KeePass Password Safe ReadMe

KeePass Password Safe

KeePass is Copyright (c) 2003/2004 Dominik Reichl. KeePass is OSI Certified Open Source Software. OSI Certified is a certification mark of the Open Source Initiative. For more information see the License page.

Index:
  • Installation and Uninstallation
  • Features Overview
  • Passwords and Key-Disks
  • Security Information
  • Frequently Asked Questions (FAQ)
  • Thanks and Acknowledgements
  • Online Resources
  • License
Feature descriptions:
  • The Auto-Type feature
  • The URL field (capabilities, command-lines, substitutions, etc.)
  • TAN support

Introduction

Today you need to remember many passwords. You need a password for the Windows network logon, your e-mail account, your homepage's ftp password, online passwords (like CodeProject member account), etc. etc. etc. The list is endless. Also, you should use different passwords for each account. Because if you use only one password everywhere and someone gets this password you have a problem... A serious problem. He would have access to your e-mail account, homepage, etc. Unimaginable.

But who can remember all those passwords? Nobody, but KeePass can. KeePass is a free, open-source, light-weight and easy-to-use password safe for Windows.

The program stores your passwords in a highly encrypted database. This database consists of only one file so it can be transferred from one computer to another easily.

KeePass supports password groups, so you can sort your passwords (for example into Windows, Internet, My Homepage, etc.). You can drag-n-drop passwords into other windows. The program can export the database to TXT, HTML, XML or CSV files.

For sure, you can also print the password list or current list view (see groups). Using the context menu of the password list you can quickly copy password or user name to the Windows clipboard. Searching in password database is possible.

KeePass can be translated into other languages very easily (over 20 languages are available already). The program has a strong random password generator (you can define the possible output characters).

And the best: it's free and you have full access to its source code!

KeePass is a Windows application. It has been developed using Microsoft Visual C++ with MFC classes. No .NET framework is required, nor any other special DLLs. So it should run on all Windows operating systems.

KeePass is distributed under a BSD-style license. To sum it up a bit: you can use it freely, modify the source code yourself if you log your changes and don't remove my original header. Because it's free, there is no warranty of any kind. See the file "License.html" in the downloadable KeePass zip package for details.


Installation and Uninstallation

The application doesn't need to be installed. The KeePass development team provides you an installer, which automates creating links in the startmenu etc., but you can alternatively download the binary zip package. The zip package only contains the main executable, which runs fine without installing anything.

KeePass doesn't, in contrast to many other applications, use any functions that require the latest Windows operating system, such like theming on XP or like a .NET application requiring the .NET framework.

KeePass doesn't store anything on your system. The program doesn't create any new registry keys and it doesn't create any initialization files (ini) in your Windows directory. Deleting the KeePass directory (in case you downloaded the binary zip package) or using the uninstaller (in case you downloaded the installer package) leaves no trace of KeePass on your system.


Features

KeePass Password Safe

Here are the "selling points" of KeePass. To get a first impression, you can also have a look at some of the screenshots.
  • Highly encrypted databases
  • Support of master passwords and key-disks
  • Runs on all Windows operating systems and doesn't need to be installed
  • Export password list to TXT, HTML, XML or CSV files
  • Import from CSV, CodeWallet(Pro) TXT and Password Safe v2 TXT files
  • Easy database transfer
  • Support of password groups
  • Time fields support
  • Drag-n-Drop support
  • Fast copy fields to the Windows clipboard
  • Searching and sorting
  • Multi-language translation support
  • Strong random password generator
  • Low memory requirement
  • Open-Source!

Highly encrypted databases
  • KeePass supports the Advanced Encryption Standard (AES) and the Twofish algorithms to encrypt its password databases.
  • Both ciphers are regarded as very secure by the cryptography community. Banks are using these algorithms, too.
  • Even if you would use all computers in the world to attack one database, decrypting it would take longer than the age of the universe.
  • Even quantum computers won't help that much. The algorithms are symmetric so its complexity would be reduced a bit, anyway, the sun will go nova before you have decrypted the database.
  • The complete database is encrypted, not only the password fields. So your usernames, notes, etc. are hidden, too.
  • SHA-256 is used as password hash. SHA-256 is a 256-bit cryptographically secure one-way hash function. Your master password is hashed using this algorithm and its output is used as key for the encryption algorithms (AES and Twofish).
  • SHA-256 is based on the design of SHA-1 (160-bit), its precedessor. No attacks are known against SHA-1 and the SHA-2 familiy (256-, 384- and 512-bits), in contrast to many other algorithms like MD5 or MD4.
  • In-memory protection: your passwords are encrypted while KeePass is running, so even if Windows caches the KeePass process to disk, this wouldn't reveal the passwords anyway.
  • Also see the security information page.

