Help Center - KeePass

KeePass Password Safe

KeePass: Copyright © 2003-2010 Dominik Reichl. The program is OSI Certified Open Source Software. OSI Certified is a certification mark of the Open Source Initiative. For more information see the License page.

Introduction

Today you need to remember many passwords. You need a password for the Windows network logon, your e-mail account, your homepage's FTP password, online passwords (like website member account), etc. etc. etc. The list is endless. Also, you should use different passwords for each account. Because if you use only one password everywhere and someone gets this password you have a problem... A serious problem. He would have access to your e-mail account, homepage, etc. Unimaginable.

But who can remember all those passwords? Nobody, but KeePass can. KeePass is a free, open source, light-weight and easy-to-use password manager for Windows.

The program stores your passwords in a highly encrypted database. This database consists of only one file, so it can be easily transferred from one computer to another.

KeePass supports password groups, you can sort your passwords (for example into Windows, Internet, My Homepage, etc.). You can drag&drop passwords into other windows. The powerful auto-type feature will type user names and passwords for you into other windows. The program can export the database to various formats. It can also import data from various other formats (more than 20 different formats of other password managers, a generic CSV importer, ...).

Of course, you can also print the password list or current view. Using the context menu of the password list you can quickly copy password or user name to the Windows clipboard. Searching in password database is possible.

The program ships with a strong random password generator (you can define the possible output characters, length, generation rules, etc.).

The program features a plugin architecture. Other people can write plugins for KeePass, extending its functionality: support for even more data import/export formats, backup features, network features, etc. See the plugins page on the KeePass homepage for downloadable plugins and an introduction on how to write your own plugins.

And the best: it's free and you have full access to its source code!

KeePass is distributed under the GPL license. See the file 'License.txt' in the downloadable KeePass package for details.

This documentation applies to KeePass 2.x.


First Steps Tutorial - KeePass

Help

First Steps Tutorial

A short tutorial showing you the basic usage of KeePass.

This short tutorial will show you how to actually use KeePass. It describes only the basic usage, advanced features are covered on separate pages.

Creating a new database

The very first step is creating a new password database. KeePass will store all your passwords in such a database. To create one, click 'File - New...' in the main menu or click the leftmost toolbar button. A window will appear, which prompts you for a master password and/or key file. The database will be encrypted with the password you enter here. The password you enter here will be the only password you'll ever have to remember from on now. It should be long and built up of mixed characters. Keep in mind that when someone gets your database file and guesses the password, he could access all passwords you stored in the database.

For this tutorial, we'll just use a password, not a key file. Click into the password edit field and enter a password of your choice. The password edit control isn't limited in length, so feel free to even enter a whole sentence (just keep in mind that you'll need to remember it).

After clicking [OK], a second dialog appears. In this dialog you can configure some generic database properties. For now, just leave everything as it is and click [OK].

Now you see the main window. On the left, you see the entry groups. On the right, you see the actual password entries. The password entries are grouped together into the password groups you see on the left. So, depending on which group on the left you selected, it'll show you the entries in this group in the right view. KeePass has created a few default groups for you, but you're totally free to delete them and create your own ones.

Adding an entry

Time to store your very first password in the KeePass database! Right-click into the right password entry view and choose 'Add Entry...'. A window will pop up. In this window you can now edit your entry: enter some title for it, an username, an URL, the actual password, etc. If you don't need some of the fields, just leave them empty. When you're done, click [OK].

You'll see your new entry in the password list on the right now.

Using entries

You got the new entry in the password list now. What can you actually do with it now? Right-click onto the entry.

You have several options now. You can for example copy the username of the entry to the Windows clipboard. When you've copied it, you can post it into any other program of your choice. The same works for copying passwords.

Alternatively, you can drag&drop fields into other windows. To see an example of how this works, see this page: Drag&Dropping Fields.

KeePass can open the URL you specified. To do this, just click 'URL(s) - Open URL(s)' in the context menu. KeePass will start the default browser and open the specified URL.

Saving the database

It's time to save our database. Click onto the 'Save' toolbar button (looks like a disk; 3rd toolbar button). As you're saving the database the first time, you now have to specify a location where you want the database file to be stored.

More

That's it! You've made the first steps in using KeePass! You can now have a look at the more advanced features of KeePass.

Passwords and Key Files: In the tutorial above we've encrypted the database using a password. But KeePass also supports key files, i.e. you can lock your database using a file (which you can carry around on your USB stick for example). It even supports combining those two methods for maximum security.

TAN Entries: TAN entries are one-time passwords. Many banks are using TANs for better security. KeePass supports TAN entries, by making them expire automatically when using them.

Auto-Type: The auto-typing functionality is a very powerful feature. In the tutorial above you've copied the username and password of an entry to the clipboard. Wouldn't it be nice if KeePass would just type those strings for you into other windows? Wouldn't it be nice if you could define whole sequences of keypresses that KeePass should type for you? That's exactly what the Auto-Typing feature does: it sends simulated keypresses for you to other windows!

URL Field Capabilities: The URL field supports URLs of course. In the tutorial, you've learned that you can enter simple URLs into this field and KeePass will open the browser window for you. But the URL field can do more! It actually supports many different protocols (not just http) and supports executing Windows command lines through the cmd:// virtual protocol. The field also features a powerful substitution engine, replacing codes by other fields (username, password, ...) of this entry.

Command Line Capabilities: You can open .kdb files by passing the filename to the KeePass executable file. But did you know that you can also send the password for the database and key file location over the command line? You can also use the command line to pre-select a key file for you.

Plugins: KeePass features a powerful plugin architecture. If you miss some functionality, have a look at the plugins page to see if there are other people that have already written plugins for this. Many plugins exist to import/export data from/to other file formats.


Acknowledgements - KeePass

Help

Acknowledgements / Credits

Thanks to various people for contributions and/or work.

At this place I want to thank a lot of people very much for their help, source code, suggestions and other contributions (in no particular order).

  • Donation Acknowledgements
  • Source Code Acknowledgements
  • Translation Acknowledgements
  • Plugin Acknowledgements
  • Tools Acknowledgements
  • Hosting/Distribution Acknowledgements
  • Suggestions and Forum Support Acknowledgements
  • Special Acknowledgements
  • Icons Acknowledgements

Info Donation Acknowledgements

Developing high-quality applications takes much time and resources. Donations make it possible to keep up the current development standard. Therefore, thanks a lot to all who donated to the project.

More information about donations and a list of people who donated can be found here: KeePass Donations.

Info Source Code Acknowledgements

KeePass uses a lot of classes and libraries written by different people and given away for free. Here I want to thank them for writing these classes and libraries.

Author | Class / Library
Szymon Stefanek | C++ implementation of the AES/Rijndael encryption algorithm.
Brian Gladman | C implementation of the SHA-2 (256/384/512) hashing algorithms.
Brent Corkum | MFC class for XP-style menu (BCMenu).
Davide Calabro | MFC class for buttons with icons (CButtonST).
Peter Mares | MFC class for window side banners (CKCSideBannerWnd).
Chris Maunder | MFC class for system tray icons (CSystemTray).
Hans Dietrich | MFC class for hyperlinks in dialogs (XHyperLink).
PJ Naughter | MFC classes for checking for single instance and version information (CSingleInstance, CVersionInfo).
Lallous | Class for sending simulated keystrokes to other applications (CSendKeys).
Jarrod Nelson | Class for computing SHA-256 hashes (NetSHA.SHA256).
Mike Krueger, John Reilly | Library to handle GZip files (SharpZipLib).

Info Translation Acknowledgements

Thanks a lot to all people who created translations for KeePass (see translations page).

Info Plugin Acknowledgements

Very many thanks to all people who wrote plugins for KeePass (see plugins page). Without you, KeePass would be a lot less powerful and useful!

Info Tools Acknowledgements

Thanks to the UPX Team for the writing the Ultimate Packer for eXecutables (UPX). This tool is used to compress the final KeePass executables, in order to create a smaller distribution and making KeePass start up faster.

Thanks to Jordan Russell for creating Inno Setup. This tool is used to create the nice KeePass installation program.

Info Hosting/Distribution Acknowledgements

SourceForge | Thanks to SourceForge.net for hosting the KeePass downloads / translations / plugins and for providing the project support platform (forums, feature requests / bug trackers, ...) for free.
domain)FACTORY | Thanks to domain)FACTORY for hosting the KeePass website.
Datensysteme Lenk | Thanks to datensysteme-lenk for hosting the German KeePass support forum in the past.

Info Suggestions and Forum Support Acknowledgements

Thanks to all the people answering questions of others in the KeePass forums! A product is only as good as its support is, and I alone could never provide such an excellent individual help platform.

Two persons should be mentioned here, because of an extraordinary amount of suggestions (features, bug reports, ...) and helping others in the forums: Paul Tannard and Michael Scheer.

Info Special Acknowledgements

Thanks to Daniel Turini for suggesting "KeePass" as the name of the project.

An especially big thanks to Bill Rubin. He not only contributed a lot of source code to KeePass, he also had an enormous amount of feature and improvement suggestions, helped people in the KeePass forums, and wrote a KeePass plugin for backing up databases. He's also the reason why many of the sections in the KeePass Help are very precise, helpful, clear and easy to understand. In our countless hours long IM chats, we not only discussed much about the design of KeePass, Bill also told me a lot about C++ and other stuff. Thanks!

Info Icons Acknowledgements

Thanks a lot to Christopher Bolin for creating the main KeePass icon (see top left on this page) and its variations.

Thanks to David Vignoni for creating the nice 'Nuvola' icon theme. Most of the icons used in KeePass and on its website are icons of this theme. You can find the original images on the homepage of the author. Usage of the icons is allowed under the terms of the LGPL license (which you can find here: GNU Lesser General Public License), plus an addition. The original distribution notice can be found here: 'Nuvola' Icon Theme License.


License - KeePass

System

KeePass 2.x License

License terms of KeePass 2.x.

KeePass: Copyright © 2003-2010 Dominik Reichl.

The program is distributed under the terms of the GNU General Public License version 2 or later. The complete source code can be obtained from the Official KeePass Website.

GNU General Public License (copy from http://www.gnu.org/licenses/gpl.html):

GNU GENERAL PUBLIC LICENSE

Version 2, June 1991

Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA

Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble

The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.

To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it.

For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.

We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software.

Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations.

Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.

The precise terms and conditions for copying, distribution and modification follow.

TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you".

Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does.

1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.

You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.

2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:

a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.
c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program.

In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.

3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code.

4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.

7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program.

If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances.

It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.

This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.

8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.

9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.

10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.

NO WARRANTY

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

END OF TERMS AND CONDITIONS

How to Apply These Terms to Your New Programs

If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.

To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.

one line to give the program's name and an idea of what it does.
Copyright (C) yyyy  name of author

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

Also add information on how to contact you by electronic and paper mail.

If the program is interactive, make it output a short notice like this when it starts in an interactive mode:

Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details
type `show w'.  This is free software, and you are welcome
to redistribute it under certain conditions; type `show c'
for details.

The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program.

You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names:

Yoyodyne, Inc., hereby disclaims all copyright
interest in the program `Gnomovision'
(which makes passes at compilers) written
by James Hacker.

signature of Ty Coon, 1 April 1989
Ty Coon, President of Vice

This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License.

End GNU General Public License

Icon Theme

The icon theme used in KeePass has been created and is copyrighted by David Vignoni. For more information, see the Acknowledgements page.


Setup - KeePass

System

Installation / Portability

KeePass 2.x installation, uninstallation, portability and updates.
  • General information
  • Installer program (KeePass-2.xx-Setup.exe file)
  • Portable version (KeePass-2.xx.zip file)
  • Running KeePass under Mono (Linux, Mac OS X, BSD, ...)

Setup General information

When downloading KeePass, you have the choice between 3 different packages:

  • KeePass-2.xx-Setup.exe: An installer program for Windows.
  • KeePass-2.xx.zip: A KeePass ZIP package (portable version).
  • KeePass-2.xx-Source.zip: The source code.

The installer and the portable version are described in detail below.

The source code package contains everything you need to compile KeePass. It includes the C#/C++ source code and header files, resource files, sources for building the installer, etc.

Both installed and portable KeePass versions require a .NET framework, see the downloads page for details.

Updating KeePass:
When a new KeePass version has been released, you can update your existing KeePass installation, without losing any configuration settings. The steps are depending on which package you are using (installer or portable), see below.

Translations should also be updated when you install a new KeePass version. You can find the latest translation files here: KeePass Translations.

Setup Installer program (KeePass-2.xx-Setup.exe file)

The KeePass development team provides an installer, which copies KeePass to your hard disk, creates shortcuts in the start menu and associates KDBX files with KeePass, if desired.

Additionally, KeePass is automatically configured to store its settings in the application data directory of the current user. This way multiple users can use one KeePass installation without overwriting each other's settings (each user has his own configuration file). The setup program must run with administrative rights, however KeePass runs fine without administrative rights once it is installed.

Installation:
To install KeePass, run the KeePass-2.xx-Setup.exe file and follow the wizard.

Updating:
Run the KeePass-2.xx-Setup.exe file. You do not need to uninstall the old version first. Your configuration options will not be lost.

Uninstallation:
In order to uninstall KeePass, run the uninstallation program, which is accessible by a shortcut in the start menu folder of KeePass, or in the program section of the system control panel. If you also want to remove your configuration settings, you need to delete the configuration file in the application data directory of your user profile, see Configuration.

Silent Installation:
The KeePass installer KeePass-2.xx-Setup.exe supports command line switches for silent installation, i.e. the program gets installed without asking the user for target directory or association options. The default settings of the installer are used.

The /SILENT command line switch performs a silent installation and shows a status dialog during the setup process. No questions will be asked though.

The /VERYSILENT command line switch performs a silent installation and does not show a status dialog during the setup process.

Setup Portable version (KeePass-2.xx.zip file)

The portable version can be carried around on portable devices (like USB sticks) and runs on any computer directly from the device, without any installation (provided that a .NET framework is installed). It doesn't store anything on your system (in contrast to the setup package, see above). KeePass doesn't create any new registry keys and it doesn't create any configuration files in your Windows or application data directory of your user profile.

Make sure that KeePass has write access to its application directory. Otherwise, if it doesn't have, it'll attempt to store the configuration options (nothing security-relevant though) into the application data directory of the currently logged on user. For more about that, see this page: Configuration.

Installation:
KeePass does not need to be installed. Just download the ZIP package, unpack it with your favorite ZIP program and KeePass is ready to be used. Copy it to a location of your choice (for example onto your USB stick); no additional configuration or installation is needed.

Updating:
Download the latest portable package of KeePass, unpack it and copy all new files over the old ones. Your configuration settings will not be lost (the settings are stored in the KeePass.config.xml file, which won't be overwritten, because KeePass ZIP packages don't include a KeePass.config.xml file).

Uninstallation:
Simply delete the KeePass folder. This will leave no trace of KeePass on your system.

