This is the second-highest-value thing on this site after a security key, and the two work together: the key stops someone logging in as you, and the manager stops one breached site turning into all of them. Do both and the ordinary route into your life is closed.
01Why an offline one
Most password managers store your vault on the company's servers. That is a genuine convenience and it is not automatically wrong, the good ones encrypt it so they cannot read it. But it creates a single, permanent, well-known target: a database of millions of vaults, sitting in one place, run by a company that can be breached, bought, subpoenaed, or simply make a mistake. This has happened, more than once, to large providers.
KeePassXC keeps the database as a file on your own disk. There is no company, no account, no server, and nothing to breach at scale. If someone wants your passwords they have to come for you specifically, which is a completely different proposition from harvesting everyone at once.
- No third party holds your vault, so no third party can lose it, be compelled over it, or change its terms.
- It works offline, including on a machine that has never touched the internet.
- Open source and audited, with an open file format that many independent programs can read, you are not locked in.
- Free forever, with no tier that withholds a security feature until you pay.
- Backups are your job. Lose the file with no copy and the passwords are gone. There is no support desk.
- Syncing between devices is your job, and it is the part most people get wrong. See section 05.
- Mobile is a separate app by a different developer, not an official one.
- Nobody can reset your master password. That is the point, and it is also the risk.
If offline sounds like more responsibility than you want, use Bitwarden or Proton Pass instead and move on with your life. The catastrophic option is the one you are using now, the same password in fifty places. Do not let the search for the perfect tool leave you on the worst one.
02The master password, which is the whole thing
Everything rests on one passphrase. If it is weak, nothing else in this guide matters; if it is strong, an attacker with your database file still has nothing.
Four to six random words — not a phrase you composed, which is far less random than it
feels. Something like harbour-plum-ditch-tractor-vine. It is long, genuinely
random, and you can actually memorise it, which a string of symbols never is. Let KeePassXC
generate it for you using its passphrase mode, then write it down on paper until it is in your
head, and destroy the paper afterwards.
The master passphrase should exist in exactly two places: your memory, and, if you need one, a sealed physical backup somewhere safe. Never in a file, never in a note app, never in a message to yourself, and never in this or any other document.
03Setting it up
-
Install it from the official source
Download from keepassxc.org, or on Linux from your distribution's repository or Flatpak. Type the address by hand — password-manager lookalike domains are a well-worn attack, for obvious reasons.
-
Create the database
Database → New Database. Give it a name that is not "passwords". You will be asked about encryption settings, the defaults are good, and the decryption-time slider is worth understanding: a higher value makes every guess an attacker tries slower. One second on your own machine is a reasonable setting and a serious obstacle to brute force.
-
Set the master passphrase
Use the generator, in passphrase mode, as described above. Take the time to memorise it before you fill the database with anything, because this is the one moment where starting over is free.
-
Decide on a key file — carefully
KeePassXC can require a second file alongside your passphrase. It increases security: someone who obtains the database and guesses the passphrase still cannot open it. It also doubles the number of things you can lose, and the key file must not live in the same folder as the database, or it protects against nothing. Skip it unless you have somewhere sensible to keep it, such as a USB stick you keep separately.
-
Save it somewhere you will actually back up
Not the desktop. A documents folder that is included in whatever backup you already run.
04Using it day to day
Let it generate everything
The point of a manager is not storing the passwords you have, it is that you never invent one again. For each new account, click the dice icon and take whatever it produces. You will never see it, never type it and never need to remember it, so length is free: use 20+ characters wherever the site allows.
Work through your existing accounts gradually, most important first — email, then anything with money, then anything you publish from. There is no need to do all two hundred in one evening; doing the top ten this week is most of the benefit.
The browser extension
KeePassXC-Browser fills passwords into pages for you. Install it from your browser's official add-on store and connect it to the desktop app, which will ask you to approve the link.
The extension only offers a password on the domain it was saved for. On a lookalike phishing domain, it stays silent, and that silence is a warning you should learn to notice. If the manager does not offer to fill, stop and check the address bar rather than typing it manually.
Two-factor codes
KeePassXC can store TOTP secrets and generate the six-digit codes itself. This is convenient and involves a real trade-off: your password and your second factor now live in the same file, so a single compromise gets both. For most accounts the convenience wins. For your most important accounts, use a security key instead, which is stronger than either.
What else to keep in there
The database is an encrypted container, so it is a sensible home for more than passwords: recovery codes from every account, software licence keys, the answers to "security questions" (which should be random strings, not true answers), and the occasional scanned document. Each entry has a notes field and can carry file attachments.
