KeePassXC Review 2026: The Best Local-Only Vault

KeePassXC is the right answer for a specific user: someone who wants credential management with zero cloud dependency, fully auditable source code, no subscription, and an open vault format that other applications can read. It is the wrong answer for someone who wants a seamless cross-device experience with no setup.

This review is an analysis of KeePassXC’s published documentation, its independent audit report, and its national-scheme certification. It is documentation analysis, not a hands-on trial.

What KeePassXC is

KeePassXC is a community-maintained C++/Qt rewrite of the original Windows-only KeePass, released under the GNU General Public License. It reads and writes KDBX 4, an open, documented vault format.

Your vault is a single file on disk. The application has no network functionality at all — not disabled by policy, absent by design. That single architectural decision explains both its strengths and every one of its limitations. Sync between devices is your responsibility: a cloud drive, Syncthing, rsync, or a USB key.

Encryption

KDBX 4 as implemented by KeePassXC offers:

Setting	Options	Default guidance
Content cipher	AES-256, ChaCha20, Twofish	AES-256 is the default; ChaCha20 is a reasonable alternative
Key derivation	Argon2d, Argon2id, AES-KDF	Argon2 family; AES-KDF exists only for backwards compatibility
KDF tuning	Iterations, memory, parallelism	User-adjustable; higher memory raises offline brute-force cost
Second factor	Key file	A file that must be present alongside the password
Second factor	Hardware challenge-response	YubiKey and OnlyKey via HMAC-SHA1 challenge-response
Quick unlock	Windows Hello, Touch ID, polkit	Convenience layer over an already-unlocked session

The KDF parameters being user-adjustable is the point. Cloud managers pick these for you and you take what you are given. Here you can raise the Argon2 memory parameter well beyond any commercial default, at the cost of a slower unlock on your own hardware.

The format specification is public and multiple independent applications read KDBX files, so the vault format itself is not a lock-in point.

Audit and certification history

KeePassXC is one of the few free, community-run password managers with a formal national certification. The project maintains a public audits page listing two entries:

Assessment	Assessor	Date	Version	Outcome
ANSSI Security Visa, CSPN certification (ANSSI-CSPN-2025/16)	ANSSI, the French national cybersecurity agency	17 November 2025, valid to 17 November 2028	2.7.9 on Windows 10	Certification granted; full technical report published in French and English
Application Security Review	Zaur Molotnikov, independent security consultant	19 January 2023	2.7.4, source	Report published April 2023

The 2023 audit report concluded that KeePassXC provides sufficient cryptographic protection — confidentiality, integrity and authenticity — for the data stored in the database, conditional on the user choosing a strong authentication method and the current file format. That conditional is doing real work: KDBX 3 databases and AES-KDF settings inherited from a decade-old KeePass file do not get the same assurance as a current KDBX 4 database with Argon2.

The project is also unusually candid about what an audit is worth. Its own framing is that an audit is not proof of safety, that competent auditors still miss flaws, and that any audit only covers a snapshot of the code. That is a more honest statement of the limits of assurance than most commercial vendors publish.

The ANSSI certification is the more significant of the two for institutional users. A CSPN certificate is a state-scheme evaluation with a defined target of evaluation and a published technical report, and it is the kind of document a procurement or compliance function will actually accept.

Platform support

Platform	Support	Notes
Windows	Native	Official installer and portable build; Windows Hello quick unlock
macOS	Native	DMG and Homebrew; Touch ID quick unlock
Linux	Native	AppImage, Flatpak, Snap and distribution packages
iOS / iPadOS	None official	Third-party KDBX readers: Strongbox, KeePassium
Android	None official	Third-party KDBX readers: KeePassDX, KeePass2Android
Chrome, Firefox, Edge, Brave, Vivaldi	KeePassXC-Browser extension	Talks to the desktop app over a local socket, never a server
Safari	Not supported	No extension available
CLI	Windows, macOS, Linux	keepassxc-cli for scripting, backups and CI
SSH agent	All desktop platforms	Vault can serve SSH keys while unlocked
Sync	Your choice	Syncthing, cloud drive, rsync, USB — nothing built in

The browser integration has one workflow consequence that catches people out: the extension only works while the KeePassXC desktop application is running and unlocked. Lock the app and autofill stops. That is not a bug, it is the local-socket architecture, but it is a genuinely different habit from cloud managers where the extension can fetch credentials on its own.

The absence of an official mobile app is the single largest gap. The third-party readers are good and actively maintained, but you are trusting a different development team with your vault file, and you own the sync arrangement that gets the file to the phone in the first place.

Cost of ownership

KeePassXC has no pricing page because it has no price. What it has is a cost structure spread across the pieces you have to assemble yourself. Figures below reflect the position as of August 2026.

