KeePassXC is a password manager. It stores your passwords in one file, encrypted with AES-256, the standard used by banks and governments. A strong master password makes that file impractical to brute-force.
It's also free and open source, with no subscription or account required.
What You Need
- The KeePassXC desktop app
- A cloud storage folder (optional, for syncing across devices)
- A browser extension (optional, for autofill)
- A phone app (optional, for mobile usage)
Step 1: Create Your Database
Open KeePassXC. Click Create new database.
Set a strong, unique master password. It protects every entry in the file.
Save the database wherever you like.
To add your first entry, click the green plus icon. Fill in whatever fields you'd like and click ok to save it.
If you would like to generate a new password click the dice icon next to the password field. The password generator is very strong and has many options to ensure the generated password meets the requirements of the app or website you are using.
If you already have passwords saved in your browser, import them instead of re-entering each one. Export them from your browser as a CSV file, then go to Database > Import > CSV File in KeePassXC and point it at that export.
Step 2: Sync the File Across Devices
Your .kdbx file is your database. There are a few ways to keep it in sync across devices.
- Syncthing. A free, open-source tool that syncs the file directly between your devices, with no cloud provider in between.
- Cloud storage. Dropbox, Google Drive, OneDrive, or similar. This is safe, since the file stays encrypted the whole time. The cloud provider only ever sees a locked database, not your passwords.
- USB drive. Carry a USB drive between devices and open the database from it. No software to set up, but you have to remember to bring the drive.
- Manual copying. Copy the file over by hand whenever it changes. Simple, but tedious if you update passwords often.
Pick whichever fits how you use your devices. KeePassXC works the same either way, once the file is there.
Step 3: Install the Browser Extension
KeePassXC can fill in usernames and passwords on websites. Install the KeePassXC browser extension from your browser's extension store, then turn on browser integration in the desktop app: go to Tools > Settings > Browser Integration, and check the box for your browser.
Open your database, then visit a login page. Click the extension icon and select Connect. KeePassXC asks you to confirm, inside the desktop app. This happens once per browser.
After that, autofill is one click: open the extension icon, select the entry. If your database is locked, KeePassXC prompts you to unlock it first.
The extension also generates passwords, right on sign-up forms. Click the KeePassXC icon inside a new password field, and it offers a random password and saves it as a new entry.
Step 4: Use KeePassXC on Your Phone
The KeePassXC team doesn't make a phone app. Instead, several third-party apps read the same .kdbx file.
On iOS, use KeePassium. Install it from the App Store, then point it at your .kdbx file.
On Android, use KeePassDX. Install it from the Play Store, then point it at the same file.
Step 5: Think Twice About Storing 2FA Codes
KeePassXC can generate TOTP codes, the six-digit codes used for two-factor authentication on other sites. You can store a site's TOTP secret right in the same entry as its password.
I don't recommend this. Two-factor authentication works by combining two separate things: something you know, like a password, and something you have, like a code from your phone. Store both inside the same database, and a stolen file hands over both at once. That single point of failure defeats the reason 2FA exists in the first place.
Non-Password Uses
KeePassXC stores more than passwords, with extra fields, notes, and attachment space on each entry. Use it for backup codes, license keys, PINs, and other sensitive text you'd otherwise leave scattered around.
Closing Thoughts
KeePassXC covers everything a password manager needs to: strong encryption, browser autofill, and access from your phone. It does all of that for free, with no subscription and no account tied to a company's server.