Setup Running KeePass under Mono (Linux, Mac OS X, BSD, ...)

In addition to Windows, KeePass 2.x runs fine under Mono, i.e. Linux, Mac OS X, BSD, etc. In order to run KeePass, follow these steps:

  1. Install Mono ≥ 2.6 (older versions will not work and are not supported). Depending on your platform, the packages to install are called mono-stable, MonoFramework, mono-devel or mono-2.0-devel; see the Mono project page, if you are unsure which packages to install. On some platforms, the Windows Forms implementation (System.Windows.Forms) is offered as a separate package; KeePass requires this package, so if you see one, install it, too.
  2. If you want to use auto-type on Linux / Mac OS X / BSD / etc., you additionally need the xdotool package.
  3. Download the portable version of KeePass (file KeePass-2.xx.zip) and unpack it in a location of your choice.
  4. When being in the KeePass directory, run the command line "mono KeePass.exe". Alternatively, right-click onto the KeePass.exe file, choose "Open with Other Application" and type in mono as custom command.

For the last step you might want to create a shortcut or shell script file with this command line (use an absolute path to KeePass.exe, if the shortcut / shell script file is in a different location).

Global Auto-Type:
In order to use global auto-type, you need to create an appropriate system-wide hot key. This only needs to be done manually once. KeePass performs global auto-type when it's invoked with the --auto-type command line option.

For example, to create a system-wide hot key for global auto-type on Ubuntu Linux, follow these steps:

  1. Press Alt-F2, enter gconf-editor and click [OK].
  2. Navigate to apps -> metacity -> keybinding_commands.
  3. Double-click one of the command_i items, enter
    mono /YourPathToKeePass/KeePass.exe --auto-type
    and click [OK].
  4. Click the global_keybindings node on the left.
  5. Double-click the appropriate run_command_i item (for example, when you've used command_5 in the previous steps, double-click run_command_5 now) and specify the hot key of your choice. For example, to use Ctrl-Alt-A as hot key, you'd enter <Control><Alt>a.

Important: for global auto-type, the version of the xdotool package must be 2.20100818.3004 or higher! If your distribution only offers an older version, you can download and install the latest version of the package manually, see the xdotool website.


Translations - KeePass

Language

Installing Translations

How to install translations of KeePass 2.x.
  • Installing User Interface Translations
  • Additional Localized Content

Text Installing User Interface Translations

To install a user interface translation, follow these steps:

  1. Download the translation file from the Translations page.
  2. Unpack the ZIP archive you just downloaded to some directory.
  3. Copy the <Language>.lngx file into the KeePass application directory (where KeePass.exe is located).
  4. Start KeePass. In the main menu, click 'View' - 'Change Language...'. In the dialog that opens, select your language. In the restarting prompt, click [Yes].

That's it! The user interface is now translated completely into your language!

Text Additional Localized Content

For some languages (not for all) there is additional localized content available, like translated help files, tutorials, etc. All this content is available from the same page where the user interface translations are downloadable: Translations page.

If you'd like to create some translated content yourself, please first ask the KeePass team if the thing you're planning to create isn't in work already by someone else. If not, you'll make a lot of people very happy by creating translated content!


Plugins - KeePass

Settings

KeePass 2.x Plugins

Installation, uninstallation and security of KeePass plugins.

Plugin Introduction

KeePass features a plugin framework. Plugins can provide additional functionality, like support of more file formats for import/export, network functionalities, backup features, etc.

Info Online Resources

You can download the latest KeePass plugins (and their source code) from http://keepass.info/plugins.html.

Computer Plugin Installation and Uninstallation

If the plugin doesn't provide explicit instructions how to install it, follow these steps:

  1. Download the plugin from the page above and unpack the ZIP file to a directory of your choice.
  2. Copy the unpacked plugin files into the KeePass directory (where the KeePass.exe is) or a subdirectory of it.
  3. Restart KeePass in order to load the new plugin.

In other words, to "install" a plugin you simply need to copy it somewhere into the KeePass directory.

To "uninstall" a plugin, delete the plugin files.

Locked Security

What about the security of plugins? Can't malicious spyware plugins 'inject' themselves into KeePass?

If plugins can register themselves (i.e. have write access to the KeePass directory), they could also just replace the whole KeePass.exe. It's rather a problem of file access rights, not the plugin system.

If you worry about this, you can do the following:

  1. Install KeePass as administrator.
  2. Write-protect the KeePass directory. Nobody must have write access.
  3. Log on as normal user (with no administrator privileges).

This will solve the problem above. Since the KeePass directory is write-protected, no other program can copy files into it. KeePass requires the plugins to be in the application directory. Therefore, plugins cannot inject themselves anymore.

Computer Plugin Cache

PLGX plugins are compiled and stored in a plugin cache directory on the user's system. This cache highly improves the startup performance of KeePass. Old files are normally deleted from the cache automatically (this can be disabled in the plugins dialog).

By default, the plugin cache is located in the user's application data directory. However, this can be overridden using the Application/PluginCachePath setting in the configuration file (this setting supports placeholders and environment variables). So, if you're for example using KeePass on a portable device and don't want the cache to be on the system, you could set the path to {APPDIR}\PluginCache.


Compatibility - KeePass

System

Compatibility

Compatibility of KeePass editions.

KDBX files created by KeePass 2.x and KDB files created by KeePass 1.x are not compatible. KeePass 2.x supports a lot of features, which 1.x doesn't support, therefore these formats are incompatible.

But KeePass 2.x can import KDB files created by KeePass 1.x. For this, you need first need to create a new database in KeePass 2.x and import the 1.x database using 'File' -> 'Import'.

By 'File' -> 'Export', KeePass 2.x can also export data to 1.x KDB files. However note that not all 2.x fields are supported by 1.x (i.e. the export is lossy).


Security - KeePass

Locked

Security

Detailed information about the security of KeePass.

  • Database Encryption
  • Hashing and Key Derivation
  • Random Number Generation
  • Protection against Dictionary Attacks
  • Process Memory Protection
  • Locking the Workspace
  • Plugins
  • Self-Tests
  • Specialized Spyware
  • References

Key Database Encryption

KeePass database files are encrypted. KeePass encrypts the complete database, i.e. not only your passwords. The user names, notes, etc. are encrypted, too.

Databases are encrypted using one of the following block ciphers:

Cipher | Block Size | Key Size
Advanced Encryption Standard (AES / Rijndael) | 128 bits | 256 bits
Twofish | 128 bits | 256 bits

These algorithms are well-known, analyzed thoroughly and considered to be very secure by the cryptographic community (see [1] for comments by the NIST on AES for example).

KeePass 2.x doesn't support Twofish, but additional encryption algorithms can be provided by plugins.

The block ciphers are used in the CBC (cipher-block chaining) block cipher mode. In CBC mode, plaintext patterns are concealed.

For both algorithms, a 128-bit initialization vector (IV) is generated randomly each time you save the database. This allows multiple databases to be encrypted using the same key without observable patterns being revealed.

Key Hashing and Key Derivation

In order to generate the 256-bit key for the block ciphers, the Secure Hash Algorithm SHA-256 is used. This algorithm compresses the user key provided by the user (consisting of password and/or key file) to a fixed-size key of 256 bits. This transformation is one-way, i.e. it is computationally infeasible to invert the hash function or find a second message that compresses to the same hash.

The recently discovered attack against SHA-1 [2] doesn't affect the security of SHA-256. SHA-256 is still considered as being very secure [3].

Key Derivation:
If only a password is used (i.e. no key file), the password plus a 128-bit random salt are hashed using SHA-256 to form the final key (but note there is some preprocessing: Protection against Dictionary Attacks). The random salt prevents attacks that are based on pre-computed hashes.

When using both password and key file, the final key is derived as follows: SHA-256(SHA-256(password), key file contents), i.e. the hash of the master password is concatenated with the key file bytes and the resulting byte string is hashed with SHA-256 again. If the key file doesn't contain exactly 32 bytes (256 bits), they are hashed with SHA-256, too, to form a 256-bit key. The formula above then changes to: SHA-256(SHA-256(password), SHA-256(key file contents)).

Binary Random Number Generation

KeePass needs to generate several random bytes (for the IV, the master key salt, etc.). For this, several pseudo-random sources are used: current tick count, performance counter, system date/time, mouse cursor position, memory status (free virtual memory, etc.), active window, clipboard owner, various process and thread IDs, various window handles (active window, desktop, ...), window message stack, process heap status, process startup information and several system information structures. Additionally, KeePass uses random bytes provided by the system's default CSP RNG.

This pseudo-random data is collected in a random pool. To generate 16 random bytes, the pool is hashed (SHA-256) with a counter. The counter is increased after 16 generated bytes. This way, as many secure random bytes can be produced efficiently as needed.

Key Protection against Dictionary Attacks

KeePass supports a protection against guessing and dictionary attacks.

You can't really prevent these attacks: nothing prevents an attacker to just try all possible keys and look if the database decrypts. But what we can do (and KeePass does) is to make it harder: by adding a constant work factor to the key initialization, we can make them as hard as we want.

To generate the final 256-bit key that is used for the block cipher, KeePass first hashes the user's password using SHA-256, encrypts the result N times using the Advanced Encryption Standard (AES) algorithm (called key transformation rounds from on now), and then hashes it again using SHA-256. For AES, a random 256-bit key is used, which is stored in the database file. As the AES transformations aren't pre-computable (key is random), an attacker has to perform all the encryptions, too, otherwise he cannot try and see if the current key is correct.

An attacker now needs much more time to try a key. If he can only try a few keys per second, a dictionary attack is not practical anymore. N is a work factor, only indirectly a time factor. A super computer can try a key a lot faster than a standard PC, but anyway testing one key with N transformation rounds will take N times longer than trying a key with no transformation rounds on the super computer.

By default, KeePass sets N to 6000 encryption rounds (full encryptions are meant; N has nothing to do with the internal encryption rounds of AES). This number has been chosen in order to provide compatibility with portable device versions (PocketPC processors are slower, therefore the key computation takes longer).

If you are using KeePass on PC only, it is highly recommended to increase the number of key transformation rounds. You can change the number in the database options dialog. Right of the field for the rounds, you'll find a button. When clicking this button, KeePass computes the rounds number that leads to a 1-second delay. Waiting 1 second at database opening isn't a problem, but for an attacker of course it is. But, the number can be freely set to a number of your choice; the button only should give you a rough idea how many rounds can be computed in 1 second on your computer.

This protection feature is only useful for master passwords; key files are random anyway, there's no need to transform the key file contents. Guessing the key file contents is equally hard to a brute-force attack on the final key.

KeePass uses multi-threading to compute the transformations (the master key is split up to two parts of 128 bits, which is the AES block size). On dual/multi core processors, the computation can be twice as fast as on a single core processor.

On Windows Vista and higher, KeePass can use Windows' CNG/BCrypt API for the key transformations, which is about 50% faster than the KeePass built-in key transformation code.

KeePassX: In contrast to KeePass, the Linux port project 'KeePassX' only partially supports protection against dictionary and guessing attacks.

Application Protection Process Memory Protection

While KeePass is running, sensitive data (like the hash of the master key and entry passwords) is stored encrypted in process memory.

This means that even if you would dump the KeePass process memory to disk, you couldn't find the passwords.

By default, entry passwords are in-memory protected, the other fields not (like in 1.x). However, you can turn on in-memory protection for other fields in the database settings dialog (not recommended though, because of performance reasons).

For example, when you are copying a password to the clipboard, KeePass first decrypts the password field, copies it to the clipboard and immediately re-encrypts it using the random key.

Additionally, KeePass erases all security-critical memory when it's not needed anymore, i.e. it overwrites these memory areas before releasing them (this applies to all security-critical memory, not only the password fields).

KeePass ≥ 1.15 and 2.x use the Windows DPAPI for in-memory encrypting the sensitive data. With DPAPI, the key for in-memory encryption is stored in a secure, non-swappable memory area managed by Windows. If DPAPI is not available or disabled (advanced KeePass options, by default using DPAPI is enabled), KeePass uses the ARC4 encryption algorithm with a random key. Note that this is less secure than DPAPI, mainly not because ARC4 cryptographically isn't that strong, but because the key for in-memory encryption is also stored in swappable process memory.

Key Locking the Workspace

When locking the workspace, KeePass closes the database file and only remembers the last view settings (which group and entries were selected, list position, etc.).

This provides maximum security: unlocking the workspace is as hard as opening the database file the normal way. Also, it prevents data-loss (the computer can crash while KeePass is locked, without doing any damage to the database).

Plugins Plugin Security

A separate page exist about the security of plugins: Plugin Security.

Black Box Self-Tests

Each time you start KeePass, the program performs a quick self-test to see whether the block ciphers and the hash algorithms work correctly and pass their test-vectors. If one of the algorithms doesn't pass its test vectors, KeePass shows a security exception message box.

Terminal Specialized Spyware

This section gives answers to questions like the following:

  • Would encrypting the configuration file increase security by preventing changes by a malicious program?
  • Would encrypting the application (executable file, eventually together with the configuration file) increase security by preventing changes by a malicious program?
  • Would an option to prevent plugins from being loaded increase security?
  • Would storing security options in the database (to override the settings of the KeePass instance) increase security?

The answer to all these questions is: no. Adding any of these features would not increase security.

All security features in KeePass protect against generic threats like keyloggers, clipboard monitors, password control monitors, etc. (and against non-runtime attacks on the database, memory dump analyzers, ...). However in all the questions above we're assuming that there's a spyware program running on the system that's specialized on attacking KeePass.

In this situation, the best security features will fail. This is law #1 of the 10 Immutable Laws of Security [4] [5]: "If a bad guy can persuade you to run his program on your computer, it's not your computer anymore".

For example, consider the following very simple spyware specialized for KeePass: an application that waits for KeePass to be started, then hides the started application and imitates KeePass itself. All interactions (like entering a password for decrypting the configuration, etc.) can be simulated. The only way to discover this spyware is to use a program that the spyware doesn't know about or can't manipulate (secure desktop); in any case it can't be KeePass.

References References and Further Reading

[1] National Institute of Standards and Technology: Report on the Development of the Advanced Encryption Standard (AES) (PDF).

[2] Bruce Schneier's blog: SHA-1 broken.

[3] Bruce Schneier's blog: Cryptanalysis of SHA-1, with comments about the impact of that discovery and what to do now.

[4] Scott Culp, Microsoft TechNet Essay, 2000: 10 Immutable Laws of Security.

[5] Jesper M. Johansson, Microsoft TechNet Magazine, 2008: Revisiting the 10 Immutable Laws of Security, Part 1.


Application Policy - KeePass

Settings

Application Policy

Details about the application policy system within KeePass.
  • Help for Users
  • Help for Administrators
    • Policy Security

Users Help for Users

Application policy is a KeePass feature that enables administrators to prevent you from accidently compromising the security system of your company.

Operations like exporting password entries to non-encrypted files or printing for example can be prevented effectively using the application policy.

