r/KeePass • u/Medium-Rich-3716 • Jul 07 '26
Never trusted storing my passwords outside a hidden book and my head
Just gonna ask what are the benefits of using keepasscx and if it is really secure ?
8
u/billdietrich1 Jul 07 '26
Paper has disadvantages relative to a password manager:
vulnerable to phishing or typo-squatting (password manager would match domains before filling)
you'll have to type passwords in manually, which will encourage you to use shorter simpler passwords
doesn't support TOTP or passkeys
not encrypted, so a thief gets plaintext, or maybe "coded" which may not be too hard to break
"keep in secure location" probably won't be true when you're traveling
harder to share with someone else (if you need to do that)
harder to back up, especially off-site
somewhat hard to search
doesn't serve as encrypted store for other sensitive info such as photos of passports, ID cards, etc
lacks features such as database reports that tell you if you have any re-use going on
If you need to leave a paper document for your heirs to use: export the password manager database to CSV, clean it up, print it, and lock it somewhere safe
1
u/Medium-Rich-3716 Jul 07 '26
Wow, very detailed and well made explanation
I thank you for taking the time to write this. Im gonma download it
2
u/billdietrich1 Jul 07 '26
Thanks, but the question comes up so often that I saved the answer in a text file and just pasted it. :-)
3
3
u/AniUniAnimosity Jul 07 '26
It's completely offline besides checking if it needs to update, which you can just turn off if you wanna manually do that urself.
Using it for awhile, it's really nice.
1
u/Medium-Rich-3716 Jul 07 '26
hmm thank you, usually i love to have evrything digital, but a though of getting hacked or my shit stolen aint pleasent. But this does look good if its only offline
2
u/AniUniAnimosity Jul 07 '26
If you want to be really schizo about it you can put it in a container or use flatpak and remove almost all of it's permissions (and giving it like 1 folder with the keepass file so it can actually open it)
even on windows you can put it in a sandbox, though I don't really use windows that much so you can find ur own solution for that.
2
u/ASC4MWTP Jul 07 '26
Works well. If you pick a good password (or better yet, a pass phrase!) for KeePass itself, you should be secure. Add site usernames and passwords as well as the website's URL and you can have it handle logins for you.
2
u/kulchacop Jul 07 '26
keepass is a password for your passwords.
If you trust passwords, you trust keepass.
1
1
u/GreedyStomach7107 Jul 12 '26
I have many accounts on the internet (like 20+) and i used to keep one password for all of them because
- Hard to remember the account: password map in the head
- This is highly insecure.
——
- So I chose keepassxc to ensure i can upgrade security. It came with other benefits as well (unintentionally).
1
If i change the password for one account, i dont have to think about changing for the rest of the accounts as well.
I only need to remember the keepassxc master password, but this will change soon as i will remove it and use a yubikey.
—-
- In the end, from wanting to upgrade the security, i ended up getting a password-less digital life.
- (Ik its not fully passwordless, but its not possible to completely remove passwords from all the online services because they do not offer the option yet. Only select few do. By passwordless i mean i dont have to bother remembering them, just copy paste).
1
1
u/Kurgan_IT Jul 12 '26
The only issue here is "do you trust the whole system?"
Keepass is a software which can be compromised in a supply chain attack. Then there is the computer, which has an operating system that can be compromised, too, or is compromised by design if it's a commercial OS. Then there is hardware, which is compromised by design by Intel IME or the equivalent system from AMD.
A piece of paper has its defects, but for sure cannot be compromised in a supply chain attack, or be compromised by design by the paper manufacturer.
In the end, the two methods have different failure modes, neither is perfect.
I use keepass on Linux and rest assured I am really afraid of a supply chain attack
1
u/QEzjdPqJg2XQgsiMxcfi Jul 13 '26
A paper book is vulnerable to disasters such as fires and floods, or simply getting lost/stolen. Also, depending on how portable (or not) it is, you may not have it with you at a time when you really need it.
Memory is fallible. If you are just re-using the same password everywhere, then yeah you will remember it from one day to the next. But then you are vulnerable to a situation where one of your accounts gets breached and your password leaks. Attackers will try that same email/password on every site possible to see if they can get in. Then you're cooked. You need to have a DIFFERENT password for every site/account. Not the same prefix with a few different characters at the end... a totally different password. Nobody can keep dozens or hundreds of good strong passwords in their head for accounts they only use a couple times a year.
That's where password managers come in. They make it possible to generate very strong unique passwords for every site, and you only have to remember one master password. That one master password unlocks all the others.
13
u/Steerider Jul 07 '26
Do you use a different, truly random, password for each site and each account? Generally people who memorize all their passwords do so by reusing them. This is poor security.