KeePass 1.31

KeePass is a small, portable, secure password manager for generating, storing, and retrieving your passwords. With it, you will never worry about your passwords again.

Getting Started

  • How to Start a Password Database
  • How to Add a Password
  • How to Retrieve a Password

Learn More About Passwords

  • Understanding the Security Features of KeePass
  • Securing Your Passwords
  • Using Password Best Practices


Using Password Best Practices

This topic applies to hand-generated passwords you can remember. For random passwords, see How to Generate a Stronger Password.

As computers become more powerful, it takes less time and fewer resources for a malicious individual to correctly guess your password on a stolen device or when targeting you. To counteract this, you must keep yourself up-to-date with the latest best practices for hand-typed passwords.

Closed How Can Someone Crack My Password?

When a malicious individual steals your phone, computer, or targets you online, they have tremendous resources with which to guess your password. A modern computer with the right software can guess millions of passwords per second. Password guessing algorithms are robust, use multiple human language dictionaries, and anticipate character replacement strategies, common numbers, and will quickly break any passwords easy for humans to remember. Any password will be beaten with enough time, however not all passwords take the same time to guess. Your best protection is to make yours complicated while remaining memorable.

Techniques for Strong Hand-Typed Passwords

Any important password should be as long as possible, and use no common words or replacement strategies. If a password is easy to remember, it's easy for an algorithm to guess. If a password is slow to type because it uses special characters, it's a hindrance to you, but not the hacker's algorithm, which needs no hands to guess your password. For hand-typed passwords, security experts commonly advise using a sequence multiple, rare, unrelated words.

1. Increase the Length

Passwords should be at least 12 characters long. Expect this minimum to increase in the future.

✔qwertyuiopasdf

✘qwertyuiop

2. Use Uncommon Words

Words are easier to remember than unusual combinations of letters, numbers, and symbols. However, many users pick words or phrases within the top 50% of the most commonly used English words, which, even when misspelled or reversed, password algorithms easily guess.

✔confusticationkryptongneiss

✘confusing

3. Avoid Repetition

The more unique characters in a password, the more entropy (see List of Character Set Bit Entropies) it contains, and the harder it becomes to guess.

✔confusticationkryptongneiss

✘confusingconfusingconfusing

4. Avoid Personal Information

Targeted attacks against you are likely to source outside information about you (also called social engineering). If a hacker knows your email, they can most likely find plenty of information about you through social media and search engine queries, and then use that information in their password algorithm.

✔confusticationkryptongneiss

✘Harvard1998

Closed Additional Techniques

6. Use Special Characters in Unexpected Positions

Special characters alone no longer guarantee of password strength, but still add useful complexity. Avoid using special characters in expected positions, such as ampersands (&) between words or exclamation marks (!) at the end.

✔confus$ticationkrypt}ongneiss

✘confusing-confusing-confusing!

7. Avoid Replacements

Replacing letters with special characters (like leet-speak) was once an extremely effective way to strengthen passwords. The method became too popular, and algorithms anticipate all common replacement schemes.

✔confus$ticationkrypt}ongneiss

✘c0nfu$1ng-c0nfu$1ng-c0nfu$1ng!

What's Next?

  • How to Start a Password Database
  • How to Add a Password
  • How to Retrieve a Password
  • Examples of Password Strengths
  • List of Character Set Bit Entropies


To Be Completed

To do: write this topic.


How to Start a Password Database

The first step in managing your passwords is to create a password database. KeePass allows you to create multiple databases, each with a unique master password or key, if needed.

  1. In the main window, click File > New...
Closed Use a Password (Least Secure)
  1. Enter a secure password in the Master Password field and click OK.
    See Using Password Best Practices for password recommendations.
  2. Re-enter your secure password and click OK.
Closed Use a File (Secure)
  1. Click Save key file manually to... and select a file from your computer. Click OK.
    Note: To use your database on other devices, you will need to copy the chosen file to those devices.
  2. When prompted to overwrite the file, click Reuse.
Closed Use a Password and a File (Most Secure)
  1. Enter a secure password in the Master Password field.
  2. Check the box marked Use master password and key file.
  3. Click Save key file manually to... and select a file from your computer. Click OK.
  4. Re-enter your secure password and click OK.
  5. When prompted to overwrite the file, click Reuse.