If you are using KeePass at home, you can ignore the application policy (everything allowed anyway) or reduce your rights using the policy yourself, in order to avoid accidental leakage of sensitive information.

In order to prevent changing the policy after it has been specified, it is recommended to use an enforced configuration file.

Administrator Help for Administrators

KeePass can be installed on a network drive and a policy can be enforced (like not permitting users to print the password list).

The application policy enforcement is based on the mechanism how KeePass stores configuration settings. You first need to understand this method before you can continue creating a policy: Configuration.

A policy-enforcing KeePass installation looks like the following: the KeePass application files are stored on the network drive and all users are starting KeePass from this drive (i.e. they only have links to the executable on the network drive). By using an enforced configuration file on the network drive (remember that this file overrides all others), a policy can be enforced.

In order to create such an installation, follow these steps:

  1. Copy KeePass to a common network drive, which supports file permissions (like NTFS). All users must have access to it.
  2. Adjust the file permissions: allow users only to read and execute all KeePass files, don't allow write access.
  3. Adjust the file permissions for KeePass.exe: only Execute must be allowed, all other permissions should be disabled (including Read access).
  4. Start KeePass. Open the Options dialog, switch to the Policy tab and configure the policy. Exit KeePass.
  5. Rename the KeePass.config.xml file to KeePass.config.enforced.xml.

That's it. You created a policy that is enforced on all computers, including your own one (until you change the enforced configuration file on the network drive).

Locked Policy Security

Recall what the policy mechanism looks like: KeePass and the configuration file are stored on the network drive. If you grant your users free access to the internet or allow them to insert CD-ROMs/DVDs/USB-Sticks, nothing prevents a user to download a fresh copy of KeePass and run it. In this case the policy isn't enforced, as the downloaded KeePass doesn't know anything of the enforced configuration file on the network drive.

Policy enforcement therefore only is effective if your users really use the KeePass version installed on the network drive.


Auto-Type - KeePass

Auto-Type Icon

Auto-Type

Powerful feature that sends simulated keypresses to other applications.
  • Basic Auto-Type Information
  • Invoking Auto-Type
    • Context Menu: 'Perform Auto-Type' Command
    • Global Auto-Type Hot Key
  • Specifying Keystroke Sequences and Target Windows
    • Auto-Type Keystroke Sequences
    • Target Window Filters
    • Change Default Auto-Type Sequence
  • Usage Example

Text Basic Auto-Type Information

KeePass features an "Auto-Type" functionality. This feature allows you to define a sequence of keypresses, which KeePass can automatically perform for you. The simulated keypresses can be sent to any other currently open window of your choice (browser windows, login dialogs, ...).

By default, the sent keystroke sequence is {USERNAME}{TAB}{PASSWORD}{ENTER}, i.e. it first types the user name of the selected entry, then presses the Tab key, then types the password of the entry and finally presses the Enter key.

For TAN entries, the default sequence is {PASSWORD}, i.e. it just types the TAN into the target window, without pressing Enter.

Auto-Type can be configured individually for each entry using the Auto-Type tab page on the entry dialog (select an entry -> Edit Entry). On this page you can specify a default sequence and customize specific window/sequence associations.

Two-Channel Auto-Type Obfuscation is supported (making Auto-Type resistant against keyloggers).

Additionally, you can create customized window/sequence associations, which override the default sequence. You can specify different keystroke sequences for different windows for each entry. For example, imagine a webpage, to which you want to login, that has multiple pages where one can login. These pages could all look a bit different (on one you could additionally need to check some checkbox -- like often seen in forums). Here creating customized window/sequence associations solves the problems: you simply specify different auto-type sequences for each windows (identified by their window titles).

Invoking Auto-Type:
There are three different methods to invoke auto-type:

  • Invoke auto-type for an entry by using the context menu command Perform Auto-Type while the entry is selected.
  • Select the entry and press Ctrl-V (that's the menu shortcut for the context menu command above).
  • Using the system-wide auto-type hot key. KeePass will search all entries in the currently opened database for matching sequences.

All methods are explained in detail below.

Text Context Menu: 'Perform Auto-Type' Command

This method is the one that requires the least amount of configuration and is the simpler one, but it has the disadvantage that you need to select the entry in KeePass which you want to auto-type.

The method is simple: right-click on an entry of your currently opened database and click 'Perform Auto-Type' (or alternatively press the Ctrl-V shortcut for this command). The window that previously got the focus (i.e. the one in which you worked before switching to KeePass) will be brought to the foreground and KeePass auto-types into this window.

The sequence which is auto-typed depends on the window's title. If you didn't specify any custom window/sequence associations, the default sequence is sent. If you created associations, KeePass uses the sequence of the first matching association. If none of the associations match, the default sequence is used.

Text Global Auto-Type Hot Key

This is the more powerful method, but it also requires a little bit more work/knowledge, before it can be used.

Simple Global Auto-Type Example:

  1. Create an entry in KeePass titled Notepad with values for user name and password.
  2. Start Notepad - under Programs -> Accessories.
  3. Press Ctrl + Alt + A within Notepad. The user name and password will be typed into Notepad.

The KeePass entry title Notepad is matched with the window title of Notepad and the default Auto-Type sequence is typed.

How It Works - Details:

KeePass registers a system-wide hot key for auto-type. The advantage of this hot key is that you don't need to switch to the KeePass window and select the entry. You simply press the hot key while having the target window open (i.e. the window which will receive the simulated keypresses).

By default, the global hot key is Ctrl-Alt-A (i.e. hold the Control and Alt keys, press 'A' and release all keys). You can change this hot key in the options dialog (main menu - 'Tools' - 'Options', tab 'Integration'): here, click into the textbox below "Global Auto-Type Hot Key Combination" and press the hot key that you wish to use. If the hot key is usable, it will appear in the textbox.

When you press the hot key, KeePass will look at the title of the currently opened window and search the currently opened database for usable entries. If KeePass finds multiple entries that can be used, it displays a selection dialog. In order to decide if an entry is usable for the current window title, at least one of the following conditions must be fulfilled:

  • The title of the entry is a substring of the currently active window title.
  • The entry has a window/sequence association, of which the window specifier matches the currently active window title.

The second condition has been mentioned already, but the first one is new. By using entry titles as filters for window titles, the configuration amount for auto-type is almost zero: you only need to make sure that the entry title is contained in the window title of the window into which you want the entry to be auto-typed. Of course, this is not always possible (for example, if a webpage has a very generic title like "Welcome"), here you need to use custom window/sequence associations.

Custom window/sequence associations can be specified on the 'Auto-Type' tab page of each entry.

Text Auto-Type Keystroke Sequences

An auto-type keystroke sequence is a one-line string that can contain placeholders and special key codes.

Above you've seen already that the default auto-type is {USERNAME}{TAB}{PASSWORD}{ENTER}. Here, {USERNAME} and {PASSWORD} are placeholders: when auto-type is performed, these are replaced by the appropriate field values of the entry. {TAB} and {ENTER} are special key codes: these are replaced by the appropriate keypresses. Special key codes are the only way to specify special keys like Arrow-Down, Shift, Escape, etc.

Of course, keystroke sequences can also contain simple characters to be sent. For example, the following string is perfectly valid as keystroke sequence string:
{USERNAME}{TAB}Some text to be sent!{ENTER}.

Placeholders and special key codes are case-insensitive.

KeePass supports the following placeholders:

Field | Placeholder
Title | {TITLE}
User Name | {USERNAME}
URL | {URL}
Password | {PASSWORD}
Notes | {NOTES}
Custom strings can be referenced using {S:Name}. For example, if you have a custom string named "eMail", you can use the placeholder {S:eMail}.

Referencing fields of other entries:
See Field References. Auto-Type does dereference these links before sending keystrokes.

Special Keys:
The following codes for special keys are supported:

Special Key | Code
Tab | {TAB}
Enter | {ENTER} or ~
Arrow Up | {UP}
Arrow Down | {DOWN}
Arrow Left | {LEFT}
Arrow Right | {RIGHT}
Insert | {INSERT} or {INS}
Delete | {DELETE} or {DEL}
Home | {HOME}
End | {END}
Page Up | {PGUP}
Page Down | {PGDN}
Backspace | {BACKSPACE}, {BS} or {BKSP}
Break | {BREAK}
Caps-Lock | {CAPSLOCK}
Escape | {ESC}
Help | {HELP}
Numlock | {NUMLOCK}
Print Screen | {PRTSC}
Scroll Lock | {SCROLLLOCK}
F1 - F16 | {F1} - {F16}
Keypad + | {ADD}
Keypad - | {SUBTRACT}
Keypad * | {MULTIPLY}
Keypad / | {DIVIDE}
Shift | +
Control | ^
Alt | %

Special Key | Code
+ | {+}
^ | {^}
% | {%}
~ | {~}
(, ) | {(}, {)}
{, } | {{}, {}}

Additionally, some special commands are supported:

Command Syntax | Action
{APPDIR} | Will be replaced by the current application directory path.
{DELAY X} | Delays X milliseconds.
{INTERNETEXPLORER} | Will be replaced by the path of Internet Explorer, if installed.
{FIREFOX} | Will be replaced by the path of Mozilla Firefox, if installed.
{OPERA} | Will be replaced by the path of Opera, if installed.
{GOOGLECHROME} | Will be replaced by the path of Google Chrome, if installed.

Command Syntax | Action
{GROUP} | Name of the entry's parent group.
{GROUPPATH} | Full group path of the entry.
{PICKPASSWORDCHARS}
{PICKPASSWORDCHARSn:k} 		Shows a dialog to pick certain characters from the password. See below.
{NEWPASSWORD} | Generates a new password. See below.
{HMACOTP} | Generates a one-time password. See below.
{DELAY=X} | Sets the default delay to X milliseconds for all standard keypresses in this sequence.
{URL:RMVSCM} | Entry URL without scheme specifier.
{DB_PATH} | Full path of the current database.
{DB_DIR} | Directory of the current database.
{DB_NAME} | File name (including extension) of the current database.
{DB_BASENAME} | File name (excluding extension) of the current database.
{DB_EXT} | File name extension of the current database.
{ENV_DIRSEP} | Directory separator (\ on Windows, / on Unix).
{DT_SIMPLE} | Current local date/time as a simple, sortable string.
{DT_YEAR} | Year component of the current local date/time.
{DT_MONTH} | Month component of the current local date/time.
{DT_DAY} | Day component of the current local date/time.
{DT_HOUR} | Hour component of the current local date/time.
{DT_MINUTE} | Minute component of the current local date/time.
{DT_SECOND} | Seconds component of the current local date/time.
{DT_UTC_SIMPLE} | Current UTC date/time as a simple, sortable string.
{DT_UTC_YEAR} | Year component of the current UTC date/time.
{DT_UTC_MONTH} | Month component of the current UTC date/time.
{DT_UTC_DAY} | Day component of the current UTC date/time.
{DT_UTC_HOUR} | Hour component of the current UTC date/time.
{DT_UTC_MINUTE} | Minute component of the current UTC date/time.
{DT_UTC_SECOND} | Seconds component of the current UTC date/time.
Keys and special keys (not placeholders or commands) can be repeated by appending a number within the code. For example, {TAB 5} presses the Tab key 5 times.

Finally, some examples:

{TITLE}{TAB}{USERNAME}{TAB}{PASSWORD}{ENTER}
Types the entry's title, a Tab, the user name, a Tab, the password of the currently selected entry, and presses Enter.

{TAB}{PASSWORD}{ENTER}
Presses the Tab key, enters the entry's password and presses Enter.

{USERNAME}{TAB}^v{ENTER}
Types the user name, presses Tab, presses Ctrl-v (which pastes data from the Windows clipboard in most applications), and presses Enter.

Toggling Checkboxes:
Sometimes you find checkboxes on websites ("Stay logged in on this computer" for example). You can toggle these checkboxes by sending a space character (' ') when auto-typing. For example:
{USERNAME}{TAB}{PASSWORD}{TAB} {TAB}{ENTER}
If there is a webform with a user name field, password field and a checkbox, this sequence would enter the user name, the password and toggle the checkbox that follows the password control.

Pressing Non-Default Buttons:
Pressing non-default buttons works the same as toggling checkboxes: send a space character (' '). Note that this should only be used for non-default buttons; for default buttons, {ENTER} should be sent instead.

Higher ANSI Characters:
The auto-type function supports sending of higher ANSI characters in range 126-255. This means that you can send special characters like ©, @, etc. without any problems; you can write them directly into the keystroke sequence definition.

Picking Password Characters:
The password character picking dialog can be invoked multiple times in one auto-typing sequence. Use {PICKPASSWORDCHARS} first, then append numbers starting with 2, i.e. {PICKPASSWORDCHARS2}, {PICKPASSWORDCHARS3}, etc.

In KeePass ≥ 2.08, you can additionally specify the number of characters to pick. To do this, append :k in the placeholder, where k is the number of characters. For example, {PICKPASSWORDCHARS2:5} is a placeholder with ID 2 and will allow to pick 5 characters. Advantage of predefining the number of characters: when enough characters have been picked, the dialog closes automatically, i.e. you don't need to click [OK] anymore.

{NEWPASSWORD} – Generating new passwords:
The {NEWPASSWORD} placeholder generates a new password for the current entry, based on the "Automatically generated passwords for new entries" generator profile.

This placeholder is replaced once in an auto-type process, i.e. for a typical 'Old Password'-'New Password'-'Repeat New Password' dialog you can use {PASSWORD}{TAB}{NEWPASSWORD}{TAB}{NEWPASSWORD}{ENTER} as auto-type sequence.

{HMACOTP} – Generating one-time passwords:
The {HMACOTP} placeholder generates a HMAC-based one-time password as specified in RFC 4226. The shared secret is the UTF-8 representation of the value of the 'HmacOtp-Secret' custom entry string field (case-sensitive), and the counter is stored in decimal form in the 'HmacOtp-Counter' field.

Text Target Window Filters

When creating a custom window/sequence association, you need to tell KeePass how the matching window titles look like. Here, KeePass supports simple wildcards:

String with Wildcard | Meaning
STRING | Matches all window titles that are named exactly "STRING".
STRING* | Matches all window titles that start with "STRING".
*STRING | Matches all window titles that end with "STRING".
*STRING* | Matches all window titles that have "STRING" somewhere in the window title. This includes the string being directly at the start or at the end of the window title.

In KeePass ≥ 2.06, wildcards may also appear in the middle of patterns. For example, *Windows*Explorer* would match Windows Explorer.

Additionally, matching using regular expressions is supported. In order to tell KeePass that the pattern is a regular expression, enclose it in //. For example, //B.?g Window// would match Big Window, Bug Window and Bg Window.

By using wildcards, you can make your auto-type associations browser-independent. See the usage examples for more information.

Text Change Default Auto-Type Sequence

The default auto-type sequence (i.e. the one which is used when you don't specify a custom one) is {USERNAME}{TAB}{PASSWORD}{ENTER}. KeePass allows you to change this default sequence. Normally you won't need to change it (use custom window/sequence definitions instead!), but it is quite useful when some other application is interfering KeePass (for example a security software that always asks you for permission before allowing KeePass to auto-type).

