC the same as KeePass?

No. KeePassXC is an independent cross-platform application that uses the same KDBX database format as the original Windows KeePass.

Is storing my vault in a cloud folder safe?

The KDBX file is encrypted locally before syncing, so the main requirement is a strong master passphrase and a current KDBX 4 database.