PCTools logoPCToolsProof before promises.
KeePassXC icon

KeePassXC

The best free offline password manager: AES-256/ChaCha20-encrypted .kdbx you own, plus Argon2 memory-hardened unlock, autotype hashed against target window titles, browser-extension bridge that opens a local socket. No network calls by default; nothing leaves the machine unless you sync the file yourself.

Category
Security
Licence
Free and open source
Official site
keepassxc.org
Last updated
2026-10-17
Download from official siteAll free apps

What it does

KeePassXC stores passwords in an encrypted local database, generates strong passwords, and fills them into browsers via an extension. The database format is open and portable.

When it helps

When you want your passwords to exist nowhere except on your machines: no cloud account, no subscription, no provider to breach. It is also the natural home for the passwords produced by our Password Generator.

Limitations

Syncing between devices is your problem — you manage the database file yourself (syncthing, an encrypted USB stick, or a private cloud folder). If you lose the database and the key, nothing can recover it. Mobile support exists via KeePassDX (Android) and Strongbox (iOS) rather than a first-party app.

Security and licensing

Open source (GPL), widely audited, no network calls by default. The usual failure mode is a weak master password — use the generator, and consider a key file as a second factor.

Alternatives

Bitwarden when you want managed sync and breach checking (open-source client, hosted service); Password Safe for a lighter classic; the built-in browser or OS managers if you prefer convenience over portability.

Common questions

How do I sync KeePass between devices?

KeePassXC stores everything in a single .kdbx file. Sync that file yourself: put it in a Syncthing, Nextcloud, or private OneDrive/Dropbox folder, or copy it via an encrypted USB stick. KeePassXC itself makes no network calls — sync is entirely your choice of file transport.

Which is better, KeePassXC or Bitwarden?

In a KeePassXC vs Bitwarden comparison, KeePassXC wins on control: the database never leaves your machines unless you sync it yourself, and you manage backups. Bitwarden wins on convenience: the vault syncs automatically through their servers (end-to-end encrypted), which means trusting a third party with your ciphertext and uptime. Control-first users pick KeePassXC; convenience-first users pick Bitwarden.

How do I import passwords from my browser into KeePassXC?

Export from the browser (Chrome/Firefox: Password Manager → Export → CSV), then in KeePassXC use Database → Import → CSV. Delete the CSV file immediately after import — it is plaintext. Then enable the browser extension so new logins are saved to KeePassXC going forward.

How do I set up the KeePassXC browser extension?

Install KeePassXC-Browser from your browser's store, open KeePassXC, go to Tools → Settings → Browser Integration, and enable your browser. Click the extension icon → Connect. The extension talks to the local app only; it does not use a cloud service.

Is KeePassXC safe? What if I forget my master password?

The database is encrypted with AES-256 or ChaCha20; without the master password (and key file, if you use one) nobody — including us — can read it, and nothing can recover it. That is the trade-off of offline storage: write the master password down and store it where you would store a passport, or use a passphrase you can reconstruct.

Related reading

← All recommendations