By default, entries inherit the auto-type sequence of their containing group. Groups also inherit the auto-type sequence of their parent groups. There is only one top group (the first group contains all other groups). Consequently, if you change the auto-type sequence of this very first group, all other groups and their entries will use this sequence. Practically, this is a global override. To change it, right-click on the first group, choose 'Edit Group' and switch to the 'Auto-Type' tab.

Text Usage Example

Now let's have a look at a real-world example: logging into a website. In this example, will we use the global auto-type hot key to fill out the login webpage. First open the test page, and afterwards create a new entry in KeePass with title Test Form and a user name and password of your choice.

Let's assume the global auto-type hot key is set to Ctrl-Alt-A (the default). KeePass is running in the background, you have opened your database and the workspace is unlocked.

When you now navigate to the test page and are being prompted for your user name and password, just click into the user name field and press Ctrl-Alt-A. KeePass enters the user name and password for you!

Why did this work? The window title of your browser window was "Test Form - KeePass - Internet Explorer" or "Test Form - KeePass - Mozilla Firefox", depending on the browser you are using. Because we gave the entry in KeePass the title Test Form, the entry title is contained in the window title, therefore KeePass uses this entry.

Here you see the huge advantages of auto-type: it not only doesn't require any additional browser software (the browser knows nothing of KeePass -- there are no helper browser plugins required), it is also browser-independent: the one entry that you created within KeePass works for Internet Explorer and Mozilla Firefox (and other browsers) without requiring any modifications or definitions.

When you would use window/sequence associations (instead of entry title matching), you can achieve the same browser-independent effect using wildcards: you could for example have used Test Form - KeePass - * as window filter. This filter matches both the Internet Explorer and the Firefox window.


Two-Channel Auto-Type Obfuscation - KeePass

Auto-Type Icon

Two-Channel Auto-Type Obfuscation

Description of the Two-Channel Auto-Type Obfuscation feature in KeePass 2.x.
  • Information for Users:
    • Introduction: What is Two-Channel Auto-Type Obfuscation?
    • When can Two-Channel Auto-Type Obfuscation be used?
    • How to enable / configure Two-Channel Auto-Type Obfuscation?
  • Technical Information:
    • Technical Overview
    • Clipboard Event Blocker
    • Intelligently Splitting the Text
    • Splitting the Secrets

Text Introduction: What is Two-Channel Auto-Type Obfuscation?

The Auto-Type feature of KeePass is very powerful: it sends simulated keypresses to other applications. This works with all Windows applications and for the target applications it's not possible to distinguish between real keypresses and the ones simulated by Auto-Type. This at the same time is the main disadvantage of Auto-Type, because keyloggers can eavesdrop the simulated keys. That's where Two-Channel Auto-Type Obfuscation (TCATO) comes into play.

TCATO makes standard keyloggers useless. It uses the Windows clipboard to transfer parts of the auto-typed text into the target application. Keyloggers can see the Ctrl-V presses, but do not log the actual contents pasted from the clipboard.

Clipboard spies don't work either, because only parts of the sensitive information is transferred on this way.

Anyway, it's not perfectly secure (and unfortunately cannot be made by theory). None of the currently available keyloggers or clipboard spies can eavesdrop an obfuscated auto-type process, but it is theoretically possible to write a dedicated spy application that specializes on logging obfuscated auto-type.

Text When can Two-Channel Auto-Type Obfuscation be used?

TCATO cannot be used with all windows. The target window(s) must support clipboard operations and navigation within edit controls using arrow keys. Additionally, the target user interface must not contain automation features like jumping focus when maximum length of a text box is reached (as seen in registration number dialogs for example).

Rules of thumb:

  • Can be used in:
    • Browsers.
    • Windows programs with standard text boxes.
  • Can not be used in:
    • Console-based applications (interactive terminals, ...).

Because it doesn't work with all windows, it's an opt-in feature for each entry. You have to enable it explicitly on the 'Auto-Type' tab page in the 'Edit Entry' dialog.

Text How to enable / configure Two-Channel Auto-Type Obfuscation?

All you need to do is to tick the checkbox "Two-channel auto-type obfuscation" of an entry ('Auto-Type' tab of the entry editing window); KeePass will do the rest.

Text Technical Overview

Instead of simply sending simulated keypresses to the target application (as normal auto-type does), obfuscated auto-type does the following:

  • Enable clipboard event blocker.
  • Backup the current clipboard contents.
  • Intelligently split the text into parts.
  • For each part: check if the clipboard can be used.
    • If yes: Split it into two subparts (character-wise, like two flat intertwining combs). Copy/paste the first part, merge the rest by sending keypresses.
    • If no: Send it normally using simulated keypresses.
  • Restore previous clipboard contents.
  • Disable clipboard event blocker.

These steps are described in detail below.

Text Clipboard Event Blocker

Because we are heavily using the clipboard, it is useful to block all current clipboard monitors. This means that no other applications will get notified when KeePass changes the clipboard.

For this, an invisible window is created and added to the top of the clipboard event handler chain. This window simply throws away all clipboard change messages it receives, practically blocking all other applications from receiving any events.

Text Intelligently Splitting the Text

The text to be sent must first be split intelligently. Not all parts of the string can be sent using the clipboard: special key codes and key modifiers must be passed unchanged to the SendKeys function. For an example, have a look at the following string:

mymail@myprovider.com{TAB}MyTopSecretPassword{TAB} {TAB}{ENTER}

This is an example of a typical string sent by KeePass to another application. First it types the user's email address, then a tab, then the password, a tab, toggles a checkbox, another tab and finally presses the enter key. This sequence can be split into the following parts:

mymail@myprovider.com
{TAB}
MyTopSecretPassword
{TAB}
' ' (space)
{TAB}
{ENTER}

For each line, it is checked if the clipboard can be used. If the line contains a '{', '}', '(', ')', '+', '^', '%' or whitespace (space), it can only be sent by the SendKeys function directly. '+' for example presses the Shift key, it should not be copy/pasted as '+' character. Spaces can't be copy/pasted either, because they are usually used to toggle checkboxes.

In the example above, "mymail@myprovider.com" and "MyTopSecretPassword" can be sent using the clipboard.

Text Splitting the Secrets

Let's transfer "mymail@myprovider.com" to the target application using the clipboard now. KeePass could simply copy it to the clipboard and send a Ctrl-V keypress to the target application, making it paste the clipboard contents. This would be perfectly secure against keyloggers because they only see the Ctrl-V keypress but not the actual contents pasted. But there's still a problem: a malicious application could monitor the clipboard based on time intervals (i.e. not using the events - we've blocked those). Although the duration of the complete copy/paste operation is only a few milliseconds, there's still a small chance that an attacker could get the data in the clipboard. Therefore, the secrets are split.

First, the secret string "mymail@myprovider.com" is randomly split character-wise into two parts like two flat intertwining combs:

 y  il m   o  d  .c
m ma  @ ypr vi er  om

The first string "yilmod.c" is now copied to the clipboard. The string sent by the SendKeys is now assembled as follows:

  • Begin with pasting from the clipboard: ^v.
  • Press the left arrow key n times, with n = length of the clipboard string.
  • Send the remaining characters and press the right arrow key to skip the ones that were already pasted from the clipboard.

In our example above, the key sequence would be assembled to:

^v{LEFT 8}m{RIGHT}ma{RIGHT}{RIGHT}@{RIGHT}ypr{RIGHT}vi{RIGHT}er{RIGHT}{RIGHT}om

This will first paste the clipboard contents, go to its start and fill in the remaining characters, building up the original string "mymail@myprovider.com".

The time in which the first string part remains in the clipboard is minimal. It is copied to the clipboard, pasted into the target application and immediately cleared. This process usually takes only a few milliseconds at maximum.

More about secret string splitting:
In the above example, the string "mymail@myprovider.com" was split and sent. If the string would be split differently each time, a malicious application could reassemble the string by capturing multiple auto-types and combining them. In order to prevent this, KeePass initializes the random number generator for splitting based on a hash of the string. This means that each string is split differently, but the partitions of a string are uniquely determined. So, by invoking auto-type multiple times, an attacker cannot reassemble the original string, because he always captures the same half part.


Command Line Options - KeePass

Command Line

Command Line Options

Command line options to automate KeePass tasks.

You can pass a file path in the command line in order to tell KeePass to open this file immediately after startup.

Additionally, you can specify the password and/or key file location for this database. Switches can be either prefixed using a slash (/) or a minus (-).

Database file. The database file location is passed as argument. Only one database file is allowed. If the path contains a space, it must be enclosed in quotes (").

Password. Passwords are passed using the -pw: option. In order to pass 'abc' as password, you would add the following argument to the command line: -pw:abc. Note that there must be no space between the ':' and the password. If your password contains a space, you must enclose it in quotes. For example: -pw:"my secret password".

Key file. For supplying the key file location, the -keyfile: switch exists. The same rules as above apply, just that you specify the key file location: -keyfile:D:\pwsafe.key. You also need to quote the value, if it contains a space, tab or other whitespace characters.

Pre-selection. In order to just pre-select a key file, use the -preselect: option. For example, if you lock your database with a password and a key file, but just want to type in the password (so, without selecting the key file manually), your command line would look like this:

KeePass.exe "C:\My Documents\MyDatabase.kdb" -preselect:C:\pwsafe.key

KeePass would then show a prompt for the password for the database, but in the key file list, the C:\pwsafe.key file is selected already. When using the preselect switch, KeePass by default activates the key file switch and sets the focus to the password edit window.

Note the difference! The preselect switch just pre-selects the key file for you and displays the login prompt. In contrast, the keyfile switch doesn't prompt you for the (maybe missing) password.

The -minimize command line argument makes KeePass start up minimized.

The -auto-type command line argument makes previous KeePass instances perform a global auto-type.

Additionally, the -useraccount switch is supported. If specified, the current user account credentials will be used.

The -iocredfromrecent switch makes KeePass load file system credentials (not database key) from the most recently used files list. Alternatively, the file system credentials can be specified using the -iousername and -iopassword parameters.

The -entry-url-open option makes other KeePass instances search for an entry and open its URL. The entry is identified by its UUID, which you can pass as -uuid: command line parameter.

The order of the arguments is arbitrary.

Text Usage Examples

Open the database file 'C:\My Documents\MyDatabase.kdb' (KeePass will prompt you for the password and/or key file location):

KeePass.exe "C:\My Documents\MyDatabase.kdb"

If you got a database that is locked with a password 'abc', you could open it like this:

KeePass.exe "C:\My Documents\MyDatabaseWithPw.kdb" -pw:abc

If your USB stick always mounts to drive F: and you've locked your database with a key file on the USB stick, you could open your database as follows:

KeePass.exe "C:\My Documents\MyDatabaseWithFile.kdb" -keyfile:F:\pwsafe.key

If you've locked your database using a password and a key file, you can combine the two switches and open your database as follows:

KeePass.exe "C:\My Documents\MyDatabaseWithTwo.kdb" -pw:abc -keyfile:F:\pwsafe.key

You have locked your database using a password and a key file, but only want to have the key file pre-selected (i.e. you want to get prompted for the password), your command line would look like this:

KeePass.exe "C:\My Documents\MyDatabaseWithTwo.kdb" -preselect:F:\pwsafe.key

Text Starting KeePass using Batch Files

Batch files can be used to start KeePass. Mostly you want to specify some of the parameters listed above. You can theoretically simply put the command line (i.e. application path and parameters) into the batch file, but this is not recommended as the command window will stay open until KeePass is closed. The following method is recommended instead:

START "" KeePass.exe ..\MyDb.kdb -pw:MySecretPw

This START command will run KeePass (which opens the ..\MyDb.kdb file using MySecretPw as password). KeePass is assumed to be in the same directory (working directory) as the batch file, otherwise you need to specify a different path.

START executes the given command line and immediately exits, i.e. it doesn't wait until the application is terminated. Consequently, the command window will disappear after KeePass has been started.

Please note the two quotes (") after the START command. These quotes are required if the application path contains quotes (in the example above, the quotes could also be removed). If you want to learn more about the START command syntax, type START /? into the command window.

Text Closing/Locking KeePass using Batch Files

To close all currently running KeePass instances, call KeePass.exe with the '--exit-all' parameter:

KeePass.exe --exit-all

All KeePass windows will attempt to close. If a database has been modified, KeePass will ask you whether you want to save or not. If you wish to save in any case (i.e. a forced exit without any confirmation dialog), enable the 'Automatically save database on exit and workspace locking' option in 'Tools' - 'Options...' - 'Advanced'.

The KeePass instance that has been created by the command above is not visible (i.e. it does not show a main window) and will immediately terminate after sending close requests to the other instances.

KeePass ≥ 1.17 and ≥ 2.10 support the --lock-all and --unlock-all command line options to lock/unlock the workspaces of all other KeePass instances.


Composite Master Key - KeePass

Help

Composite Master Key

This document details how KeePass locks its databases.
  • Master Passwords
  • Key Files
  • Windows User Account
  • For Administrators: Specifying Minimum Properties of Master Keys

KeePass stores your passwords securely in an encrypted file (database). This database is locked with a master password, a key file and/or the current Windows account details. To open a database, all key sources (password, key file, ...) are required. Together, these key sources form the Composite Master Key.

KeePass does not support keys being used alternatively, i.e. it's not possible that you can open your database using a password or a key file. Either use a password, a key file, or both at once (both required), but not interchangeably.

Info Master Passwords

If you use a master password, you only have to remember one password or passphrase (which should be good!) to open your database. KeePass features protection against brute-force and dictionary attacks on the master password, read the security information page for more about this.

If you forget this master password, all your other passwords in the database are lost, too. There isn't any backdoor or a key which can open all databases. There is no way of recovering your passwords.

Info Key Files

You don't even have to remember a long, complicated master passphrase. The database can also be locked using a key file. A key file is basically a master password in a file. Key files are typically stronger than master passwords, because the key can be a lot more complicated; however it's also harder to keep them secret.

  • A key file can be used instead of a password, or in addition to a password (and the Windows user account in KeePass 2.x).
  • A key file can be any file you choose; although you should choose one with lots of random data.
  • A key file must not be modified, this will stop you opening the database. If you want to use a different key file, you can change the master key and use a new/different key file.
  • Key files must be backed up or you won't be able to open the database after a hard disk crash/re-build. It's just the same as forgetting the master password. There is no backdoor.

    Do not backup the key file to the same location as the database, use a different directory or disk. Test opening your database on another machine to confirm your backup works. For a detailed discussion on the difference between backing up the key file and the database, see the ABP FAQ.

The point of a key file is that you have something to authenticate with (in contrast to master passwords, where you know something), for example a file on a USB stick. The key file content (i.e. the key data contained within the key file) needs to be kept secret. The point is not to keep the location of the key file secret — selecting a file out of thousands existing on your hard disk basically doesn't increase security at all (it's very easy for malware/attackers to find out the correct file, for example by observing the last access times of files). Trying to keep the key file location secret is security by obscurity, i.e. not really effective.

