KeePass is a free, open-source password manager that helps you securely manage your passwords. You can store all your passwords in a single database, secured with either a master key or a key file. This way, you only need to remember one master password or select the key file to unlock the entire database.
The databases are encrypted using industry-leading, highly secure encryption algorithms. A password database is stored in a single file, making it easy to transfer from one computer to another.
KeePass encrypts its password databases using the Advanced Encryption Standard (AES, based on the Rijndael algorithm) and the Twofish algorithm.
Both of these ciphers are considered highly secure. For example, AES became a U.S. federal government standard and was approved by the National Security Agency (NSA) for securing top-secret information.
KeePass All Features
KeePass uses the common CSV export format used by various password managers, such as Password Keeper and Password Agent. Exports from these programs might be imported into your KeePass databases. The password list can be exported to various formats like TXT, HTML, XML, and CSV.
The application has a portable edition: you may carry it on a USB stick and run it on Windows systems without installation.
Strong Security
- The app uses the Advanced Encryption Standard (AES, based on Rijndael) and the Twofish algorithm for encrypting its password databases. Both ciphers are considered highly secure. For example, AES became a U.S. federal government standard and is approved by the National Security Agency (NSA) for encrypting top-secret information.
- The entire database is encrypted, not just password fields. This means your usernames, notes, and all other data remain securely protected.
- SHA-256 is used to hash the master key components. SHA-256 is a 256-bit cryptographically safe one-way hash function. No assaults are recognized but towards SHA-256. The output is remodeled using a key derivation function.
- To significantly bolster security against dictionary and guessing attacks, we implement a powerful key derivation function (KDF), such as AES-KDF or Argon2, to transform the master key component hash. This critical process makes unauthorized access to your data exceptionally difficult, even for sophisticated threats.
- Process memory protection: your passwords are encrypted while KeePass is running, so even when the operating system dumps the KeePass process to disk, your passwords aren’t revealed.
- [2.x] Protected in-memory streams: passwords are encrypted using a session key when loading the internal XML format.
- Security-enhanced password edit controls: KeePass is the primary password manager with security-enhanced password edit controls. None of the available password edit control spies work against these controls. The passwords entered in those controls aren’t even visible in the process memory of KeePass.
- The master key dialog can be shown on a secure desktop, where almost no keylogger can operate. Auto-Type can also be protected against keyloggers.
Changes in KeePass 2.59 Professional :
New Features:
- On Windows 11 24H2 ARM64 and newer, KeePass operates as a native application, eliminating the need for x64 emulation.
- Added KeePassLibN native support library, which provides native implementations of AES-KDF and Argon2 on Windows systems (x86, x64, and ARM64).
- New C# AES-KDF implementation (about 30-50 times as fast as before, depending on the system; used when the native support library is unavailable or disabled).
- New C# KDB import/export module, which now makes it possible to import/export KDB files on ARM64 systems and on Unix-like systems, too.
- The KDB import/export module now supports importing and exporting the default user name and the database color.
- When exporting a database to a KDB file, the root group is now exported, too.
- The ‘About KeePass’ dialog now displays the architecture of the current process (‘x86’/’x64’/’ARM64’/… instead of only ’32-bit’/’64-bit’).
- Added support for opening URLs with Maxthon, SeaMonkey, and Yandex in private mode.
- On Unix-like systems, URLs in certain views are now linkified.
- Some development snapshots can now load DLL plugins.
- Added framework-specific solution and project files for Visual Studio 2022.
Improvements:
- Encrypting and decrypting databases using the AES algorithm is now faster.
- Native support library usage now includes Argon2.
- Native support library settings are now respected when using KeePass as a library (e.g., KPScript or PowerShell script).
- Clicking the [OK] button in the options dialog now also saves volatile settings, such as the main window’s position and size.
- When an exception occurs while exporting data, it is now shown in the status logger dialog, if one is displayed.
- Improved formatting of multiline messages in the status logger dialog.
- The KDB import/export module now refuses to use a master key containing an XML key file (because KeePass 1.x does not support XML key files).
- The KDB export module no longer exports unnecessary auto-type sequence definitions.
- Improved removal of dangling custom icon references.
- The app is now built using Visual Studio 2022.
- Increased target framework version.
- Improved efficiency of some algorithms that use a set.
- Improved creation of AES CSP objects.
- Improved project cleanup script.
- Removed KeePassLibC native support library (because it is not used by KeePass 2.x anymore; KeePassLibC continues to be available in the KeePass 1.x source code package); the installer deletes it when updating an existing app installation.
- Installer: updated native image (NGen) size estimation.
- Upgraded installer.
- Various UI text improvements.
- Various code optimizations.
- Minor other improvements.
Bugfixes:
Changes in KeePass 1.43 Classic:
New Features:
- Added option ‘Prevent certain screen captures’ (in ‘Tools’ → ‘Options’ → tab ‘Advanced’, turned off by default); note that this may also prevent legitimate other software (remote desktop solutions, accessibility tools such as screen magnifiers, etc.) from seeing KeePass windows.
- Added {PASSWORD_ENC} placeholder, which is replaced by the password of the current entry in encrypted form (DPAPI/CryptProtectData).
- Added ‘-pw-enc:‘ command line parameter.
Improvements:
- Improved database save confirmation dialog text.
- Improved behavior of the translation system for untranslatable strings.
- Improved project cleanup script.
- Upgraded installer.
- Various UI text improvements.
- Various code optimizations.
- Minor other improvements.
Bugfixes:
Supported Operating Systems: Windows 7, 8, 8.1, 10, 11 (32-bit, 64-bit).