Support of master passwords and key-disks
  • One master password decrypts the complete database.
  • Alternatively you can use key-disks. Key-disks provide better security than master passwords in most cases. You only have to carry the key-file with you, for example on a floppy disk, or you can burn it on CD. Of course, you shouldn't lose this disk then.
  • Also see keys information page.

Runs on all Windows operating systems and doesn't need to be installed
  • KeePass doesn't, in contrast to many other applications, use any functions that require the latest Windows operating system, such like theming on XP or like a .NET application requiring a .NET framework.
  • The application doesn't need to be installed. The KeePass development team provides you an installer which automates creating links in the startmenu etc., but you also can download the binary zip package which contains only the main executable, which runs fine without installing anything.
  • KeePass doesn't store anything on your system. The program doesn't create any new registry keys and it doesn't create any initialization files (ini) in your Windows directory. Deleting the KeePass directory (in case you downloaded the binary zip package) or using the uninstaller (in case you downloaded the installer package) leaves no trace of KeePass on your system.
  • KeePass runs, without downloading any additional libraries, on Windows 95, 98, 98SE, ME, NT, 2000, XP, 2003
  • 1
  • Even a 100% compatible version for the PocketPC is available (visit KeePass PocketPC page).

Export password list to TXT, HTML, XML or CSV files
  • The password list can be exported to various formats like TXT, HTML, XML and CSV.
  • The XML output can be easily used in other applications.
  • The CSV output is fully compatible with most other password safes like the commercial closed-source Password Keeper and the closed-source Password Agent, also the CSVs can be imported in spreadsheet applications like Microsofts Excel or OpenOffice's Calc.
  • The HTML output uses cascading style sheets (CSS) to format the table, so you can easily change the layout.

Import from CSV, CodeWallet(Pro) TXT and Password Safe v2 TXT files
  • KeePass uses the common CSV export format of various passwords safes like Password Keeper and Password Agent. Exports from these programs can be easily imported to your KeePass databases.
  • KeePass can parse and import TXT outputs of CodeWalletPro, a commercial closed-source password safe.
  • KeePass can import TXT files created by Bruce Schneier's Password Safe v2.

Easy database transfer
  • A database consists of only one file that can be transferred from one computer to another easily.

Support of password groups
  • You can create, modify and delete groups, in which passwords can be sorted in.
  • The groups can be arranged as a tree, so a group can have subgroups, those subgroups can have subgroups themselves, etc.
  • Also see this screenshot.

Time fields support
  • KeePass supports time fields: creation time, last modification time, last access time and expiration time.

Drag-n-drop support
  • All fields, title, username, password, URL and notes can be drag-n-dropped into other windows.

Fast copy fields to the Windows clipboard
  • Just double-click on any field to copy it to the Windows clipboard.

Searching and sorting
  • You can search for specific entries in the databases.
  • To sort a password group, just click on one of the column headers in the password list, you can sort by any column.

Multi-language translation support
  • KeePass can be translated into other languages very easily.
  • Currently 12 different languages are available.
  • See the translations page.

Strong random password generator
  • KeePass can generate strong random passwords for you.
  • You can define the possible output characters of the generator (number of characters and type).
  • Random seeding through user input: mouse movement and random keyboard input.

Low memory requirement
  • KeePass uses very few memory, only the memory really needed is allocated.
  • No unnecessary memory- and cpu-consuming things like any animations are used.

Open-Source!
  • KeePass free and you have full access to its source code!
  • Open-Source prevents from backdoors. You can have a look at its source code and compile it yourself.
  • You can yourself check if the security is implemented correctly, you can, if you want, use any other encryption algorithm.
  • Opening the sources also encourages other people to port the application to other systems (PocketPC version already in development) or write translations.
  • KeePass is OSI Certified Open Source Software. OSI Certified is a certification mark of the Open Source Initiative.

