KeePassXC: A Free, Offline Password Manager for Every Desktop (GitHub, Scanned)

KeePassXC stores your passwords in a single encrypted file instead of someone else's cloud. You choose where that file lives: on your laptop, a USB stick or any sync service you already use, since the contents are encrypted before they leave the app. It runs on Windows, macOS and Linux and uses the standard KDBX format, so the same file opens in other KeePass-compatible apps.

It covers what people expect from a paid manager: a password generator, two-factor (TOTP) codes, passkeys, browser integration with Chrome, Firefox, Edge, Brave, Vivaldi and Tor Browser, auto-type into other apps, file attachments, entry history and YubiKey or OnlyKey challenge-response. It can import from 1Password, Bitwarden, Proton Pass and CSV files, and its password health report can check your entries against Have I Been Pwned. There is also a command-line tool and SSH agent integration.

KeePassXC is a community-driven port of the Windows app KeePass Password Safe, licensed under GPL-2 or GPL-3, with about 30,000 stars and 516 contributors. Version 2.8.0 came out on 21 October 2026.

• Repository: github.com/keepassxreboot/keepassxc
• Licence: custom (Other)
• Language: C++. Stars: 29.9K. Forks: 2,023. Last push: Nov 8, 2026.
• Scan: safe, Nov 10, 2026, commit 6bcb901

Who it is for

Anyone who wants a password manager without a subscription or an online account, people who prefer to keep their vault offline, and technical users who want SSH keys, TOTP codes and passwords in one place.

Getting started

1. Download the installer for Windows, macOS or Linux

https://keepassxc.org/download

2. Or take a build from GitHub

https://github.com/keepassxreboot/keepassxc/releases/latest

3. Then follow the official getting started guide to create your first database

https://keepassxc.org/docs/KeePassXC_GettingStarted.html

Your vault is only as safe as its master password and your backups. KeePassXC has no account recovery: if you forget the master password, nobody can open the file for you. Keep a copy of the database somewhere safe.

Safety scan

We cloned keepassxreboot/keepassxc at commit 6bcb901 on Nov 10, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• 22 secret hits, none of them real secrets. 20 are test keys in tests/TestOpenSSHKey.cpp, tests/TestPasskeys.cpp and tests/TestSSHAgent.cpp, used to check SSH key and passkey handling. The other 2 are constants in the app itself: the BEGIN and END PRIVATE KEY markers it uses to store passkeys (src/core/EntryAttributes.cpp) and to write SSH keys in PEM format (src/sshagent/OpenSSHKey.cpp).
• No pattern hits, no install hooks and no committed binaries across 1,517 files and about 664,000 lines. The bare IP addresses are in tests for the website icon downloader.
• 4 advisories, all unrated and all in golang.org/x/crypto inside utils/keepassxc-cr-recovery, a small Go tool for recovering a YubiKey challenge-response secret. They concern that package's SSH and OpenPGP code, and the main app is C++ and does not use it.
• The hosts in the code fit a password manager: haveibeenpwned.com for the optional breach check, yubico.com, the project's own site, and many example domains in tests. We found no analytics service.
• 2 workflows, no pull_request_target and no third-party actions. CodeQL is on and there is a security policy. The licence sits in a file called COPYING, which is why GitHub shows it as other.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 510.9K, C++ 116.8K, C/C++ header 28K, Markdown 2,200, Python 1,581, CMake 919.

Questions

Is KeePassXC free?

Yes, completely. It is open source under GPL-2 or GPL-3, with no paid tier, subscription or account.

How do I use the same passwords on my phone?

KeePassXC is a desktop app. Put the database file in a sync service you trust and open it with a KDBX-compatible app on your phone. The file is encrypted, so the sync service only sees encrypted data.

Can I move from another password manager?

Yes. It imports from 1Password, Bitwarden, Proton Pass, KeePass 1 and CSV files. We list Bitwarden in our directory at /bitwarden/ if you would rather have a hosted manager.

Does KeePassXC send my passwords anywhere?

Not by itself. The database stays where you save it. Network features such as downloading website icons and the Have I Been Pwned check only run when you use them.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.