KeePassXC — Cross-Platform Offline Password Manager

What it is

KeePassXC is a free, open-source, cross-platform password manager that stores all credentials in an encrypted local database (KDBX format). There is no cloud sync, no subscription, and no telemetry. You own your password file and decide how to sync it.

KeePassXC targets security-conscious users and developers who prefer full control over their credentials. It supports auto-type, browser integration, TOTP, SSH agent integration, and YubiKey/OnlyKey hardware keys.

How it saves time or tokens

KeePassXC's browser extension auto-fills credentials on web pages. The auto-type feature works with any application by simulating keyboard input. SSH agent integration loads SSH keys from KeePassXC on unlock, eliminating separate key management.

For developers, the CLI tool (keepassxc-cli) enables scripted access to credentials in CI/CD pipelines and automation scripts.

How to use

1. Install KeePassXC:

# macOS
brew install --cask keepassxc

# Linux
sudo apt install keepassxc
# Or: flatpak install org.keepassxc.KeePassXC

1. Create a new database and set a master password.

1. Add entries for your credentials. Enable browser integration in settings.

Example

# KeePassXC CLI for automation
# List entries
keepassxc-cli ls ~/passwords.kdbx

# Show a specific entry
keepassxc-cli show ~/passwords.kdbx 'Internet/GitHub'

# Extract just the password (for scripts)
keepassxc-cli show -s -a Password ~/passwords.kdbx 'Servers/prod-db'

# Generate a password
keepassxc-cli generate -L 32 -l -U -n -s
# Output: kX9#mP2$wR7&nQ4!jT6^hY3@fB8*cL5

SSH agent integration:

# In KeePassXC settings:
# 1. Enable SSH Agent integration
# 2. Attach SSH key files to entries
# 3. On database unlock, keys are loaded into ssh-agent

Related on TokRepo

• AI Tools for Security -- Security tools and credential management
• AI Tools for Self-Hosted -- Self-hosted privacy tools

Common pitfalls

• KeePassXC does not sync your database file. Use a file sync tool (Syncthing, Nextcloud, or cloud storage) to sync the .kdbx file across devices.
• The browser extension requires the KeePassXC application to be running and unlocked. Without it, auto-fill does not work.
• KDBX format is different from 1Password or Bitwarden exports. Import tools exist but test the import before deleting your old password manager.