What's Next?

  • Using Password Best Practices
  • How to Log In to Your Password Database
  • How to Add a Password
  • How to Edit a Password
  • How to Delete a Password
  • How to Create a Password Subgroup
  • How to Edit a Password Subgroup


How to Add a Password

KeePass has simple password creation, so you can rapidly and easily add new passwords for services and applications as needed.

  1. From the main window, click Add Entry....
  2. From the Group drop-down list, select your intended subcategory for the password.
  3. In the Title field, enter a name or description for the website, application, or service where you use the password.
  4. In the User Name field, enter your username for the website, application, or service (if not applicable, leave blank).
  5. In the Password field, enter a new hand-typed password.
  6. Enter a new password again in the Repeat field.
Closed Optional Password Settings

To select a custom icon for your password:

  1. Click the Icon button.
  2. Click on the appropriate icon from the list, then click OK.

    3. To set a date and time when the password expires (resets):

  3. Check the Expires box.
  4. Select the date:
    1. Enter the date in the first field, and enter the time in the second field, or
    2. Click on the Change expiration time button, and select a time from the menu.

What's Next?

  • How to Edit a Password
  • How to Delete a Password
  • How to Retrieve a Password
  • How to Generate a Stronger Password


How to Edit a Password

You can edit any attribute of a password saved in KeyPass at any time.

You cannot undo changes to your passwords!

  1. In the password directory, navigate to the password you wish to delete.
  2. Click on the password entry.
  3. Click Edit/View Entry....
  4. All attributes from when you added the password can be changed. For details, see How to Add a Password.

What's Next?

  • How to Add a Password
  • How to Delete a Password
  • Managing Your Password Database


How to Delete a Password

You cannot un-delete a password!

  1. In password view, navigate to the password you wish to delete.
  2. Click on the password entry.
  3. Click Delete Entry.
  4. In the confirmation dialogue, click Delete.

What's Next?

  • How to Add a Password
  • How to Edit a Password
  • Managing Your Password Database


Managing Your Password Database

Managing your password database in KeePass is simple, and similar to browsing files on your computer.

The left pane of KeePass's main window, called the database view, displays the full tree of your password database.

Each top-level item is called a group, and each item organised within it is called a subgroup, just like folders in a file explorer. Like folders, each group and subgroup can contain passwords, e.g.:

  • Group1
      • Password1
    • Subgroup1
      • Password2
      • Password3
    • Subgroup2
      • Password4
      • Password5

Passwords are not displayed in the database view, but in the pane to the right, called the password view.

To view the passwords contained in a group or subgroup, simply click on it, and the right pane will populate with all the associated passwords. You can then copy, add, edit, or delete passwords from that group as needed.

By default, when you create a new database, KeePass populates it with the following groups:

  • General
    • Windows
    • Network
    • Internet
    • eMail
    • Homebanking

These are only recommendations. You may add, remove, or rename any the default subgroups. How you organise your passwords is up to you.

What's Next?

  • Using Password Best Practices
  • How to Start a Password Database
  • How to Add a Password


Examples of Password Strengths

A higher bit strength does not always make a stronger password. These values are not guaranteed to be accurate in all situations. Different computational metrics and password guessing algorithms will yield different results.

Password | Strength (bits)
Password | 14
1234567890 | 6
1111111111 | 5
test | 11
Test | 14
Testament | 40
ExquisiteCombination | 81
%ExquisiteCombination# | 100
KMM48NmKpMfjZxmzmq | 90
t+mrsr8_.==eAtGjtklM | 114
¤ÙZn0ÿWÝ.ÚìÓ\eñûªßA¶ | 151

Note: The most optimal password is bolded.

What's Next?

  • Using Password Best Practices
  • How to Add a Password
  • How to Generate a Stronger Password
  • List of Character Set Bit Entropies


List of Character Set Bit Entropies

Higher bit values correspond to increased password complexity.

Character Set | Entropy per character
Arabic numerals (0–9) | 3.2 bits
Case sensitive Latin alphabet (a-z, A-Z) | 5.7 bits
All ASCII printable characters | 6.6 bits
All extended ASCII printable characters | 7.8 bits

Source: https://en.wikipedia.org/wiki/Password_strength .

