Most password managers ask you to trust a company with your vault. KeePassXC takes the opposite position, storing everything in one encrypted file on your own disk with no account to create and no server keeping a copy. It runs natively on Windows, macOS, and Linux, and it costs nothing. Whether that trade suits you depends less on the software than on how much plumbing you are willing to run yourself, so it pays to understand what you take on before you download it.
How KeePassXC keeps your passwords in a file you own outright
The database is a KDBX file encrypted with AES-256, Twofish, or ChaCha20, unlocked by a master password and, if you want, a key file or a hardware key on top. Nothing moves anywhere unless you move it. That single design decision explains both the appeal and the friction: there is no vendor account to be breached, no subscription to lapse, and equally no reset link when the master password slips your mind. Lose it and the database is finished. Recent releases have been steady rather than dramatic, bringing importers for other managers, better passkey handling, and a fix for a Windows attack path that abused a configuration file. KeePassXC also carries a CSPN Security Visa from ANSSI, the French national cybersecurity agency, on top of an independent audit of the codebase, and that pairing is rare for a volunteer-built project.
What does KeePassXC actually give you beyond a place to store logins?
The database, the master key, and hardware key options
Entries hold usernames, passwords, URLs, notes, and file attachments, sorted into groups with custom icons and searchable with pattern matching. Protection stacks in layers: a master password, an optional key file full of random bytes, and challenge-response with a YubiKey, OnlyKey, or Nitrokey. The hardware key path deserves a warning before you commit to it, because KeePassXC implements challenge-response differently from the KeeChallenge plugin on KeePass. A database secured with a YubiKey in one will not open in the other.
Auto-Type and browser filling
Auto-Type is the feature people stay for. It types your credentials into any desktop application using simulated keystrokes, which covers software that no browser extension can reach. On Linux this only works in an X11 session, not under Wayland, and that limitation appears nowhere on the feature listing while quietly affecting anyone running a modern default desktop. Browser filling is separate work, handled by the KeePassXC-Browser extension for Firefox, Chrome, Chromium, Edge, Vivaldi, Brave, and Tor Browser. Pairing them means switching on Browser Integration under Tools, then Settings, for each browser you use, installing the extension there, and clicking Connect with the database unlocked so the two can trade a named key.
One-time codes, passkeys, and SSH keys
KeePassXC stores TOTP secrets and generates the six-digit codes itself, which is convenient and a genuine security tradeoff: keeping a password and its second factor in the same file weakens the point of two-factor login. A second database with a different master password is the usual answer. Passkeys are supported too. The SSH agent integration earns its keep for developers: it loads keys into a running agent when the database unlocks and removes them when it locks, so private keys stay encrypted rather than sitting in a folder.
Moving in from KeePass and other managers
KeePassXC reads and writes the KDBX format used by KeePass, so an existing database opens without conversion, and older KeePass files import into the current format. Importers also cover CSV files and exports from several commercial managers. There is deliberately no plugin system, and the team argues the case openly: abandoned plugins with unpatched flaws are a poor fit for the one application holding every credential you own. In practice that is the real difference from KeePass for anyone who relied on a niche extension.
KeePassXC compared with Bitwarden, 1Password, and Proton Pass
All three rivals solve the problem KeePassXC leaves to you, and they charge for it in different currencies. Bitwarden is the closest match philosophically: open source, a free tier covering unlimited logins on unlimited devices, and the option to run the server yourself. Its catch is that built-in code generation and hardware security key support sit behind a paid plan, both of which KeePassXC gives away. 1Password is the polished one, with the smoothest apps and the best family handling, but it is closed source, subscription only, and its Secret Key model puts your data on its servers by design. Proton Pass leans on Swiss jurisdiction and encrypted metadata, with a free tier and email aliasing the others do not match, though vault sharing is paid.
| Feature | KeePassXC | Bitwarden | 1Password | Proton Pass |
|---|---|---|---|---|
| Where the vault lives | Encrypted file on your own disk | Bitwarden servers or your own | 1Password servers | Proton servers |
| Account required | No | Yes | Yes | Yes |
| Licensing | Free, open source | Free tier plus paid plans | Paid subscription only | Free tier plus paid plans |
| Desktop platforms | Windows, macOS, Linux | Windows, macOS, Linux | Windows, macOS, Linux | Windows, macOS, Linux |
| Mobile apps from the maker | None | Android and iOS | Android and iOS | Android and iOS |
| Sync between devices | You arrange it yourself | Automatic | Automatic | Automatic |
| Run your own server | No server exists | Supported | No | No |
| Browser autofill | Extension plus helper process | Extension | Extension | Extension |
| Built-in one-time codes | Yes | Paid plan | Yes | Yes |
| Passkey storage | Yes | Yes | Yes | Yes |
| Hardware security key | Yes, strengthens the database key | Paid plan | Yes | Yes |
| Sharing with other people | Not built in | Yes | Yes | Paid plan |
| Source code open to inspect | Yes | Yes | No | Yes |
Pick KeePassXC when local control is the requirement and you already keep backups. Pick Bitwarden when you want most of that openness with sync handled for you. Pick 1Password when someone else in the household will use it and polish matters more than principle, and Proton Pass when aliasing and Swiss hosting are the draw.
Unlock speed and the key derivation tradeoff
Written in C++ and running natively, KeePassXC needs no separate runtime, which is the practical gap against KeePass on macOS and Linux where that runtime sits as an extra layer. Unlock time is the one cost you control directly: the key derivation settings, Argon2 by default, deliberately spend processing effort to slow anyone attacking your file offline. Raise those settings and every unlock takes longer on older hardware, which is the protection doing its job rather than a fault. Past the unlock, everything is local file access with no server round trip in the way.
KeePassXC is the right download for people who keep their own backups
If you want your credentials in a file you control, already run backups you trust, and do not mind picking a companion app for your phone, KeePassXC is the strongest free option in this category and worth the download. Anyone who expects passwords to appear on a new device automatically should look at a synced password manager instead, because there is no account here to sign into and nothing to recover if the master password is lost. For everyone in between, the certification and the open codebase make it an easy tool to trust, provided you accept the work it hands back to you.
