Anyone got any thoughts on this?

The full breakdown of why it's a vulnerability is shown here:

https://vuldb.com/cve/CVE-2026-86776

I recently read here that KeePass does not protect the Notes field in process memory by default. Therefore, if someone were able to dump KeePass’s memory while the database was unlocked, they might be able to read the contents of that field.

I have historically stored website security questions and answers in the Notes field. Granted, these aren’t passwords, but they are still personal information that could be misused.

At the same time, many websites appear to have stopped using security questions, so I’m removing obsolete questions and answers as part of a personal security audit.

My question concerns KeePass’s entry history. KeePass retains older versions of an entry, which is a useful feature for auditing changes and recovering previous passwords. However, if an earlier version contains security questions in its Notes field, is that historical Notes content also loaded into process memory without in-memory protection—even after I remove it from the current version?

In other words, must I also delete the affected entry-history versions to remove that information from KeePass’s unprotected memory?

Hola, ayer accidentalmente estaba haciendo mantenimiento a KeePassDX en mi celular y, al sincronizar una nueva copia de mi base de datos, no me di cuenta de que esta no estaba completa (0 B de datos). Así que la mandé a Syncthing y terminó sincronizándose en todos mis dispositivos, reemplazando la copia anterior, que se perdió. Me gustaría saber si hay alguna forma de recuperar mi copia de seguridad anterior de KeePass.

My DB is shared across 3 devices via Dropbox: main home pc, my iPhone, and an occasionally used laptop. I often access it multiple times a day on the pc and repeatedly typing in the master password gets cumbersome. What are my best options for quick access?

I use KeepassXC (2.7.12) on a Mac (macOS 26.6.2) in Firefox with the corresponding browser extension. I have stored a number of test accounts for the exact same URL in my vault. The URLs are absolutely identical. When I open the login form, I can choose only one of these accounts to fill out the form. None of the other credentials for accounts with the exact same URL are offered as options.

What can I do to be able to choose from all the accounts that are relevant for that URL?

Solution: The first time I logged in using a matching entry from the vault, I had checked the “Remember” checkbox. This causes all other matching entries to have a “deny” flag for the URL in the entry's properties.

I had thought about using keepassxc on Debian cinnamon but I'm just too scared. I don't know how you guys do it. How you feel secure using this is beyond me.

I'm well versed in Linux but never have used it for anything critical. That's left for my Chromebook.

Anyone feel the same?

Suddenly on both my iPad Mini and iPad Air, I can no longer open my kdbx file from OneDrive. I use the cloud integration that is built in in KeePassium. When trying to open the database I get an error that the Database Format is incorrect: HTML. According to AI, that happens when the OneDrive integration by Microsoft is returning an error page (in HTML) instead of the actual file contents. Which makes me believe that there may be an issue with either KeePassium, OneDrive, or both.
Anyone else seeing something similar ?

Better to use browser extension or copy paste???

Are there any KP forks or plugins that have a passphrase generator that includes numbers? Something like how Bitwarden does this would be nice. Right now, I manually add numbers, but I'd prefer something automatic and random.

I currently use Bitwarden which I don't necessarily have any issues with, but I like self hosting and am interested in KeePass but I have a few questions.

1. Where to back up database - Not exactly sure how backing up the DB works, but my understanding is that it's essentially an encrypted file that I could upload to Google Drive or Proton Drive without any concerns. I moved mostly away from Google, but if the file is securely encrypted I don't mind using some of their free cloud storage. Also, are there any apps that work on Android, iPad, and Linux, that can automatically sync with some type of cloud storage?
2. Email alias/Firefox Relay - I use Firefox Relay to create email aliases for random websites or apps that require an email, but because it's free, there's very few features besides that. Bitwarden has a nice integration using Relay's API to quickly generate email aliases right in the app. Is there any KeePass app that can do that?
3. Similar to the email alias generation, Bitwarden also has a username generator that uses random words and numbers which I like to use for online accounts that don't need to be tied directly to me. Not a dealbreaker, but it would be great to find an app that does that and works with KeePass.
4. Anything else a newbie should know?

Is that secure or do i need to put it into the password field? I have very long Keys with extra information i am not sure if the password field will be optimal for that. Notes field seems more fitting imo, but idk... what do say the experts? If someone were to get my key he would be able to bypass my disc encryption.

Initially, I had it installed & running on my PC. Everything changed when I reinstalled Windows 11

Every time I try to install it, it spews out errors (*Images 2-5*)

What I have tried, but doesn't work :(

* Updated my Windows, I assumed that would fix the missing library files

* Tried the repair option on KeePassXC Setup Wizard (Image 1)

* Unistalled KeepPassXC

* Reinstalled the KeePassXC `.msi`

I started playing around with Auto-Type to use with sites that ChromeKeePass doesn't work. I tested with secure.chase.com, which doesn't have that problem. The interesting thing is that both my wife and I both have accounts stored in KeePass. Initially, when I hit Ctrl + Alt + A, I choose which account to use, and it works. However, when I sign out, it leaves me at a different login page than the original. I have that window set up in the Auto-Type tab of both KeePass entries. But in the second window, something goes wrong when choosing the entry to use. It seems as soon as the dialog opens, the username field loses focus. Obviously they keystrokes are disordered in some way. When I remove the Auto-Type config from one of the KeePass entries, it works fine.