KeePass can generate key files for you, however you can also use any other, already existing file (like JPG image, DOC document, etc.).

In order to use an existing file as key file, click the 'Browse' button in the master key creation dialog.

Info Windows User Account

KeePass can make the database dependent on the current Windows user account. If you enable this option, you can only open the database when you are logged in as the same Windows user when creating the database.

You can still change the password of the Windows user account freely. This does not affect the KeePass database.

Be very careful with using this option. If your Windows user account gets deleted, you won't be able to open your KeePass database anymore. Also, when using this option at home and your computer breaks (hard disk damaged), it is not enough to just create a new Windows account on the new installation with the same name and password; you need to copy the complete account (i.e. SID, ...). This is not a simple task, so if you don't know how to do this, it is highly recommended that you don't enable this option.

If you decide to use this option, it is highly recommended not to rely on it exclusively, but to additionally use one of the other two options (password or key file).

Triggers allow you to automatically export the database when you save. Saving in XML format provides a useful backup, but the export is in plain text, not encrypted. See the Trigger Examples for more details.

Protection using user accounts is unsupported on Windows 98 / ME.

Info For Administrators: Specifying Minimum Properties of Master Keys

Administrators can specify a minimum length and/or the minimum estimated quality that master passwords must have in order to be accepted. You can tell KeePass to check these two minimum requirements by adding/editing appropriate definitions in the INI/XML configuration file.

The contents of the MinimumLength node in Security/MasterPassword can contain the minimum master password length in characters. For example, by setting the contents to 10, KeePass will only accept master passwords that have at least 10 characters.

The contents of the MinimumQuality node in Security/MasterPassword can contain the minimum estimated quality in bits that master passwords must have. For example, by setting the contents to 32, only master passwords with an estimated quality of at least 32 bits will be accepted.

By specifying KeyCreationFlags and/or KeyPromptFlags (in the UI node), you can force states (enabled, disabled, checked, unchecked) of key source controls in the master key creation and prompt dialogs. These values can be bitwise combinations of one or more of the following flags:

Flag (Hex) | Flag (Dec) | Description
0x0 | 0 | Don't force any states (default).
0x1 | 1 | Enable password.
0x2 | 2 | Enable key file.
0x4 | 4 | Enable user account.
0x8 | 8 | Enable 'hide password' button.
0x100 | 256 | Disable password.
0x200 | 512 | Disable key file.
0x400 | 1024 | Disable user account.
0x800 | 2048 | Disable 'hide password' button.
0x10000 | 65536 | Check password.
0x20000 | 131072 | Check key file.
0x40000 | 262144 | Check user account.
0x80000 | 524288 | Check 'hide password' option/button.
0x1000000 | 16777216 | Uncheck password.
0x2000000 | 33554432 | Uncheck key file.
0x4000000 | 67108864 | Uncheck user account.
0x8000000 | 134217728 | Uncheck 'hide password' option/button.

For example, if you want to enforce using the user account option, you could check and disable the control (such that the user can't uncheck it anymore) by specifying 263168 as value (0x40000 + 0x400 = 0x40400 = 263168).


Configuration - KeePass

Configuration

Configuration

Details about how and where KeePass stores its configuration.

KeePass supports multiple locations for storing configuration information: the global configuration file in the KeePass application directory, a local user-dependent one in the user's private configuration folder, and an enforced configuration file in the KeePass application directory. The first one is called global, because everyone using this KeePass installation will write to the same configuration file (and possibly overwriting settings of other users). The second one is called local, because changes made to this configuration file only affect the current user.

Configuration files are stored in XML format.

Configuration | Location | Typical File Path
Global | Application Directory | C:\Program Files\KeePass Password Safe\KeePass.config.xml
Global (Virtualized) | Windows Vista/7 Virtual Store | C:\Users\User Name\AppData\Local\VirtualStore\Program Files\KeePass Password Safe\KeePass.config.xml
Local | User Application Data | C:\Documents and Settings\User Name\Application Data\KeePass\KeePass.config.xml
Enforced | Application Directory | C:\Program Files\KeePass Password Safe\KeePass.config.enforced.xml

Text Installation by Administrator, Usage by User

If you use the KeePass installer and install the program with administrator rights, the program directory will be write-protected when working as a normal/limited user. KeePass will use local configuration files, i.e. save and load the configuration from a file in your user directory.

Multiple users can use the locally installed KeePass. Configuration settings will not be shared and can be configured individually by each user.

Text Portable Version

If you downloaded the portable version of KeePass (ZIP package), KeePass will try to store its configuration in the application directory. No configuration settings will be stored in the user directory (if the global configuration file is writable).

Text Create Portable Version of Installed KeePass

If you are currently using a locally installed version of KeePass (installed by the KeePass installer) and want to create a portable version of it, first copy all files of KeePass to the portable device. Then get the configuration file from your user directory (application data, see above) and copy it over the configuration file on the portable device.

Text For Network Administrators: Enforced Configuration

KeePass can be forced to load specific configuration settings. Enforced configuration settings are loaded from KeePass.enforced.ini (KeePass 1.x) and KeePass.config.enforced.xml (KeePass 2.x) files in the application directory (where KeePass.exe is stored).

Configuration items that are not present in the enforced configuration file are loaded normally from global/local configuration files.

All data nodes (leaf nodes) are optional, however preceding non-leaf nodes with the same tag name in parent nodes of data leafs that you want to enforce are mandatory. For example, to enforce hiding user names and passwords using asterisks by default, the enforced configuration file would look like the following:
<?xml version="1.0" encoding="utf-8"?>
<Configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <MainWindow>
        <EntryListColumns>
            <Column />
            <Column>
                <Name>UserName</Name>
                <HideWithAsterisks>true</HideWithAsterisks>
            </Column>
            <Column>
                <Name>Password</Name>
                <HideWithAsterisks>true</HideWithAsterisks>
            </Column>
        </EntryListColumns>
    </MainWindow>
</Configuration>
In this example, the empty <Column /> non-leaf node (representing the title field) has the same tag name as the following sibling nodes ("Column"), and therefore is required.

This method of course only is effective as long as your users run the KeePass installation on the network drive. If they copy KeePass to their hard drives and run it from there, the options you set are not enforced (the local KeePass installation doesn't know anything of the enforced configuration file on the network drive in this case).

Text Technical Details

This section explains in detail how loading and saving the configuration works.

When KeePass starts up and finds both global and local configuration files, it must decide the order in which KeePass tries to get the configuration items. This is controlled by the (Kee)PreferUserConfiguration flag in the global configuration file. If it is not present, it defaults to false.

The flag is set to true in the global configuration file of the KeePass installer package. The portable ZIP package does not contain a configuration file, consequently the flag defaults to false.

Loading:
  • Try to get the configuration item from the enforced configuration file. If found, use this one.
  • If the PreferUserConfiguration flag is true, use the item from the local configuration file, otherwise use the one of the global one. If the global one doesn't exist or doesn't contain this item, use the default value.
Saving:
  • If the PreferUserConfiguration flag is true, try to store all configuration items into the local configuration file. If this fails, try to store them into the global configuration file. If this fails, report error.
  • If the PreferUserConfiguration flag is false, try to store all items into the global configuration file. If this fails try to store them into the local configuration file. If this fails, report error.


Field References - KeePass

Split

Field References

How to put references to data in fields of other entries.
  • Introduction
  • Placeholder Syntax
  • Example

Text Introduction

KeePass can insert data stored in different entries into fields of an entry. This means that multiple entries can share a common field (user name, password, ...), and by changing the actual data entry, all other entries will also use the new value.

To create a field reference, you can either use the convenient field references wizard (in the entry editing window, click the 'Tools' button at the bottom left and select 'Insert Field Reference'), or insert the placeholder manually (see the syntax below).

Text Placeholder Syntax

The placeholder syntax for field references is the following:

{REF:<WantedField>@<SearchIn>:<Text>}

The WantedField and SearchIn parts need to be replaced by 1-letter codes identifying the field:

Code | Field
T | Title
U | User name
P | Password
A | URL
N | Notes
I | UUID
O | Other custom strings (KeePass 2.x only)

The Text part is the search string, i.e. this text must occur in the specified field of an entry to match.

If multiple entries match the specified search criterion, the first entry will be used. To avoid ambiguity, entries can be identified by their UUIDs, which are unique. Example: {REF:P@I:46C9B1FFBD4ABC4BBB260C6190BAD20C} would insert the password of the entry having 46C9B1FFBD4ABC4BBB260C6190BAD20C as UUID.

Referencing fields of other entries only works with standard fields, not with custom user strings. You can use the O code to make KeePass search custom string fields (to identify the referenced source entry), but O cannot be used to retrieve data from custom fields (i.e. the code can't be used as WantedField). If you want to reference a custom user string, you need to place a redirection in a standard field using {S:<Name>}, and reference the standard field.

Custom strings can locally (i.e. within an entry) be referenced using {S:<Name>}, see Auto-Type Placeholders (which also work in clipboard and URL operations) for details.

Text Example

Let's assume you have two entries: one with title "Mozilla Website" and one with "Mozilla Forums", and want to insert the user name of the website account into the URL of the forums entry. Within the forum entry's URL, you could reference the user name like this:
http://fictitious-forum.mozilla.org/?user={REF:U@T:Mozilla Website}


File Formats - KeePass

Help

Import / Export

KeePass supports importing/exporting data from/to various file formats.

KeePass 1.x supports importing data from CSV files (special form), CodeWallet, Password Safe, and Personal Vault.

KeePass 2.x supports importing data from CSV files (all), KeePass 1.x (KDB, XML and CSV), KeePass 2.x XML, 1Password Pro, Alle meine Passworte, Any Password, CodeWallet, FlexWallet, Handy Safe, Handy Safe Pro, KeePassX, Mozilla Bookmarks, PassKeeper, Passphrase Keeper, Password Agent, Password Depot, Password Exporter, Password Gorilla, Password Keeper, Password Memory, Password Prompter, Password Safe, Passwort.Tresor, Personal Vault, PINs, RoboForm, Security TXT, SplashID CSV, Steganos Password Manager 2007, Whisper 32, ZDNet's Password Pro, and Spamex.com.

For both KeePass 1.x and 2.x, there are importer plugins available, which add more import capabilities/formats.

  • For KeePass 1.x:
    • File Format: CSV
    • File Format: XML
  • For KeePass 2.x:
    • Generic CSV Importer
    • Formats that require custom options/steps in order to be imported:
      • How to Import CodeWallet TXT 6.05
      • How to Import Password Gorilla CSV 1.42
      • How to Import PINs TXT 4.50
      • How to Import Data from RoboForm
      • How to Import Data from Steganos Password Manager 2007
      • How to Import Data from PassKeeper 1.2
      • How to Import 1Password Pro CSV

Unfortunately there isn't any standard password database format. Every password manager uses its own file format. Anyway, almost all support exporting to CSV or XML files. This sounds good at first glance, but CSV and XML files aren't specialized password database formats, they only specify a low-level layout of the stored data (for CSV: data fields are separated by commas; for XML: hierarchical form using tags). These formats do not specify the high-level arrangement of the data (for CSV: order/meaning of the fields; for XML: tag names and structure). Because of this, many users are confused when application #1 exports data to CSV/XML and application #2 can't read the CSV/XML file, although it claims that it can read those files.

This help page details the expected CSV and XML file formats. Knowing the formats which KeePass expects, you can reformat CSV and XML files exported by other password managers to match the KeePass formats. CSV files can be reformatted using OpenOffice Calc (see below). XML files can be reformatted using an XML editor.

KeePass can import many password database formats directly (see top of this page). Additionally, there are specialized KeePass Plugins available for importing more formats (like AnyPassword CSV, Oubliette files, PINs TXT, ZSafe files, and many more...). Using these plugins, you don't need to manually reformat the output of other password managers; you can directly import the exported files.

If no import plugin exists for importing data from your previous password manager, feel free to post a request for it in the KeePass Feature Requests and/or in the Open Discussion forum.

Text File Format: CSV (KeePass 1.x)

KeePass imports and exports data from/to CSV files in the following format:

"Account","Login Name","Password","Web Site","Comments"

For a detailed example, download this file: ZIP Package FileSample_CSV.zip. This file is zipped only in order to ensure correct encoding (if not zipped, browsers or download managers could automatically convert the file to a different encoding). When importing a CSV file, it must not be zipped!

Important notes about the format:

  • The file must be encoded using UTF-8 (Unicode). Other encodings are not supported.
  • CSV files only support the following fields: title, user name, password, URL and notes. Other fields like last entry modification time, expiration time, icon, entry file attachments, etc. are not supported. If you want to transfer such information, you have to use a different format (like XML).
  • All fields must be enclosed in quotes ("). These quotes are mandatory, unquoted fields are not allowed.
  • Quotes (") in strings are encoded as \" (two characters). Backslashes (\) are encoded as \\.
  • Multi-line comments are realized through normal line breaks. Encoding line breaks by \n is not supported.

Microsoft Excel by default does not enclose fields in quotes ("). It is recommended that you use OpenOffice Calc to create a correct CSV file (see below), or use the Generic CSV Importer of KeePass 2.x (import your CSV file into KeePass 2.x, then export the data to a KeePass 1.x KDB file), or fix the CSV file by manually adding the quotes using a text editor.

If you want to transfer data between KeePass 1.x databases, you must not change the default export options of KeePass. Do not export additional fields or uncheck any options, otherwise KeePass will not be able to re-import the CSV file, because it does not comply to the specification above any more.

Using OpenOffice Calc to create a CSV file:
OpenOffice Calc can be used to create CSV files that can be imported correctly into KeePass. Follow these steps:

  • Make sure you got 5 columns as described above.
  • Select everything, right-click and select 'Format Cells'. In the dialog, choose Text as category. Click [OK].
  • Go 'File' -> 'Save As...', choose a location and make sure that the check box 'Edit Filter Settings' is enabled. Click the 'Save' button.
  • Choose 'Unicode (UTF-8)' as character set. The field separator must be set to a comma. The text separator must be ". Make sure that the Fixed Column Width box is not checked. Click [OK].

Text File Format: XML (KeePass 1.x)

This section describes the KeePass 1.x XML format. Note that this format is different from the XML format used by KeePass 2.x (anyway, KeePass 2.x can import KeePass 1.x XML files).

You can download a detailed XML sample file here: ZIP Package FileSample_XML.zip. This file is zipped only in order to ensure correct encoding (if not zipped, browsers or download managers could automatically convert the file to a different encoding). When importing a XML file, it of course must not be zipped!

