KeePassXC review 2026: the free offline password manager

KeePassXC is the password manager for people who want to own their data. It is free, open source and stores everything in a local encrypted file, with no account, no subscription and no company in the middle. It is also more work than a hosted service. This review is an editorial assessment based on project documentation, the published audit and release notes as of October 2026, not a laboratory test.

Quick verdict

Criterion	Assessment
Encryption	KDBX 4 database; AES-256, ChaCha20 or Twofish; Argon2 key derivation
Independent audits	Independent audit of 2.7.4 (January 2023); ANSSI CSPN for 2.7.9 (per project)
Passkeys	Supported since 2.7.7
Server location	None: the file lives where you put it
Recovery	None from a vendor; backups and key file are your job
Export	CSV, XML and HTML; importers for other managers
Platforms	Windows, macOS, Linux; mobile via compatible third-party apps
Price	Free

Security

KeePassXC stores your vault in the KDBX 4 format. You choose the cipher (AES-256, ChaCha20 or Twofish), and the key is derived with Argon2, a memory-hard function that resists GPU cracking. You can protect the database with a master password, a key file, a hardware key using challenge-response, or a combination. Because there is no server, there is nothing for an attacker to breach centrally, and nobody can hand over your vault on request.

On independent review, the project published a report by an independent security consultant who examined version 2.7.4 and finished in January 2023. The scope was reading and writing the database and the cryptographic implementation. The consultant found no major problems, judged the code quality good and recommended the core functionality, with a minor suggestion on clearing secrets from memory after locking. The project also reports that version 2.7.9 earned the first-level security certification (CSPN) of ANSSI, the French national cybersecurity agency. Neither result is a guarantee, because audits cover a snapshot of the code.

You can add a hardware key to the unlock process. Our guide to hardware security keys explains how such keys work in general, and our password manager guide covers the basics of choosing a master password.

Features

• Passwords, notes and attachments. Entries with custom fields, groups, tags and file attachments.
• TOTP. Built-in one-time code generation. Keeping codes in the same vault as passwords weakens the second factor, so weigh that choice. See TOTP codes explained.
• Passkeys. Create and use passkeys through the browser extension. Read passkeys explained for what they replace.
• Browser integration. An official extension for the major browsers, and Auto-Type for desktop apps.
• Importers. Imports from other managers, including a Proton Pass importer added in 2.7.10.
• Roadmap. A 2.8.0 beta based on Qt 6 appeared in September 2026 with features such as Auto-Type on Wayland and remote database sync. Treat betas with care and keep backups.

What it does not offer: official mobile apps, a hosted sync service, built-in family sharing or emergency access. Third-party apps that read KDBX files exist for Android and iOS, but they are separate projects, and you should check their maintenance status before you rely on one.

Pricing

KeePassXC is free software under an open source licence, with no paid tier. The project accepts donations. Your only costs are the storage and sync tools you choose, which can also be free.

Privacy and data location

There is no vendor server, so location is a non-issue: the database sits on your devices and any storage you pick. That is the strongest possible answer to the data residency question, but it also means you are responsible for backups. Keep at least one offline copy of the database file, and store the master password and any key file separately from it. Our guide to backup codes shows how to handle such recovery material safely.

Sync is the practical challenge. The file can be corrupted or duplicated if two devices edit it at once, so use a sync method with conflict handling and avoid editing on two devices at the same time.

Who KeePassXC suits

KeePassXC suits people who like owning their data, who already manage files and backups, and who want to pay nothing. It is popular with technical users, privacy advocates and anyone who dislikes handing a vault to a company. It is a weaker fit for non-technical family members, who may struggle with file syncing and conflicts, and for people who want automatic breach alerts, built-in sharing and a polished mobile experience. A common compromise is to use KeePassXC yourself and a hosted manager for the family.

Getting started safely

1. Create a new database with the KDBX 4 format and a strong Argon2 setting. A longer unlock time is a good trade for stronger protection.
2. Use a long master passphrase, and consider adding a key file stored separately or a hardware key for challenge-response.
3. Save the database inside a folder that your sync tool watches, and make a second copy to an offline drive.
4. Install the browser extension from the official project page and pair it with the application.
5. Test restoring from your backup on another machine before you trust the setup.

What we could not verify

The audit we describe covers version 2.7.4 and a limited scope, and we did not read the full report or assess later versions line by line. The ANSSI certification is the project’s statement for version 2.7.9. The mobile apps that open KDBX files are separate projects, so their security and upkeep are outside this review. The 2.8 beta was current at the time of writing, and details may change before a stable release.

Alternatives

• Bitwarden: open source and free, with a hosted service and EU region.
• Proton Pass: Swiss provider with open source clients.
• Best free password managers compares the no-cost options.
• The wider market is in the best password managers comparison.

Conclusion

KeePassXC is an excellent choice for privacy-minded people who are comfortable managing a file and a sync routine. It gives you strong encryption, passkey support, independent review and no dependency on any company. If you want automatic sync, easy family sharing and first-party mobile apps, a hosted manager such as Bitwarden is simpler. If you pick KeePassXC, make backups from day one and test restoring one.