1 The Windows logo and "Windows" are trademarks and are copyright © Microsoft Corporation.


Passwords and Key-Disks

KeePass stores your passwords securely in an encrypted database. This database is locked with a master password or key-disk.

If you use a master password you only have to remember one password or passphrase (which should be good then!).

If you lose this master password, all your other passwords in the database are lost too. The database is encrypted based on mathematics and there isn't any backdoor or a key which can open all databases. There is no way of recovering your passwords.

But you don't even have to remember a long, complicated master passphrase. The database can alternatively be locked with a key-disk. A "key-disk" is just a normal disk which holds a file with the password bytes (KeePass can generate such disks for you).

If you lose the key-disk and have no backup copy of the key-file your passwords in the database are lost too, just as when you lose the master passphrase.

If you want to burn a master key CD-ROM select a writable drive (C: D: ?) and generate the master key-file. Burn the file "pwsafe.key" (i.e. C:\pwsafe.key or D:\pwsafe.key) into the root directory of your CD-ROM (i.e. E:\pwsafe.key). You can then insert the key CD-ROM and select the CD-ROM drive in KeePass to load the key from CD-ROM. For sure, you can do the steps above for any writable and readable media, not just CD-ROMs.

So you must decide: either use a really good master password or a key-disk.


Security Information

In this section I will tell you how the databases are encrypted. If you aren't a cryptographer and don't know anything in the security field you won't understand that much. In this case just believe me it's secure ;-)

All databases are encrypted. Currently they are encrypted using the Advanced Encryption Standard (AES/Rijndael), a 128-bit block cipher, using a 256-bit key. I've chosen the CBC block cipher mode. A 128-bit initialization vector (IV) is generated randomly each time you save the database.

In order to generate the 256-bit key for AES the secure hash algorithm SHA-256 (which belongs to the SHA-2 family) is used. The user key (the passphrase the user enters or the binary string in the key-file) plus a random salt is hashed using SHA-256. The random salt is generated randomly each time you save the database and saved in it.

Each time you start KeePass, the program will perform a quick self-test where the AES/Rijndael cipher and the SHA-256 are tested against their correct test vectors.


FAQ

Frequently Asked Questions (FAQ)

  • How can I help you?
  • Multi-user databases
  • Will there be KeePass versions for other OSs than Windows?

How can I help you?

If you like KeePass and would like to help me in some way:
  • Donate
    This is maybe the best way of helping me, if you don't have that much time or experience in application development. This is the recommended way of helping me for "standard users".
  • Make a translation
    If you have some free time, you could make a translation of KeePass (of course only if you're language isn't offered already)!
  • Test new releases and submit bugfixes
    KeePass is under constant development, new features get implemented, bugs get fixed. If you have some free time, you could just test the new releases thoroughly and if you're a programmer, look through the sources to find bugs and maybe even submit fixes.
  • Spread the word
    KeePass isn't that widely-known yet. If you like KeePass, tell all your friends how great KeePass is, publish articles about it, press it on CDs/DVDs, sell it with your USB sticks, submit it to software archives, talk in forums about it, etc.!

Multi-user databases

Implementing a multi-user system for KeePass is a frequent feature request...

All these multi-user / view-only user things are only working if you're using a client-server system, where the user doesn't have full access to the underlying data structures.

For KeePass, a multi-user system would be secure only on the GUI level (since it isn't a client-server application). I could add flags or something like ACLs (access control lists) to prevent/allow users editing/viewing defined sections of a database, but this isn't secure. For normal users (i.e. not programmers and not security experts) the ACLs would work very fine, but anyone who has just a very few bit experience in security can remove those ACLs, if he can read the database.

KeePass is open-source, that means that everyone can get the source code, modify it and recompile it. If it would be only secure on the GUI level, an experienced programmer could just take the KeePass sources, remove all the ACL stuff and would have full access to the database, if he knows the main password.

Since KeePass isn't a client-server application, it's "all or nothing": either you can read and write 100% of the current database or you cannot do anything with it.