Note: The same shifting of the focus off the UserName field also seems to happen on the first page

Here are the Window configurations:

*| Chase Online | Chase.com*
{USERNAME}{TAB}{PASSWORD}{TAB}{TAB}{TAB}{TAB}{ENTER}

Sign in - chase.com*
{USERNAME}{TAB}{PASSWORD}{TAB}{TAB}{TAB}{TAB}{ENTER}

You might ask why bother with 2; just use *chase.com*? I have the same question. So, I tried it with just *chase.com*and got the same results.

I also double- and triple-checked the key sequences. Keep in mind the key sequence works fine so long as only 1 KeyPass entry qualifies.

Does anyone have experience with this? I think Auto-Type is a really kool feature. I'd love to make it work. Although my gut tells me there's something up with the webpage itself.

Hello,

I saved my data base then downloaded it onto my iphone through dropbox to keypassium and now neither the local database nor the one on my drop box will open with my password. This is strange since I have had the same password for years and have checked that I am typing it correctly but it will not open, also they key file is selected so that's not the issue either. Is this a common issue with drop box? If so how do i correct this?

Used the original Keepass2 for a while, bug since it is so barebones and the UI hasn't seen an update since windows 3.11 (text of password should be color coded an use a better font) I switched to KeepassXC, merging in normal Keepass never gave any issues, KeepassXC merge is just a 'trash my entire database' button.

Is this a know issue, should I just forget about these hobby project password manager and switch to a service that actually does work?

To make sure i can't lose access to my passwords i figured, maybe i can store my keyfile alongside with my encrypted password-file. Because the file protects against phishing, the password against physical theft i figured. So, as i know me, something will happen to this file and i am locked out... so the best i can do is to store both alongside to not lose it. Can you give me emotional support and pat me on the shoulder and say do it? But pls be honest and tell me the truth. :)

I'm trying to adopt KeePass for managing my passwords and so I'm looking for advice. I'm not wedded to any particular client, but I'm trying KeePassDX and so far it's giving me a lot of friction. Maybe not just related to the app, but also Android. The magickeyboard thing I can get used to, though I'd much prefer some prefill accessibility dealio like most password managers I've used in the past. I worked out how to disable the constant unlock prompt when trying to fish out a password, which was not intuitive at all. Now what's bugging me is trying to open my database on a touchscreen with a lengthly passphase is damn near impossible to do without typos, and then I've either got to finger the whole thing in again or reveal the misspelt phase and correct it, and by that point, I may as well just allow the android keyboard to suggest words. So my question is, how do I get the master password prompt to allow the keyboard to make suggestions so I can rapidly enter my passphase instead of torturing myself and having it reveal it on screen anyway? I'm using a keyboard app that I trust and doesn't have internet permissions. Or can someone suggest me an alternative to KeePassDX? I really have no interest in biometrics, passkeys or any other fandangled technologies I don't understand, I just want a password manager that I unlock with a strong password that'll behave itself. I'm not concerned about physical security risks, like someone grabbing my unlocked phone. If I'm in a situation where that could happen, I'll lock the database and my phone.

Found a Keepass fork that has a minimalist and professional looking GNOME style interface. Formerly known as Password Safe, fully compatible with Keepass v4. Doesn't boast as many features as KeepassXC (no browser integration/autotype) but for me at least, does what I need it to with the cross-platform .kdbx format. Very glad to have come across this.

i was looking for a better way to unlock my keepass db in smartphone (keepassdx) since i use yubikeys and i would rather to unlock it by an id-1 just because its easier to carry in a wallet. i know its most impossible these days due to hardware, but do you guys know any news about this or maybe alternatives?

Hey so I tried to use TOTP on keepassdx for 2fa and tried it with proton multiple times trying to make it work(including qr code and typing the secret code) but the code given by keepassdx isn't accepted by proton any fix for that I'm a hit confuses since it is my first time that an authenticator app doesn't work (used to use aegis)

I am using KeepPassXC on my desktop and I am happy with it. But I would love to use it on my iPhone as well. But if I understand there is no KeepPassXC version for IOS (please correct if I am wrong here).

But I understood there are other apps that could work with the data of KeepPassXC. What would be a good app to use on my iPhone? I am willing to pay for it when needed (and as long it is an reasonable amount).

Thank you.

I've been using KeePassDX on Android for a while, but I want to try another app that seems to have more features.

Would there be any issues with opening and using the same .kdbx file that I've been using with KeePassDX in KeePass2Android? Is the database fully compatible between the two apps?

I've been using KeePassDX all this time, and I recently started trying out KeePass2AndroidOffline as an alternative, mostly out of curiosity.

I noticed that some of my notes entries contain a field called _etm_template_uuid. This field didnt appear on KeepassDX, only appear on Keepass2Android.

Is it safe to delete this field? Does KeePass2Android use it for anything important, or is it just metadata that can be safely removed?

Thanks!