05Syncing and backups, where people go wrong
You have one file. You want it on your laptop and your phone. There is no server doing this for you, so you have to choose a method, and the choice matters.
| Method | Verdict | Notes |
|---|---|---|
| Ordinary cloud storage (Drive, Dropbox, Proton) | Fine | The file is already encrypted, so the provider stores an opaque blob. This is the common setup and it is reasonable. Your master passphrase is doing all the work, make it a good one. |
| Syncthing | Best | Device-to-device, no third party involved at all. More setup, and the most consistent with the reason you chose an offline manager. |
| Emailing it to yourself | No | It lands in a mailbox, permanently, in several copies, on servers you do not control. |
| Two devices editing at once | Careful | The actual hazard. Two copies changed before a sync produces a conflict file, and the wrong resolution silently loses new entries. Close the database on one device before working on the other. |
Sync is not backup. A sync faithfully copies a deletion or a corruption to every device you own. Keep a periodic copy somewhere that does not sync, an external drive, a USB stick in a drawer, and check once in a while that it still opens. KeePassXC can also keep automatic backups of the previous version each time you save; turn that on in the settings.
06Pairing it with a YubiKey
This is the combination that makes both tools substantially stronger, and it is one of the least known features of either. KeePassXC can require a hardware challenge-response from a YubiKey in addition to your passphrase. Without the physical key present, the correct passphrase alone will not open the database.
-
Configure a slot on the key
Using the YubiKey Manager, set one of the two slots to HMAC-SHA1 challenge-response. Do this on both of your keys, with the same secret, or your backup key will not open your database, which is a very bad afternoon.
-
Add it to the database
Database → Database Security → Change Key File / Challenge-Response, and select the key. Save.
-
Test the backup key immediately
Close the database, unplug the first key, and open it with the second. If that does not work, fix it now, while you still have a working key in the machine.
Your database now cannot be opened without hardware. That is the security benefit and the operational risk in the same sentence. It also complicates mobile use, since the phone app must support the same challenge-response over NFC. Worth it if the database protects work that puts people at risk; probably more friction than value if it does not.
07What it does not protect you from
- Password reuse, and therefore one breached site becoming all of them.
- Weak passwords, permanently, because you stop inventing them.
- Phishing, partially, the extension's refusal to fill is a real signal.
- Losing access to accounts you set up years ago and forgot.
- Malware on your computer. A keylogger captures the master passphrase as you type it, and then it has everything. The manager assumes the machine is not already owned.
- A weak master passphrase. The entire design reduces to this one secret.
- Being compelled to open it.
- A breach at the site itself, a unique password limits the damage, it does not prevent the breach.
- An unlocked, unattended screen. Set the database to lock after a few minutes of inactivity and when the screen locks.
08Questions people actually ask
What if I forget the master passphrase?
The data is gone. There is no reset, no recovery, no support line, this is the direct consequence of nobody else holding your vault. In the first weeks, keep a written copy somewhere physically secure until you are certain you have memorised it. Plenty of people keep a sealed copy permanently, with someone they trust or in a safe; that is a reasonable trade rather than a failure of nerve.
Is it safe to put the file in Google Drive or Dropbox?
Yes, with the caveat that it makes your master passphrase the only thing standing between that provider's storage and your entire digital life. The file is strongly encrypted and the provider sees noise. If you are comfortable with that, it is the simplest sync there is. If you are not, use Syncthing.
What about my phone?
KeePassDX on Android and Strongbox on iOS both read the same file format and are well regarded. Neither is made by the KeePassXC team, so check them yourself before trusting them. Point the app at the same synced file and it behaves as you would expect.
Should I move away from my browser's built-in password manager?
Yes, eventually, but do not let the migration stop you using one at all. Browser managers are tied to the browser account, are often unlocked whenever the browser is, and are a routine target for information-stealing malware. Export from the browser, import into KeePassXC, then delete the export file securely, it is a plain-text list of every password you own, and a surprising number of them are still sitting in downloads folders.
How is this different from KeePass, KeePassX, KeeWeb?
They share a file format and a family tree. KeePassXC is the actively maintained cross-platform one with a modern interface and the browser extension, which is why it is the recommendation here. Your database will open in the others if you ever want to move.
09Sources and further reading
- KeePassXC — official site and downloads keepassxc.org
- KeePassXC user guide, the full manual keepassxc.org/docs
- Syncthing — device-to-device sync with no third party syncthing.net
- Have I Been Pwned, check which of your accounts are already in a breach haveibeenpwned.com
- Privacy Guides — password managers compared privacyguides.org
Last reviewed: 25 September 2026