So, I will NOT implement those multi-user features. Of course some people would be happy about such features (quote: "I only need it to be secure on a GUI level!"), but soon someone would complain that anyone can modify entries of other users in multi-user databases and KeePass isn't secure. I won't implement such an insecure system.

Some desktop (i.e. not server-client) password manager programs claim to have a working group rights management system, but this just isn't true. They're using ACLs, fine, but this only works on the GUI level and because their product isn't open-source. If you're only USING the program, the multi-user system works. If someone reverse-engineers the file format, he can do anything with the database, just as described above.

Maybe you don't believe me what I'm saying here, since many programs offer multi-user features. In this case, please read the sites below about Excel cell protection security. Protecting certain parts of an Excel file is exactly the same problem as protecting a KeePass database from other users. Even Microsoft says that their cell protections just work for normal users and not on the security level.

Please don't confuse this with other multi-user applications now! Multi-user systems CAN work, but only if the access of a user can really be restricted, for example when you're communicating with some server over the internet. In such a case multi-user systems work perfectly and are also 100% secure. It just doesn't and cannot work with the KeePass desktop application.

Additional reading:
Forum discussion: hierarchical security
Forum discussion: view user and edit user
Microsoft Office Online: Overview of security and protection in Excel
DotXls: Excel Security and Excel Password Protection

Will there be KeePass versions for other OSs than Windows?

The desktop KeePass application has been developed from start on to work on Windows operating systems. It uses the Microsoft Foundation Classes (MFC) and several other platform-dependent stuff that makes porting relatively hard.

Anyway, the KeePass core (i.e. the password management code, simply everything except the graphical user interface [GUI]) is platform-independent and therefor "ports" are theoretically possible, although you cannot really speak of a port here, since the whole user interface needs to be rewritten.

Also, KeePass is written in C++. No chance to convert it to Java to make it platform-independent. If you would like a KeePass written in Java, have fun rewriting it completely from scratch. Although C++ and Java are relatively similar, converting the existing C++ code to Java involves much work, most probably more work than just writing a completely new password manager in Java.

But people can make KeePass "ports", as one can easily see: KeePass for PocketPC. I assume that, when rewriting the GUI code, you can "port" KeePass to almost any platform, since the core password manager code is totally platform-independent.

Now before you ask when the Linux/PalmOS/etc. versions are ready: I don't know. I myself just don't have the time to develop these versions. Keep in mind that I'm developing KeePass in my free time and, apart from donations, don't get anything for it. I will happily develop KeePass for Windows, also in the future yes, but I don't have the time to develop a Linux version for example. I also never programmed any single PalmOS program, I don't even own a PalmOS.

KeePass is Open-Source. If you have the time to develop KeePass-compatible applications (as said, it cannot be really "ported"), feel free to contact me and I will happily support you as good as I can.

Additional reading:
Open Discussion: KeePass for PalmOS...?
Open Discussion: WxWidgets support?


Thanks and Acknowledgements

At this place I want to thank a few people very much for their help, source code, classes and suggestions: (no particular order)
  • Szymon Stefanek - for his C++ implementation of the Rijndael cipher
  • Dr Brian Gladman - for his C implementation of the SHA-2 (256/384/512) hashing algorithms
  • Brent Corkum - for his XP-like menu (BCMenu)
  • Davide Calabro - for his CButtonST class
  • Paul S. Vickery - for his hyperlink edit control
  • Peter Mares - for his side banner window class
  • Simon Wang - for his combobox class
  • Chris Maunder - for his CSystemTray class
  • Hans Dietrich - for his XHyperLink class
  • Daniel Turini - for suggesting "KeePass" as name for the password safe
  • Christopher Bolin - for the nice icons
  • Lallous - for the nice SendKeys engine
  • DonAngel - for creating and maintaining the Bulgarian translation
  • Lubos Stanek - for creating and maintaining the Czech translation
  • Henrik Gregersen - for creating and maintaining the Danish translation
  • Kees Koenders - for creating and maintaining the Dutch translation
  • Andri Viiand - for creating and maintaining the Estonian translation
  • Marc Tissot - for creating and maintaining the French translation
  • Tomer Shalev - for creating and maintaining the Hebrew translation
  • Mauro Rossi - for creating and maintaining the Italian translation
  • Matsumo - for creating and maintaining the Japanese translation
  • Park Dae Beom - for creating and maintaining the Korean translation
  • Jo Chapparal - for creating and maintaining the Norwegian translation
  • Maciej Chojnacki - for creating and maintaining the Polish translation
  • Fabio Negri Cicotti - for creating and maintaining the Portuguese translation
  • Radoslav Bielik - for creating and maintaining the Slovak translation
  • Marcel Trujillo - for creating and maintaining the Spanish translation
  • Michael Åström - for creating and maintaining the Swedish translation
  • Erhan Burhan - for creating and maintaining the Turkish translation
  • The UPX team - for the UPX executable compressor