Component	Cost	Notes
KeePassXC desktop (Windows, macOS, Linux)	$0	GPL-licensed; no paid tier, no upsell, no telemetry
KeePassXC-Browser extension	$0	Official, maintained by the same project
keepassxc-cli	$0	Included with the desktop package
Vault sync	$0 to whatever you already pay	Syncthing is free; a cloud drive uses storage you likely already have
iOS companion app	Free tiers and one-off or subscription paid tiers, depending on the app	Strongbox and KeePassium both offer a free tier with paid upgrades
Android companion app	$0	KeePassDX and KeePass2Android are free and open source
Hardware second factor	Cost of a YubiKey or OnlyKey	Optional; challenge-response, not FIDO2
Support	Community only	GitHub issues and the project forum; no SLA, no support desk

The honest comparison is not “free versus $19.80 a year”. It is “free plus your own time” versus “$19.80 a year and someone else’s time”. For a technical user who already runs Syncthing, KeePassXC costs nothing. For a household that would need help every time sync breaks, the commercial plan is cheaper in every sense that matters.

Family and team plans

There are none, and this is the section that decides the product for a lot of people.

KeePassXC has no concept of an account, an organisation, a shared collection, a per-member private vault, role-based access, emergency access, or account recovery. The available approximations are:

• A shared vault file. Put one KDBX file in a location every member can reach and give them all the same password. Everyone sees everything, there is no per-item permission, and there is no audit trail of who opened what.
• Multiple vault files. One shared household file plus a personal file each. Workable, but every member now manages two vaults and their own sync.
• A written recovery plan. Since there is no emergency access feature, the only inheritance mechanism is a physical one: the master password and any key file recorded somewhere a trusted person can reach after the fact. Our guide to lost master password recovery covers why this has to be planned in advance.

If more than one non-technical person needs access, Bitwarden Families solves in a checkbox what KeePassXC asks you to solve with process.

Import and export

Import. KeePassXC reads KeePass 1 (.kdb) databases and generic CSV through a guided column mapper, and has direct importers for several competitors’ export formats, including 1Password’s .1pux and OPVault, Bitwarden’s JSON export, and Proton Pass JSON. Anything not on that list goes through CSV.

Export. The desktop app exports to CSV, HTML and the KDBX XML representation. All three are plaintext — an exported CSV of your vault is a plaintext credential dump and should be treated exactly as dangerous as that sounds. There is no encrypted export format, because for KeePassXC the encrypted export format is simply a copy of the .kdbx file itself.

That last point is the underrated advantage. Your backup strategy is cp vault.kdbx backup/ — the file is already encrypted at rest with your chosen cipher and KDF, so copying it anywhere, including an untrusted cloud drive, does not expose anything. No competitor’s backup story is that simple, and no competitor can revoke your access to it.

Verdict

Score: the best local-only password manager, and the best value in the category if you accept the workload.

• Best for: privacy maximalists, security professionals who need offline credential handling, Linux users, anyone with SSH key workflows, and users who want their vault to outlive any company.
• Security posture: GPL source, a published independent code review, and an ANSSI CSPN certificate valid to November 2028. User-tunable Argon2 parameters exceed what any commercial manager exposes.
• Weakest point: no official mobile app, no sync, no sharing, no recovery. These are consequences of the design, not defects in it.
• Configure this first: set the KDF to Argon2id and raise the memory parameter, add a key file or hardware challenge-response as a second factor, and confirm your backup copy actually opens before you rely on it.
• Price verdict: $0, permanently, with no vendor who can raise it, discontinue the product, or lose your data. That is worth more than it looks. The two cloud-synced alternatives at the same price are covered in the no-limits free password manager comparison.

Who should skip KeePassXC

• Anyone who wants sync to just work. There is nothing built in. If configuring Syncthing or reasoning about file-conflict resolution in a cloud drive sounds like a chore rather than a Saturday, use Bitwarden.
• Phone-first users. No official mobile app. If most of your logins happen on a phone, the third-party-reader-plus-sync arrangement will be the main thing you interact with, and it is the weakest part of the setup.
• Households and small teams. No shared vaults, no per-member permissions, no emergency access. A shared file with a shared password is not a family plan.
• Safari users. No browser extension.
• Anyone who needs a recovery path. Lose the master password and key file and the data is gone. There is no organiser, no support desk, and no reset — see what actually happens when the master password is lost.
• Anyone who wants proactive breach alerts. There is no Have I Been Pwned integration pushing warnings at you, because there is no network stack to push them over. Breach response is entirely manual here.

KeePassXC is excellent at exactly what it sets out to do. Its limitations are structural rather than unfinished work, and knowing that going in is the difference between a tool that fits and a tool that frustrates.

See also

• Docker homelab tutorials
• homelab firewall guide