What's Next?

  • Using Password Best Practices
  • How to Add a Password
  • How to Generate a Stronger Password
  • Examples of Password Strengths


Securing Your Passwords

Most essential, day-to-day services require a password. The majority of computer users have email accounts, bank accounts, social media, credit cards, video streaming services, bill payments, and work logins that all require passwords. The loss or compromise of one of the passwords to these services can cause enormous financial and social damage. Despite this, most users do not use secure passwords or store them safely. Every year, millions of passwords are compromised, and millions of dollars lost to online scams, fraud, and identity theft.

Your Password is Not Secure

Most users have experienced this dilemma:

  1. I have many services that require passwords.
  2. I tried creating unique passwords for each service, but I can't remember which password goes to what service.
  3. I tried creating a single, complex password, but it was too difficult to remember or type.
  4. I found a new service I want to use, and I need to create a new login/password for it.
  5. I will just use the same simple password I use for everything else.

This is extremely risky. Most users understand the importance of passwords, however you may be unaware of the technical and social realities of password security on modern computers. The reality is often far more grim than you might expect.

Closed Why am I at risk?

You can't rely on online services to be secure

You have no way of knowing how well a service secures your password. No matter how much they promise they will protect it, they will If a service's data is compromised, your password could be compromised. This is the most common vector for password theft, and you have no control over it.

Hackers want your money

In the 80s and 90s, when fewer people used the internet for their finances, viruses, trojans, and WORMs were deployed mostly to cause disruption and chaos. Now, with the influx of moneyed services, hackers view the average user as a potential source of income. There are millions of dollars to be made by impersonating, blackmailing, or stealing from you.

Many services, many hacking opportunities

If a hacker steals your username and password from a service, they will attempt to use them on all other common services that you're likely to use. Since most users use the same password, this gives them easy access to all of your financial and social accounts at once.

Your hardware is a target

The majority of users now perform most of their computer tasks through their phone. Phones are also the most targeted items by thieves. Sophisticated thieves will either try and hack your phone themselves, or sell your phone to a third party who will try and hack it. Either way, if your phone stores all your passwords, you're taking a large risk.

Since services, phones, and your memory can't be trusted, the only option available to you is a password manager.

Offline Password Managers

An offline password manager holds a secure database of your passwords. It lets you:

  • Keep a list of your passwords, organised by account/service.
  • Choose whether to keep your passwords on a portable USB, or only at home.
  • Create a unique password for each account/service.
  • Create strong passwords you don't have to memorise.
  • Copy and paste passwords quickly and securely.
  • Secure all your passwords with one strong password, keeping it simple.

By keeping your password offline and off your phone, creating strong passwords, and keeping unique passwords, a password manager will secure you from the vast majority of all vectors of attack from hackers. If you would like to keep your passwords portable, you can store the whole manager on a USB key, further reducing your risk.

What's Next?

  • Using Password Best Practices
  • How to Start a Password Database


How to Generate a Stronger Password

KeePass offers great flexibility to generate passwords of any strength, allowing you to generate random passwords of any length with special characters, making your password unguessable.

Your computer or the service receiving the password may not accept different character sets and special characters. Contact your administrator or check online to find which characters are permitted.

  1. From the main window, click Add Entry...
  2. From the Group drop-down list, select your preferred group or subgroup category for the password.
  3. In the Title field, enter a name or description for the website, application, or service where you use the password.
  4. In the User Name field, enter your username for the website, application, or service (if not applicable, leave blank).
  5. Click Generate a random password...
  6. In the Length of generated password field, specify the number of characters for the password.
  7. Check off each special type of character you require. The more types selected, the more secure your password will be. Note: High ANSI characters are characters from Cyrillic, Chinese, Korean, and Japanese alphabets.
  8. Click Generate.
  9. If the bit strength of your password is insufficient, click Generate again, or increase the password length.
  10. Click Accept.
  11. In the Add Entry window, click OK.

What's Next?

  • Using Password Best Practices
  • How to Add a Password
  • How to Generate a Stronger Password
  • List of Character Set Bit Entropies