Important notes about the format:

  • The files must be encoded using UTF-8 (Unicode). Other encodings are not supported.
  • The following five entities must be encoded: < > & " '. They are encoded by &lt; &gt; &amp; &quot; &apos;.
  • The UUID is a hex-encoded 16-byte string (i.e. an 32 ANSI hex character string in the XML file). It is unique (also across multiple databases) and can be used to identify entries.
  • Dates/times are encoded in the standard date/time XML format (YYYY-MM-DDTHH:mm:ss): first the date in form YYYY-MM-DD, a 'T' character, and the time in form HH:mm:ss.

Text Generic CSV Importer

KeePass 2.x ships with a generic CSV importer. This tool can import almost all CSV formats out there. The CSV files are loaded and you can manually specify the encoding / character set, assign columns to data fields, and specify how the low-level structure looks like (usage of quotes, etc.).

To start the generic CSV file importer, click 'File' -> 'Import' and choose 'Generic CSV Importer'.

Text How to Import CodeWallet TXT 6.05

CodeWallet is a password manager that supports different card types (fields). KeePass cannot know which of the CodeWallet fields correspond to the KeePass standard fields (title, user name, ...), because they don't have fixed names (language-dependent, user-customizable, ...). Therefore all fields from the CodeWallet file are imported into custom string fields of KeePass entries. After importing the file, you can move some of the strings to the correct standard fields (by clicking the 'Move' button on the second tab page of the entries dialog.

Text How to Import Password Gorilla CSV 1.42

In order to successfully import a Password Gorilla CSV file, you need to configure the following settings in 'File - Preferences - Export' in Password Gorilla:

  • Enable 'Include password field'.
  • Enable 'Include notes field'.
  • Enable 'Save as Unicode text file'.
  • Set the field separator to 'µ' (mu, press AltGr+M).
  • Make sure you didn't use the 'µ' character anywhere in your password database.

When you carefully set these options, export the data to a CSV file and import it into KeePass using 'File -> Import' in KeePass 2.x.

Text How to Import PINs TXT 4.50

In order to successfully import a PINs TXT file, you need to do the following:

  • Switch PINs language to 'English'.
  • In PINs export dialog: Enable all fields.
  • In PINs export dialog: Set separator to 'tab'.
  • In PINs export dialog: Enable 'Quote texts'.

After exporting a TXT file using the settings above, import it using 'File -> Import' in KeePass 2.x.

Text How to Import Data from RoboForm

First you need to export your passcards to a HTML file. To do this, open RoboForm's Passcard Editor ('Edit Passcards' in the Windows start menu) and in the editor's main menu go 'Passcard' -> 'Print List'. In the dialog that opens, click the 'Save' button. Choose a location and file name, and click 'Save'.

Open your KeePass 2.x database file and go 'File' -> 'Import'. Choose 'RoboForm HTML' as format and select the HTML file you just exported, then click 'OK'.

Text How to Import Data from Steganos Password Manager 2007

Warning! It is possible that the transfer fails and that KeePass accidently overwrites your existing passwords in Steganos Password Manager. Therefore backup your SEF file before starting the import! In any case you should restore your passwords by restoring the backup you just created after the import process! Even if you think KeePass hasn't changed anything, restore from the backup!

Unfortunately Steganos Password Manager (SPM) lacks any form of export functionality. As the SEF file format (in which the data is stored) is proprietary and no specification is available, KeePass needs to try to get all the data out of the windows of SPM.

The import process works as follows. First you start SPM and open your password database. The main password management window should be open (i.e. the one which lists your items in the middle of the screen, and got toolbar-like buttons at the top). Make sure that all your items are displayed in the list (select the correct filter in the combobox above the item list).

Now switch to KeePass 2.x and open your KeePass database. Go File -> Import and choose Steganos Password Manager 2007. Click [OK]. Now read the rest before continuing.

After pressing the [Yes] button in the KeePass import confirmation dialog, you got 10 seconds to switch to the SPM window. Select the very first entry within the SPM window (but do not open it, just select it). This is important! The first entry must have the keyboard focus and must be selected.

When the 10 seconds are over, KeePass will start importing. You will see how KeePass opens the SPM items, copies the data, closes the item's window, select the next item, etc. Everything goes automatic now and you can just sit back and watch. Sometimes Windows playes a ding sound, this is normal.

Note that it can take quite some time to import your items. Do not do anything while KeePass is importing! One single mouse click or keypress can ruin the complete import process.

The last item will be scanned twice. When completed, KeePass will show a message "The import process has finished!".

It is possible that KeePass failed to import some items (mainly caused by SPM's unpredictable slow response times). It is highly recommended that you compare each of the entries.

Text How to Import Data from PassKeeper 1.2

The import process works visually, exactly like the import method for Steganos Password Manager data. Please read all instructions in How to Import Data from Steganos Password Manager.

Text How to Import 1Password Pro CSV

KeePass can import CSV files exported by 1Password Pro. When exporting the data, make sure:

  • All fields must be exported.
  • Choose the tabulator (Tab) as field separator.
  • The option for enclosing fields in quotes must be enabled.


Integration - KeePass

Help

Integration

How KeePass integrates into your operating system environment.
  • Global Hot Key to Restore KeePass Window
  • Limit to Single Instance Option

Info Global Hot Key to Restore KeePass Window

To quickly switch back from an application to KeePass, you can use the global hot key that restores the KeePass main window.

If you have multiple instances of KeePass running, pressing the global hot key will restore the first instance that has been started.

The global hot key is Ctrl-Alt-K.

The hot key can freely be changed to a different key combination (or disabled) in the 'Options' dialog, tab page 'Integration'.

Info Limit to Single Instance Option

If you enable the 'Limit to Single Instance' option, at most one KeePass instance can be running at a time. If you try to start a second KeePass instance, it is immediately terminated, and the first instance is brought to the foreground.


Multi-User - KeePass

Help

Multi-User

Details about multi-user features of KeePass.
  • Shared Database Editing:
    • General Information about Shared Databases
    • KeePass 1.x: Office-Style Locking
    • KeePass 2.x: Synchronize or Overwrite

People General Information about Shared Databases

Both KeePass 1.x and 2.x allow multiple users working with one database, which is typically stored on a shared network drive or a file server.

All users use the same master password and/or key file to open the database. There are no per-group or per-entry access control lists (ACLs).

In order to restrict write access to the database file (i.e. only a select set of users may change the stored data), use file system access rights.

People KeePass 1.x: Office-Style Locking

With KeePass 1.x, a database can be stored on a shared network drive and used by multiple users. When a user tries to open a database that is already opened by someone else, a prompt asks whether to open the database in read-only or normal mode (see image on the right).

By opening a database in normal mode, the current user takes ownership of the file (i.e. subsequent opening attempts will show the current user as owner).

KeePass 1.x does not provide synchronization, i.e. by saving the database you are saving your current data to disk. If another user has changed an entry in the meanwhile (i.e. since you loaded the database), these changes are overwritten. 		KeePass 1.x Read-Only Prompt

If you want to use KeePass 1.x with a database on a shared network drive, it is recommended to let an administrator write to the database and let users only read it (ensure this using file system access rights). By using the -readonly command line switch, KeePass will automatically open a given database in read-only mode (i.e. not show the mode prompt). Users would open the database using a shortcut that contains this command line switch.

If there is no central administrator managing the database, users need to be careful to not overwrite each others changes.

People KeePass 2.x: Synchronize or Overwrite

With KeePass 2.x, a database can be stored on a shared network drive and used by multiple users. When attempting to save, KeePass first checks whether the file on disk has been modified since it was loaded. If yes, KeePass asks whether to synchronize or overwrite the file (see image on the right).

By synchronizing, changes made by other users (file on disk) and changes made by the current user are merged. After the synchronization process has finished, the current user also sees the changes made by others (i.e. the data in the current KeePass instance is up-to-date).

If there is a conflict (multiple users edited the same entry), KeePass uses the latest version of the entry based on the last modification time. 		KeePass 2.x Synchronize Prompt

Note: the synchronize prompt is only triggered by the 'Save' command, not by the 'Save As' command. When executing the 'Save As' command and manually selecting a file, this file will always be overwritten.


Password Generator - KeePass

Security

Password Generator

Details about the built-in password generator of KeePass.

  • Generation Based on Character Sets
  • Generation Based on Patterns
  • Generating Passwords that Follow Rules
  • Security-Reducing Options
  • Creating and Using Password Generator Profiles
  • Configuring Settings of Automatically Generated Passwords for New Entries

Help Generation Based on Character Sets

This password generation method is the recommended way to generate random passwords. Other methods (pattern-based generation, ...) should only be used if passwords must follow special rules or fulfill certain conditions.

Generation based on a character set is very simple. You simply let KeePass know which characters can be used (i.e. upper-case letters, digits, ...) and KeePass will randomly pick characters out of the set.

Defining a Character Set:
The character set can be defined directly in the password generator window. For convenience, KeePass offers adding commonly used ranges of characters to the set. This is done by ticking the appropriate check box. Additionally to these predefined character ranges, you can specify characters manually: all characters that you enter in the 'Also include the following characters' edit box will be directly added to the character set.

Character Sets are Sets:
In mathematical terms, character sets are sets, not vectors. This means that characters can not be added twice to the set. Either a character is in the set or it is not.

For example, if you enter 'AAAAB' into the additional characters box, this is exactly the same set as 'AB'. 'A' will not be 4 times as likely as 'B'! If you need to follow rules like 'character A is more likely than B', you must use pattern-based generation + permuting password characters.

KeePass will 'optimize' your character set by removing all duplicate characters. If you'd enter the character set 'AAAAB' into the additional characters box, close and reopen the password generator, it'll show the shorter character set 'AB'. Similarly, if you tick the Digits check box and enter '3' into the additional box, the '3' will be ignored because it is already included in the Digits character range.

Help Generation Based on Patterns

The password generator can create passwords using patterns. A pattern is a string defining the layout of the new password.

Placeholder | Type | Character Set
a | Lower-Case Alphanumeric | abcdefghijklmnopqrstuvwxyz 0123456789
A | Mixed-Case Alphanumeric | ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz 0123456789
U | Upper-Case Alphanumeric | ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789
c | Lower-Case Consonant | bcdfghjklmnpqrstvwxyz
C | Mixed-Case Consonant | BCDFGHJKLMNPQRSTVWXYZ bcdfghjklmnpqrstvwxyz
z | Upper-Case Consonant | BCDFGHJKLMNPQRSTVWXYZ
d | Digit | 0123456789
h | Lower-Case Hex Character | 0123456789 abcdef
H | Upper-Case Hex Character | 0123456789 ABCDEF
l | Lower-Case Letter | abcdefghijklmnopqrstuvwxyz
L | Mixed-Case Letter | ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
u | Upper-Case Letter | ABCDEFGHIJKLMNOPQRSTUVWXYZ
p | Punctuation | ,.;:
b | Bracket | ()[]{}<>
S | Printable 7-Bit ASCII | A-Z, a-z, 0-9, !"#$%&'()*+,-./:;<=>?[\]^_{|}~
v | Lower-Case Vowel | aeiou
V | Mixed-Case Vowel | AEIOU aeiou
Z | Upper-Case Vowel | AEIOU
x | High ANSI | From '~' to U255 (excluding U255)
\ | Escape (Fixed Char) | Use following character as is
{n} | Escape (Repeat) | Repeat the previous character n times
[...] | Custom Char Set | Define a custom character set

The \ placeholder is special: it's an escape character. The next character that follows the \ is written directly into the generated password. If you want a \ in your password at a specific place, you have to write \\.

Using the {n} code you can define how many times the previous placeholder should occur. The { } operator duplicates placeholders, not generated characters. Examples:
» d{4} is equivalent to dddd,
» dH{4}a is equivalent to dHHHHa and
» Hda{1}dH is equivalent to HdadH.

The [...] notation can be used to define a custom character set, from which the password generator will pick one character randomly. All characters between the [ and ] brackets follow the same rules as the placeholders above. Examples:
» [dp] generates exactly 1 random character out of the set digits + punctuation,
» [d\m\@]{5} generates 5 characters out of the set "0123456789m@",
» [u\_][u\_] generates 2 characters out of the set upper case + '_'.

More examples:

ddddd
Generates for example: 41922, 12733, 43960, 07660, 12390, 74680, ...

\H\e\x\:\ HHHHHH
Generates for example: 'Hex: 13567A', 'Hex: A6B99D', 'Hex: 02243C', ...

Common Password Patterns:

Name | Pattern
WEP Hex Key - 40 Bit | h{10}
WEP Hex Key - 128 Bit | h{32}
WEP Hex Key - 256 Bit | h{64}
Random MAC Address | HH\-HH\-HH\-HH\-HH\-HH

Help Generating Passwords that Follow Rules

Below are a few examples how the pattern generation feature can be used to generate passwords that follow certain rules.

Important! For all of the following examples you must enable the 'Randomly permute characters of password' option!

Rule | Pattern
Must consist of 2 upper case, 2 lower case characters and 2 digits | uulldd
Must consist of 9 digits and 1 letter | d{9}L
Must consist of 10 alphanumeric characters, where at least 1 is a letter and at least 1 is a digit | LdA{8}
Must consist of 10 alphanumeric characters, where at least 2 are upper case and at least are 2 lower case characters | uullA{6}
Must consist of 9 characters out of the set "ABCDEF" and an '@' symbol somewhere in it | \@[\A\B\C\D\E\F]{9}

Help Security-Reducing Options

The password generator supports several options like 'Each character must occur at most once', 'Exclude look-alike characters', and a field to explicitly specify characters that should not appear in generated passwords.

These options are reducing the security of generated passwords. You should only enable them if you are forced to follow such rules by the website/application, for which you are generating the password.

The options can be found in the 'Advanced' dialog / tab page.

Tab Control If you enable a security-reducing option, an exclamation mark (!)
is appended to the 'Advanced' tab.

Help Creating and Using Password Generator Profiles

Password generator options (character set, length, pattern, ...) can be saved as password generator profiles.

Creating/Modifying a Profile:

  1. Open the Password Generator window.
  2. Specify all options of the new profile.
  3. Click the Save As Save as Profile button.
  4. Enter the name of the new profile, or select an existing profile name from the drop-down list to overwrite it. Close the dialog with OK.
  5. If you want to immediately create a password using the new profile, click OK/Accept. Otherwise click Cancel/Close (the profile is not lost; profile management is independent of password generation).

Using a Profile:

To use a profile, simply select it from the drop-down profiles list in the password generator window. All settings of this profile will be restored accordingly.

Help Configuring Settings of Automatically Generated Passwords for New Entries

When you create a new entry, KeePass will automatically generate a random password for it. The properties of these generated passwords can be configured in the password generator dialog.

To configure, specify the options of your choice and overwrite the '(Automatically generated passwords for new entries)' profile (see section above).

Disabling Automatically Generated Passwords:
To disable automatically generated passwords for new entries, select 'Generate using character set' and specify 0 as password length. Overwrite the appropriate profile (see above).


Repairing Databases - KeePass

Help

Repairing Databases

KeePass can repair corrupted databases in some cases.