Online Resources

KeePass Homepage
http://keepass.sourceforge.net/

Support KeePass: Donate
http://sourceforge.net/donate/index.php?group_id=95013

Translations
http://keepass.sourceforge.net/translations.php

Submit a Bug
http://sourceforge.net/tracker/?atid=609908&group_id=95013&func=browse

Submit a Feature Request
http://sourceforge.net/tracker/?atid=609911&group_id=95013&func=browse

KeePass Open Discussion Forum
http://sourceforge.net/forum/forum.php?forum_id=329220

For Developers: The KeePass CVS
http://sourceforge.net/cvs/?group_id=95013


License

KeePass License

KeePass is distributed under the terms of a BSD license:
Copyright (c) 2003/2004, Dominik Reichl
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

- Redistributions of source code must retain the above copyright notice, this
  list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice,
  this list of conditions and the following disclaimer in the documentation
  and/or other materials provided with the distribution.
- Neither the name of ReichlSoft nor the names of its contributors may be
  used to endorse or promote products derived from this software without
  specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.


Auto-Type feature

KeePass offers an "Auto-Type" feature. This feature allows you to define a sequence of keypresses, which the program can automatically perform for you. The default auto-type sequence is:

{USERNAME}{TAB}{PASSWORD}{ENTER}

If you don't define your own auto-type sequence, this sequence is sent. {USERNAME} is replaced by the username field contents of the currently selected entry. {TAB} simulates a TAB keypress, {PASSWORD} enters your password and {ENTER} finally simulates an ENTER keypress.

But you can define your own Auto-Type sequence: simply write the sequence into the notes field of the entry, prefixed with "AutoType:". Your notes could look something like this:

You can write any notes here.
My e-mail I used to register: test@nowhere.com

Auto-Type: {USERNAME}{TAB}{TAB}Some fixed string{TAB}{PASSWORD}{ENTER}

Here you can continue with your notes if you wish...
As you can see, the only important thing is that the auto-type sequence is prefixed using "Auto-Type:" and is one single line. An auto-type sequence cannot be defined using two lines. If you define two auto-type sequences, the first one is used.

KeePass supports the following tags that are automatically substituted by their field contents:

Field | Code
Title field | {TITLE} or %TITLE%
Username field | {USERNAME} or %USERNAME%
URL field | {URL} or %URL%
Password field | {PASSWORD} or %PASSWORD%
Notes field | {NOTES} or %NOTES%

In the example above, {TAB} has been substituted by a TAB keypress. The following codes for special keys are supported:

Special key | Code
Backspace | {BACKSPACE}, {BS} or {BKSP}
Break | {BREAK}
Caps Lock | {CAPSLOCK}
Del or Delete | {DEL} or {DELETE}
End | {END}
Enter | {ENTER}
Esc | {ESC}
Help | {HELP}
Home | {HOME}
Ins or Insert | {INS}
Num Lock | {NUMLOCK}
Scroll lock | {SCROLL}
Page down | {PGDN}
Page up | {PGUP}
Print screen | {PRTSC}
Arrow left | {LEFT}
Arrow right | {RIGHT}
Arrow up | {UP}
Arrow down | {DOWN}
F1 ... F16 | {F1} ... {F16}
Keypad add | {ADD}
Keypad subtract | {SUBTRACT}
Keypad multiply | {MULTIPLY}
Keypad divide | {DIVIDE}
+ | {PLUS}
@ | {AT}
% | {PERCENT}
Apps | {APPS}
^ | {CARET}
~ | {TILDE}
{ } | {LEFTBRACE} {RIGHTBRACE}
( ) | {LEFTPAREN} {RIGHTPAREN}
Windows key left, right | {WINL} {WINR}
Windows key | {WIN} (equ. to WINL)
Windows key | @
Shift | +
Control | ^
Alt | %

