KeePassXC Guide 2025 — Setup, Browser Integration & Tips

KeePassXC is the modern, community-maintained fork of KeePass — a completely free, open-source password manager that stores your vault locally on your device. No subscription, no cloud, no company with access to your data. It's the choice of security-conscious Reddit users and privacy advocates who want total control. This guide gets you fully set up from scratch.

Step 1: Download and Install KeePassXC

1. Go to keepassxc.org — always download from the official site
2. Choose your platform: Windows (installer or portable), macOS (DMG), Linux (AppImage, Flatpak, or Snap)
3. Verify the download signature — KeePassXC provides GPG signatures. Verify before installing (instructions on their site). This confirms the file hasn't been tampered with.
4. Install and launch KeePassXC

Step 2: Create Your Password Database

Your database is a single encrypted file (.kdbx) that contains all your passwords. You own it completely.

1. Click "Create new database"
2. Name your database (e.g., "Personal Passwords") and choose where to save it — your Documents folder is fine, since the file is encrypted
3. Set your master password: Use a strong passphrase — 5-6 random words. This is the only password you need to remember. Write it down and store it physically in a safe.
4. Encryption settings: KeePassXC defaults are excellent — AES-256, 600,000 key derivation rounds. Don't reduce these. You can increase them if you want.
5. Click "Done" — your empty database is created

Optional: Add a Key File for Extra Security

A key file is an additional factor — like a physical key — that must be present to open the database. Even if someone gets your database file AND your master password, they can't open it without the key file.

Click "Add additional protection" → "Add Key File" → generate a key file → store it on a USB drive or a separate location from your database. This is excellent security if you want to protect against remote attacks, but you must not lose the key file.

Step 3: Adding and Managing Entries

Each password entry contains: Title, Username, Password, URL, Notes, and custom fields.

• Add entry: Click the green + button or press Ctrl+N → fill in Title, Username, Password, URL
• Generate passwords: In the password field, click the dice icon to open the password generator. Use 20+ characters, all character types.
• Organize with groups: Create folders in the left panel (Email, Banking, Shopping, Work, etc.) to keep your vault organized
• TOTP/2FA codes: Right-click an entry → "Set up TOTP" → scan the QR code. KeePassXC stores and generates your 2FA codes too.

Step 4: Browser Integration (KeePassXC-Browser)

Browser integration allows autofill directly from KeePassXC into Chrome and Firefox.

1. In KeePassXC: Tools → Settings → Browser Integration → Enable browser integration → check "Enable Chrome/Chromium support" or "Enable Firefox support"
2. Install the KeePassXC-Browser extension from the Chrome Web Store or Firefox Add-ons
3. Click the extension icon in your browser → "Connected" status should appear
4. KeePassXC must be open and unlocked for autofill to work

When you visit a site, the KeePassXC extension icon activates — click it to fill credentials from matching entries. Unlike cloud-based managers, KeePassXC never sends any data to a server.

Step 5: Import Existing Passwords

From Chrome (CSV)

1. Export your Chrome passwords as a CSV file
2. In KeePassXC: Database → Import → CSV file → select your Chrome export
3. Map the CSV columns to KeePassXC fields (Name, Username, Password, URL)
4. Click Import

From LastPass / Bitwarden

Export as CSV from your current manager, then import via KeePassXC's CSV import. All major managers export in CSV format — see our manager migration guide.

Step 6: Syncing Across Devices

Unlike cloud managers, KeePassXC doesn't sync automatically — you manage your database file. Recommended approaches:

• Syncthing (Best): Free, open-source, peer-to-peer sync. Syncs your .kdbx file directly between your devices without any cloud service. The privacy-purist choice.
• Nextcloud: Self-hosted cloud storage. Sync your database like any file.
• Dropbox/Google Drive: Technically works — the file is encrypted, so even if the cloud provider is breached, attackers get only the encrypted database. Only viable with a very strong master password.
• USB drive: For maximum security, carry your database on an encrypted USB drive and manually sync to each device.

Step 7: Mobile Apps

KeePassXC itself is desktop-only. For mobile, use compatible apps that read the same .kdbx format:

• Android: KeePassDX (best UX) or KeePass2Android. Both free, open-source, excellent autofill support.
• iPhone: Strongbox (freemium, best iOS app) or KeePassium. Sync the database from your preferred sync service.

Setup: point the mobile app to your synced .kdbx file → enter master password (and key file if you use one) → enable biometric unlock for convenience.

Advanced: Key Files and SSH Agent

SSH Agent Integration

KeePassXC can act as an SSH agent — store your SSH private keys in KeePassXC entries and automatically load them when you unlock your database. For developers, this is a significant workflow improvement. Enable it in Settings → SSH Agent → Enable SSH Agent integration.

YubiKey Challenge-Response

KeePassXC supports YubiKey HMAC-SHA1 challenge-response as an additional database protection factor. Combined with your YubiKey, this means: master password + physical YubiKey tap = maximum database security.

Auto-Lock Settings

Configure KeePassXC to automatically lock after inactivity (Settings → Security → Lock database after inactivity). Set to 5–15 minutes for a balance of security and convenience.