KeePass has quite some features to avoid database file corruption (transacted database writing, device buffer flushing, ...). However, data corruption can still be caused by other programs, the system or broken storage devices (note that KeePass by default is verifying the integrity of database files immediately after writing them, i.e. at this point of time, KeePass guarantees file integrity; however, KeePass of course can't do anything when the data becomes corrupted/unreadable at a later point of time).

In these cases, the database repair functionality might help you. Here, KeePass tries to read as much data as possible from the corrupted file, without any integrity checks.

In order to use the repair functionality in KeePass ≥ 2.10, first create a new database file. Then, go 'File' -> 'Import' and import the corrupted database file, using 'KeePass KDBX (2.x) (Repair Mode)' as format.

Anyway, if you've lost the master key for the database, the repair functionality cannot help you. Also, if the header of the database (first few bytes) is corrupted, you're out of luck too: the repair functionality won't be able to restore any entries (because the header contains information required to decrypt the database).

The repair functionality should be seen as last hope. Regularly making backups of your databases is much better and has to be preferred. Backups have no cryptographic security implications. There are plugins that automate the backup process, see the KeePass plugins page.


Secure Edit Controls - KeePass

Help

Secure Edit Controls

KeePass supports security-enhanced edit controls.

KeePass was one of the first password managers featuring secure edit controls. The edit controls used in KeePass are resistant to password revealers and password control spies. Additionally, the entered passwords are protected against memory dumping attacks: the passwords aren't even visible in the process memory space of KeePass!

KeePass uses secure edit controls only when the hiding behind asterisks option is turned on! If you show the passwords in plaintext, they won't be protected (secure edit controls are just disabled then, replaced by standard Windows edit controls).

There are no selection limitations. Secure edit controls behave exactly like standard Windows edit controls.


TAN Support - KeePass

Help

TAN Support

KeePass supports Transaction Authentication Numbers (TANs).
  • Using the TAN Wizard to add TANs
  • Using TANs

KeePass supports TANs, i.e. passwords that can be used only once. These special passwords are used by some banks: you need to confirm transactions using such TANs. This provides additional security, as a spy cannot perform transactions, even if he knows the password of your banking account.

Text Using the TAN Wizard to add TANs

You can use the KeePass TAN Wizard to add several TANs at once to your database. Just open the TAN wizard dialog (menu Tools - TAN Wizard) and enter all your TANs. The formatting doesn't really matter, KeePass just uses all alphanumerical strings, i.e. characters like line breaks, tabs, spaces, dots, etc. are interpreted as separators.

The wizard will then generate several TAN entries from the data you entered into the dialog. Each TAN is a standard KeePass entry. The title of a TAN entry always is set to "<TAN>". This tells KeePass that the entry is a TAN entry. You cannot change the title, user name and URL of a TAN. But you can freely add notes to a TAN entry, if you wish.

Text Using TANs

When you use the TAN (e.g. execute the "Copy Password" command on it), its expiration date will be set to the current time, which expires the entry. It will get a red X as icon. If you later want to know when you used a specific TAN, you can just have a look at its expiration date.

When copying a TAN to the clipboard, the database is marked as modified. You must save the file in order to remember the usage of a TAN.

If you accidently used a TAN without needing it, you can reset it (i.e. remove the red X and show it as valid TAN again). To do this, open the TAN entry (right-click it and choose 'Edit/View Entry...'). Here, uncheck the 'Expires' checkbox. Click OK to close the dialog.


Triggers - KeePass

Triggers

Triggers

Automate workflows using the trigger system.
  • Trigger System Introduction
  • Events
  • Conditions
  • Actions
  • Examples

Triggers Trigger System Introduction

KeePass features a powerful event-condition-action trigger system. With this system, workflows can be automated. For example, you could define a trigger that automatically uploads your database to a backup server after saving the file locally.

A trigger starts to run when any of the specified events matches. When this happens, the conditions are checked. If all conditions are fulfilled, the actions of the trigger are performed. Actions are performed consecutively; if one action fails, typically the execution of the event is aborted (i.e. all following actions aren't performed).

A trigger must be both enabled and on in order to get executed. The enabled state is set by the user; a disabled trigger has no function. The on state is dependent on the state of the program. By enabling the 'Initially On' option, a trigger is on by default. If you enable the option 'Turn off after executing actions', the trigger will be off after running once. There are actions to turn triggers on and off, i.e. triggers can turn themselves and other triggers on and off, which allows to define a complex state-dependent system of triggers.

Note that most strings in the trigger system are Spr-compiled, i.e. placeholders, environment variables, etc. can be used.

Triggers Events

  • Application initialized:
    This event occurs when KeePass has finished initializing, but didn't perform any main window automations (like opening a default database) yet.
    • Parameters: None.

  • Application started and ready:
    This event occurs when KeePass has started up, performed main window automations (like opening a default database) and is ready for user actions.
    • Parameters: None.

  • Application exit:
    This event occurs when KeePass is about to exit. Databases have been closed already, but resources (like fonts, ...) are still valid.
    • Parameters: None.

  • Opened database file:
    This event occurs right after a database file has been opened successfully.
    • File/URL: An optional event filter. If a filter is specified (i.e. something is entered in 'File/URL - Filter'), the trigger is only evaluated, if the filter matches the actual database file path. For example, if you enter F:\ as filter string and specify 'Starts with' as comparison method, the trigger will only be evaluated, if the database (that has just been opened) path starts with F:\.

  • Saving database file:
    This event occurs right before a database file is saved.
    • Parameters: See 'Opened database file' event.

  • Saved database file:
    This event occurs right after a database file has been saved successfully.
    • Parameters: See 'Opened database file' event.

  • Copied entry data to clipboard:
    This event occurs when entry data (user name, password, ...) is copied to the Windows clipboard.
    • Value: An optional value (copied data) filter.

  • User interface state updated:
    This event occurs when KeePass has finished updating the state of the user interface (menus, toolbar, ...). The user interface state is updated after most user actions, like adding / editing / deleting entries and groups, etc.
    • Parameters: None.

  • Custom toolbar button clicked:
    This event occurs when the user clicks a custom toolbar button. Custom toolbar buttons can be added using the 'Add custom toolbar button' trigger action.
    • ID: ID of the toolbar button that must have been clicked (see action).

Triggers Conditions

  • Environment variable:
    • Name: Name of the environment variable to check. The name must not be enclosed in percent (%) characters.
    • Value: The value that the specified environment variable must have for the condition to be true.

  • File exists:
    • File: The file that must exist in order for the condition to be true.

  • Remote host is reachable (ping):
    • Host: Host to send the ping to.

  • Active database has unsaved changes:
    Evaluates to true, if the active database (currently selected database tab in the main window) has unsaved changes.
    • Parameters: None.

Triggers Actions

  • Execute command line / URL:
    Note: the file/URL and arguments are parsed by the Spr engine before they are sent to the shell, i.e. generic and database-dependent placeholders can be used. If you want to use built-in shell commands, like COPY, please see: Executing Built-In Shell Commands.
    • File/URL: The string to be executed by the shell.
    • Arguments: Optional. If 'File/URL' points to an executable file, this string is sent to the executable as command line argument(s).

  • Change trigger on/off state:
    • Trigger name: Name of the target trigger whose on/off state should be changed. If this field is left empty, the target trigger is the current one.
    • New state: Specifies the new state of the target trigger.

  • Open database file:
    Open a KDBX database file (in a new tab). If the given database file is opened already, KeePass brings it to the foreground.
    • File/URL: Path of the database file to open. If it is an URL, the protocol (prefix) must be specified.
    • IO Connection - User Name / Password: Optional credentials that are used for connecting to the target file system (for example FTP account user name / password). These credentials are not used to decrypt the database.
    • Password / Key file / User account: Optional credentials that are used to decrypt the database file.

  • Save active database:
    Save the currently active database. This action always saves the database, even if there are no unsaved changes. To only save if there are unsaved changes, use the 'Active database has unsaved changes' trigger condition.
    • Parameters: None.

  • Synchronize active database with a file/URL:
    Synchronize the currently opened and active database with a file.
    • File/URL: Path of the database file to synchronize with. If it is an URL, the protocol (prefix) must be specified.
    • IO Connection - User Name / Password: Optional credentials that are used for connecting to the target file system (for example FTP account user name / password). These credentials are not used to decrypt the database.

  • Export active database:
    Export the currently opened and active database to a file.
    • File/URL: Path of the target file to export to. If it is an URL, the protocol (prefix) must be specified.
    • File format: Specifies the export format (see the export dialog for possible values).

  • Activate database (select tab):
    • File/URL: Path of the database to activate. This may be a substring of the actual database path, for example specifying MyDatabase would match a database C:\Documents\KeePass\MyDatabase.kdbx.

  • Wait:
    Wait for the specified amount of time.
    • Time span: Number of milliseconds to wait.

  • Perform global auto-type:
    Execute global auto-type (like pressing the global auto-type hot key).
    • Parameters: None.

  • Add custom toolbar button:
    Add a button to the toolbar in the main window.
    • ID: ID of the toolbar button (see the event handler).
    • Name: Text that is shown on the toolbar button.
    • Description: Text that is shown in the tooltip of the button.

Triggers Examples

See the Trigger Examples page.


URL Field Capabilities - KeePass

URL Field

URL Field Capabilities

The URL field supports various special protocols and placeholders.

URL Field Capabibilities:
  • Standard Capabilities
  • Executing Command Lines
  • Placeholders
Usage Tips & Tricks:
  • Starting RDP/TS Sessions (Remote Desktop / Terminal Server Connection)
  • Executing Built-In Shell Commands

Text Standard Capabilities

The URL field can execute any valid URL, for which you have defined a protocol handler. On most systems at least the http://, ftp:// and mailto: protocols are defined. KeePass supports all registered protocols that Internet Explorer supports.

For example, if you globally (i.e. using the Windows Explorer) register PuTTY for ssh:// URLs, KeePass will automatically use PuTTY for ssh:// URLs, too.

Terminal Executing Command Lines

Instead of an URL, you can also execute command lines using the URL field. To tell KeePass that the line you entered is a command line, prefix it using cmd://. For example if you would like to execute Notepad, your URL could look like this:

cmd://C:\Windows\Notepad.exe C:\Test\MyTestFile.txt

The virtual cmd:// protocol also supports parameters for executable files, in contrast to the file:// protocol. This was the main reason why cmd:// was introduced; with file:// you aren't able to pass any parameters to started applications. Use the cmd:// protocol instead.

The paths for the cmd:// protocol don't need to be encoded. For example, you do not have to replace space characters by %20, as it is normally required for other URLs. KeePass just cuts away the cmd:// virtual protocol prefix and passes the remaining command line to Windows.

If the file path contains spaces, you must enclose it in quotes (").

Environment Variables:
Windows environment variables are supported. For example %TEMP% is replaced by the user's temporary path.

UNC Paths:
Windows-style UNC paths (starting with \\) are directly supported, i.e. do not need to be prefixed with cmd://.

Text Placeholders

In the URL field, you can use several placeholders that will get automatically replaced when the URL is executed. For example:

http://www.yoursite.com/default.php?user={USERNAME}&pass={PASSWORD}

For this entry, KeePass will replace {USERNAME} by the data of the username field and {PASSWORD} by the data in the password field when you execute the link.

Exactly the same placeholders are supported as the auto-type feature supports. For a complete list of supported placeholders, see the Auto-Type Placeholders List.

Also note that the special placeholders are supported, too. For example, the {APPDIR} placeholder is replaced by the application directory path of the currently running KeePass instance. It's the absolute path of the directory containing the KeePass executable, without a trailing backslash. If you would like to start a new KeePass instance, you could set the URL to:

cmd://"{APPDIR}\KeePass.exe"

To use different browsers for entries, you can use URLs like the following:
cmd://{INTERNETEXPLORER} "http://www.yoursite.com"
cmd://{FIREFOX} "http://www.yoursite.com"
cmd://{OPERA} "http://www.yoursite.com"
cmd://{GOOGLECHROME} "http://www.yoursite.com"
The browser placeholder will be replaced by the browser's executable path (if the browser is installed).

Terminal Starting RDP/TS Sessions

You can use the URL field of entries and the virtual cmd:// protocol to start remote desktop connections.

For this, enter the following in the URL field of an entry:

cmd://mstsc.exe

When you now double-click the URL field of the entry in the main window, a Windows remote desktop connection is initiated.

MSTSC is the Windows terminal server connection program (remote desktop connection). You can pass a path to an existing RDP file to the program to open it. For example, the following URL opens the specified RDP file:

cmd://mstsc.exe "C:\My Files\Connection.rdp"

MSTSC also supports several command line options:

  • /v:<Server[:Port]>
    Defines the terminal server to connect to.
  • /console
    Connects to the terminal session of the server.
  • /f
    Starts the client in full screen mode.
  • /w:<Width>
    Defines the width of the remote desktop screen.
  • /h:<Height>
    Defines the height of the remote desktop screen.
  • /edit
    Opens the specified RDP file for editing.
  • /migrate
    Migrates old connection files to new RDP files.

Terminal Executing Built-In Shell Commands

The URL field can be used to start applications/documents and URLs. If you want to execute a built-in shell command, like COPY for example, this however doesn't work directly, because there is no COPY.EXE (in Windows 9x times there actually was one, but on all modern Windows operating systems these commands are built-in to the command line window).

In order to execute built-in shell commands, you need to pass them to the command line interpreter cmd.exe.

For the COPY command you would specify cmd.exe as executable file and /C COPY from to as arguments (where 'from' and 'to' are paths). The /C parameter tells cmd.exe to execute the command line that follows.

In the URL field, your URL would look like the following:
cmd://cmd.exe /C COPY from to
In other locations, like command lines in the trigger system, you can leave out the cmd:// URL prefix.


Using Stored Passwords - KeePass

Help

Using Stored Passwords

How to transfer passwords stored in KeePass to other applications.

There are many different methods to copy passwords stored in KeePass to other applications:

  • Context-Sensitive Entry List
  • Drag&Drop
  • Auto-Type
  • KeeForm and other Plugins

Info Context-Sensitive Entry List

Depending on which field you double-click in the entry list (main window), different actions are performed:

  • Title field: open the entry editing dialog for this entry.
  • User Name field: copy user name to clipboard.
  • URL field: open (in browser) or copy the URL to clipboard (behavior configurable in the options).
  • Password field: copy password to the clipboard.
  • Notes field: notes are copied to the clipboard.
  • Attachment field: [1.x] copy to clipboard, [2.x] open in internal editor / viewer.
  • Other fields (like time and UUID fields): copy the contents of that field to the clipboard.

Info Drag&Drop

You can drag&drop all fields of KeePass entries into other windows:

Info Auto-Type

Auto-Type is a powerful feature that sends simulated keypresses to other applications.

You can find more details about it here: Auto-Type documentation page.

Info KeeForm and other Plugins

There are a lot of plugins available integrating KeePass directly with other applications. KeeForm (for Internet Explorer und Mozilla Firefox) allows completely automatic filling of webforms for example.

