KeePassXC

About KeePassXC

KeePassXC is a community fork of KeePassX that stores your passwords in an encrypted local database. It supports TOTP, browser integration, SSH agent and hardware keys, and needs no account.

Good for

• Keeping passwords offline in a file you control
• Auto-fill through a browser extension
• Storing TOTP codes and SSH keys

What’s new in 2.8.0

New Features
- Add remote database synchronization and import using external tools [#7222, #10896, #11271]
- Allow configuring keyboard shortcuts [#9643]
- SSH Agent: Add support for generating RSA, ECDSA, and Ed25519 keys [#7215]
- Linux: Add Wayland Auto-Type support using XDG Desktop Portals [#13359, #13449, #13579, #13770, #13810]
- Linux: Add Quick Unlock using Polkit (adds a UUID to public metadata, marking database as modified on first launch) [#8983]
- Linux Add AArch64 AppImage [#13816]
- macOS: Allow Quick Unlock using the device password when Touch ID is unavailable [#11410]
- Windows: Allow administrators to enforce certain user settings via global Group Policy overrides [#11223]
- Windows: Add native Arm64 builds [#13678, #13727]

Major Changes
- Migrate to Qt 6 [#11651, #7783, #13456, #13473, #13684, #13784]
- Linux: Store application state in XDG_STATE_HOME instead of XDG_CACHE_HOME [#9755]
- Build: Bundle build features under a single KPXC_MINIMAL CMake option [#11003]

Security Fixes
- Fix use-after-free when importing crafted KDB files (CVE-2026-69150; Credits: A. Ramos (@aramosf)) [#13500]
- Browser: Prevent entry reference injection when creating or updating entries via browser extension (CVE-PENDING; Credits: Davonte (@BadPingHere)) [#13580, #13670, #13688]
- Browser: Fix out-of-bounds writes when encrypting and decrypting native messaging messages (CVE-PENDING; Credits: @sigure21) [#13679]
- Windows: Randomize shared memor…

Full release notes on GitHub →

Install & verify

• Windows: run the installer, or unzip the portable build. SmartScreen may warn about new releases; that is normal for unsigned open-source builds.
• macOS: open the disk image and drag the app to Applications. If it is blocked, right-click it and choose Open.
• Linux: install the .deb or .rpm with your package manager, or run the AppImage or archive.
• Verify: press Copy SHA next to a file, then compare it with certutil -hashfile FILE SHA256 (Windows) or shasum -a 256 FILE (macOS/Linux).

Version history

Older versions can contain known security issues. Use the latest release unless you need a specific one for compatibility.