Additionally, some special commands are supported:

Command syntax | Action
{VKEY X} | Sends the VKEY of value X.
{BEEP X Y} | Beeps with a frequency of X and a duration of Y milliseconds.
{DELAY X} | Delays X milliseconds.
{DELAY=X} | Sets the default delay to X milliseconds for all following keys.
{APPACTIVATE WindowTitle} | Activates the window "WindowTitle".

Here are some examples:

{DELAY=50}{WIN}{UP}{UP}{UP}{ENTER}notepad{ENTER}
Starts Notepad.

{TITLE}{TAB}{USERNAME}{TAB}{PASSWORD}{ENTER}
Types the title, a tab, the username, a tab and the password of the currently selected item.

{TAB}{PASSWORD}{ENTER}
Presses the tab key, enters the password and presses return.

Thanks and acknowledgements

KeePass uses the CSendKeys engine, which can be found here: http://www.codeproject.com/cpp/sendkeys_cpp_Article.asp. Thanks to Lallous!


Auto-complete URLs feature

URLs Field Capabilities

Index:
  • Standard capabilities
  • Executing command-lines
  • Substitutions

Standard Capabilities

The URL field can execute any valid URL, for which you have defined a protocol handler. On most systems at least the http://, ftp:// and mailto: protocols are defined, but KeePass supports all registered protocols the Internet Explorer supports.

So, if you globally (i.e. using the Windows Explorer) register PuTTY for ssh:// URLs, KeePass will automatically use PuTTY for ssh:// URLs, too. KeePass uses the same settings as the Windows and Internet Explorer does.

Executing command-lines

Instead of an URL, you can also execute command-lines. To tell KeePass that the data you entered is a command-line, prefix it using cmd://. So, if you would like to execute Notepad, your URL could look like this:

cmd://C:\WinNT\Notepad.exe C:\Test\MyTestFile.txt

The virtual cmd:// protocol also supports parameters for executed applications, in contrast to the file:// protocol. This was the main reason why cmd:// was introduced, with file:// you aren't able to pass any parameters to started applications.

Substitutions

In the URL field, you can use several special strings that will get automatically replaced when the URL is executed. An example:

http://www.yoursite.com/default.php?user=%USERNAME%&pass=%PASSWORD%

For this entry, KeePass will replace %USERNAME% by the data of the username field and %PASSWORD% by the data in the password field when you execute the link.

The following substitutions are available:

Field | Code
Title field | {TITLE} or %TITLE%
Username field | {USERNAME} or %USERNAME%
URL field | {URL} or %URL%
Password field | {PASSWORD} or %PASSWORD%
Notes field | {NOTES} or %NOTES%


TAN support

KeePass supports TANs, i.e. passwords of a special form (only alphanumerical characters are allowed) that can be used only once. TAN entries are marked as expired when you use the "Copy Password" command on them.

These special passwords are mostly used by banks. For some banks, you need to confirm a transaction using such a TAN, this avoids several security problems and is a pretty secure system.

You can use the KeePass TAN Wizard to add several TANs at once to your database. Just open the TAN wizard dialog (menu Extras - TAN Wizard) and enter all your TANs. The formatting doesn't really matter, KeePass just uses all alphanumerical characters, i.e. characters like newlines, tabs, spaces, dots, etc. are used as separators.

The wizard will then generate several TAN entries from the data you entered into the dialog. Each TAN consists of a standard KeePass entry. The title of a TAN entry is always "<TAN>". This tells KeePass that the entry is a TAN entry, you cannot change the title, username or URL of a TAN (doesn't make sense).

When you use the TAN (i.e. execute the "Copy Password" command on it), its expiration date will be set to the current time, which expires the entry. It will get a red X as icon. If you later want to know when you used a specific TAN, you can just have a look at its expiration date.