You can find these integration plugins on the KeePass Plugins page.


Database Settings - KeePass

Settings

Database Settings

Describes the various database options.

On the database settings dialog, you can configure various database-related settings.

  • General
  • Security Options
  • Protection Options
  • Compression Options
  • Templates

Info General

On this tab page you can specify general things like the name of the database and a description. Additionally, you can set various defaults like a default user name for new entries (created in this database).

Info Security Options

On this page you can specify various encryption-related settings. Only change this settings when you really know what you are doing.

Encryption Algorithm:
You can set the encryption algorithm, which is used to encrypt the database. All encryption algorithms offered by KeePass are well-known standard algorithms, regarded as very secure by the cryptography community. These standards are used by banks for example. All of the algorithms are unbroken; there is no "best" algorithm. If you don't know which algorithm to choose, use the Advanced Encryption Standard (AES, Rijndael) algorithm.

Key Transformation:
See Protection against Dictionary Attacks.

KeePass has a link button on this page to compute the number of key transformations your computer can do in 1 second. If you for example only want to wait 0.5 seconds, half the number resulted from the benchmark.

Info Protection Options

On this page you can configure run-time memory protection settings for this database. Fields can be stored encrypted in process memory. This ensures that no other application can read your data by dumping the memory of KeePass.

It is recommended to turn on memory protection for password fields and leave it disabled for all others. Process memory protection slows down all operations a bit, you should therefore carefully decide which fields are really worth to be protected this way.

Memory protection is useless if you display the fields in the main window (because if they are displayed in this window, they are automatically stored as plain-text in memory as Windows needs to be able to read it), therefore KeePass offers you to turn on visual hiding in the main window for the selected protected fields. It is highly recommended to check this option before closing the dialog.

Info Compression Options

KeePass databases can be compressed before being encrypted. Compression reduces the size of the database, but also slows down the database saving/loading process a bit.

It is recommended to use the GZip compression option. This algorithm is very fast (you won't notice any difference to saving the database without compression) and its compression rate is acceptable.

It is not recommended to save databases without compression.

On modern PCs, saving files with compression can actually be faster than saving without compression, because the compression process is performed by the CPU (which is very fast) and fewer data has to be transferred from/to the storage device. Especially when the device is slow (like saving to USB stick), compression can reduce the saving/loading time significantly.

Info Templates

Templates are a great way to predefine often used user names or additional fields, or combinations of each.

  • A template is a normal KeePass entry with all required data already entered.
  • Templates must be kept in a single group.
  • Do not put real data entries in the template group.

First create a normal group in the main window and then set it as the templates group in 'File' -> 'Database Settings' -> tab 'Templates'.

In order to create a new entry based on a template in the templates group, click the drop-down arrow of the 'Add Entry' toolbar button and choose the template to be used.


Entry Dialog - KeePass

VCard Document

Entry Dialog

Explains options in the entry dialog.

In this dialog you can edit properties of new and existing entries.

Info General

On this tab page you can specify the main information about the account. Apart from filling in standard information (user name, password, etc.), you can also assign an Expiry Time. When this date is reached, the entry is automatically marked as expired (using a red X icon in the main window and showing the entry information using a striked-out font). The entry is not deleted when it expires.

By default, KeePass generates a secure, random password for new entries. You can freely replace this generated password with an own one or invoke the password generator again (using the button on the right of the 'Repeat Password' field) to generate a password having different properties. For details (including information how to disable automatically generated passwords), see Password Generator.

A standard user name for new entries can be specified in the database settings dialog.

Info Advanced

On this tab page you can assign custom strings and file attachments to the entry.

Custom Strings:
Each entry can have an arbitrary amount of custom strings. These strings can hold any information of your choice (for example additional e-mail addresses, passwords, more URLs, etc.). The strings will be stored encrypted in the database (like all other database content).

To use the value of a custom field, you can right-click on the entry and select 'Copy Custom String', which is much easier than highlighting the data in the entry view and copying.

File Attachments / Binaries:
You can attach files to entries. The files will be imported into the KeePass database and associated with the entry. When importing files, KeePass does not delete the original source file! You need to delete them yourself, if you wish. File attachments are stored encrypted in the database (like all other database content).

Info Auto-Type

On this page you can configure the auto-type behaviour for this entry. For more information, see the Auto-Type help page.

Reload Document History

Each entry got its own history. Each time you change an entry, KeePass automatically creates a backup copy of the current, non-modified entry before saving the new values. These backup copies are listed on the History tab page. You can delete backup copies if you are sure that you won't need them anymore, or you can restore any of the backup copies.


GUI Options - KeePass

System

GUI Options

Explains various Graphical User Interface (GUI) options.
  • Dialog Banner Styles

Info Dialog Banner Styles

KeePass supports various different dialog banner styles. These styles are independent from the operating system and can freely be used on all systems.

WinXP Login:
WinXP Login Style

WinVista Black:
WinVista Style

KeePass Win32:
Old KeePass Win32 Style

Blue Carbon:
Blue Carbon Style


Loading/Saving From/To URL - KeePass

Browsing

Loading/Saving From/To URL

KeePass can load/save databases from/to URLs.

In this dialog you can specify an URL, from/to which data is read/written.

By default, KeePass supports FTP and HTTP, but additional protocols might be available on your system (if specific providers are installed).

Server Example: Using FTP Server

In order to load/save your database from/to an FTP server, you first need to upload the database file to the server manually. This only needs to be done once.

Then start KeePass and go 'File' -> 'Open' -> 'Open URL...'. Enter the full database path on the server and don't forget the ftp:// prefix! This prefix is required, otherwise KeePass doesn't know which protocol to use. Enter the FTP credentials and click [OK]. KeePass will download the file and open it.

KeePass can remember the FTP credentials, if you wish. You can choose between remembering everything (user name and password), partially (user name only) and not remembering the credentials at all.

When you press the 'Save' button, KeePass will automatically upload the new database file to the server (same location as before, i.e. overwriting the previous one).


Administrative FAQ - KeePass

Help

Administrative FAQ

Frequently Asked Questions about the project, licensing, ...
  • How can I help you? (Supporting the KeePass project)
  • May KeePass be used in a company?
  • What about a centralized KeePass Internet server?

Info How can I help you?

If you like KeePass and would like to help the developers in some way:

  • Donate
    This is the best way of helping, if you don't have that much time or experience in application development.
  • Make a translation
    If you have some free time, you could make a translation of KeePass (of course only if you're language isn't offered already).
  • Test new releases and report bugs
    KeePass is under constant development, new features get implemented, bugs get fixed. If you have some free time, you could test new releases thoroughly and report bugs. If you're a programmer, look through the sources to find bugs and maybe even submit fixes.
  • Spread the word
    If you like KeePass, tell all your friends how great KeePass is, publish articles about it, press it on CDs/DVDs, ship USB sticks preinstalled with it, submit it to software archives, talk in forums about it, etc.!

Info May KeePass be used in a company?

Yes. KeePass is free software and you don't have to pay any fees. You may freely use KeePass under the terms of its license.

But of course, if you like KeePass, donations are always greatly appreciated.

Info What about a centralized KeePass Internet server?

The idea on the first glance sounds simple and useful: there should be a centralized KeePass Internet server, on which all users can store their passwords. By having Internet connection, you'd have access to all your passwords.

Note that this idea is different from simply providing webspace. KeePass 2.x already supports storing databases on servers using HTTP/FTP. The point is having one server for all users.

When creating such a server, there are several difficulties:

  • A fairly complex synchronization and caching mechanism will be required. You won't want to transfer the complete database, otherwise the service will be unusable for everyone storing attachments, etc.

  • Directly related to the previous point: in order to do synchronization, the server needs to be able to read and understand databases, i.e. some dedicated KeePass server would need to be written. While the transport way could be secure HTTPS, the server certainly has some user data as plain text in memory for some time. One needs to be very careful here. What to do if the server gets compromised? The security implications would be horrible, if an attacker could read any user data.

  • How to avoid server compromises? If a normal Internet server is compromised, the security implications are minimal: in the worst case all user accounts and data for this website are lost. But with KeePass server, whole identities would be lost. An attacker couldn't only impersonate someone on this particular server, but on the complete Internet and real world, depending on what is stored in the databases.

    Therefore, banking-level security systems would be required for a KeePass server. Keeping PHP / ASP / Linux / Windows (or whatever will be used) up-to-date definitely is not enough here.

  • Basically you offer people webspace for their databases, therefore the service obviously will cost something. By charging people, they expect reliability and you need to make up-time guarantees. Therefore, at least 2 servers are required (by different hosters), which need to be synchronized.

Summary: a centralized Internet server currently is out of range. If someone wants to start a company providing such a service, feel free to use KeePass as base application (of course respect the Open Source terms).

But what can and probably will be done later is a local intranet KeePass server (for companies for example). Employees could log in to the company's password server and use it. But a centralized Internet server -- no chance.


Technical FAQ - KeePass

Help

Technical FAQ

Frequently Asked Questions about the usage of KeePass.

Configuration:
  • I've saved my options, but when I reopen KeePass I get the old options. What's wrong?
Installation / Integration:
  • Why doesn't KeePass 2.x run on my computer?
  • Why does KeePass 2.x crash when starting it from a network drive/share?
  • Why does KeePass 2.x show a FIPS compliance error at startup?
  • Why doesn't the CHM help file work?
  • Where can I find more application icons for Windows shortcuts?
  • How can I add more client icons for password entries?
  • Does KeePass support a mini mode?
  • Why doesn't KeePass lock after Auto-Type?
  • Why doesn't Auto-Type work correctly on Polish systems?
Security:
  • Is Auto-Type keylogger-safe?
  • Can Auto-Type locate child controls?
  • Could you add the ... encryption algorithm to KeePass?
  • Why doesn't KeePass lock when Windows locks and a KeePass sub-dialog is open?
  • Printing creates a temporary file. Will it be erased securely?
Usage:
  • Can I directly edit file attachments?
  • How to store and work with large amounts of (formatted) text?

Info I've saved my options, but when I reopen KeePass I get the old options. What's wrong?

KeePass supports two different locations for storing configuration information: the global configuration file in the KeePass directory and a local, user-dependent one in the user's private configuration folder. Most likely you do not have write access to your global configuration file.

For more details, see Cascading Configuration.

Info Why doesn't KeePass 2.x run on my computer?

Symptoms: When trying to run KeePass 2.x on Windows ≤ XP, an error message like the following is displayed:
"A required .DLL file, MSCOREE.DLL, was not found", or
"The application failed to initialize properly (0xc0000135)".

Cause: KeePass 2.x requires Microsoft .NET Framework ≥ 2.0.

Resolution: Install Microsoft .NET Framework 2.0 or higher. It is available as a free download from the Microsoft website: Microsoft .NET Framework download. Alternatively, you can install it through Windows Update (the framework is an optional component).

KeePass 1.x does not require this framework.

Info Why does KeePass 2.x crash when starting it from a network drive/share?

Symptoms: When trying to run KeePass 2.x from a network drive/share, you get an error message like the following:
"Application has generated an exception that could not be handled", or
"KeePass has encountered a problem and needs to close".

Cause: The strict default security policy by the Microsoft .NET Framework disallows running .NET applications from a network drive/share.

Recommended resolution: Copy/install KeePass 2.x onto a local hard disk, and run the copy.

Alternative, not recommended resolution: Configure the security policy to allow running .NET applications from network drives/shares. Ask your administrator to do this (administrative rights are required). If you got administrative rights and want to do it yourself, you can use the Code Access Security Policy Tool (Caspol.exe) that ships with the .NET framework (helpful instructions can be found here and here).

Info Why does KeePass 2.x show a FIPS compliance error at startup?

Symptoms: When trying to run KeePass 2.x, you get an error message like the following:
"This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.".

Cause: KeePass uses the AES/Rijndael encryption and SHA-256 hashing algorithms, for which the Microsoft .NET Framework provides implementations. These implementations might not be FIPS compliant. If the local security policy of the system enforces the usage of FIPS compliant implementations, KeePass cannot run and shows an error message.

Resolution: Configure the local security policy of the system to allow FIPS non-compliant algorithm implementations. To do this, go to Control Panel -> Administrative Tools -> Local Security Policy, open Local Policies -> Security Options, and change the option 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' to 'Disabled'.

Alternative resolution: Download and run the following Windows registry file: FipsDisable.reg. By running this file (i.e. importing the modifications in this file into the registry), FIPS compliance enforcement is disabled.

Note: Currently only weaker cryptographic algorithms in the Microsoft .NET Framework are FIPS compliant. As security is the top priority for the KeePass project, an option to use these weaker FIPS compliant algorithms will not be added. Future .NET frameworks might have FIPS compliant implementations of the algorithms that KeePass requires.

Info Why doesn't the CHM help file work?

Symptoms: When trying to open the KeePass CHM help file from a remote computer or shared network drive, it's not displayed correctly (navigation aborted, ...).

Solution: See Microsoft Security Bulletin MS05-026.

Info Where can I find more application icons for Windows shortcuts?

Application icons are icons in Windows ICO format. They can be used in Windows shortcuts and/or as file association icons. The KeePass executable contains various application icons which can be used for these purposes.

Additional application icons are available from the "Ext/Icons" directory of the KeePass source code download. Most of them, shown at right, are slight variations of the main KeePass icon.

Even more, contributed icons (by users) can be found on the plugins page.

If you have multiple KeePass databases, you can use differently colored KeePass application icons in order to distinguish them.

These icons are not included in the binary distribution because this would make the application file too large.

 Application Icons

Info How can I add more client icons for password entries?

Client icons are the icons used for password entries and groups within KeePass. Each entry can be assigned its own icon.

You can import your own icons into KeePass databases. For this, click the 'Add...' button in the icon picker dialog.

Images are automatically resized to 16x16, if they are larger or smaller. Supported formats are BMP, EMF, GIF, ICO, JPEG, PNG, TIFF and WMF.
Application Icons

Info Can I directly edit file attachments?

No, this is not possible (exception: text files, see working with large texts). In order to edit attachments, you need to save them to a (temporary) file, edit it using an external application, import it back to KeePass as attachment, and finally delete the temporary file.

There will no feature be implemented that automates these steps, because of security problems. To see the problems, let's assume that KeePass would support editing attachments. When you click a button, KeePass would save the attachment to a file and open it using its associated external application. When the external application is closed, KeePass would import the temporary file and delete it securely. But what happens when KeePass is closed before the external application? KeePass cannot delete the file because it's eventually locked by the external application. Theoretically KeePass could tell the user this fact before closing, but what to do when the computer shuts down? Here, there's no time left to ask the user what to do. The temporary file would have been leaked, i.e. left unencryptedly on disk, which is obviously very bad.

One could argue that the leakage would only be temporary: at the next start, KeePass could scan the temporary directory for remaining files and delete them. Anyway, the files would be freely accessible (unencrypted) by all other applications during a complete computer shutdown and boot process. If you don't start KeePass on this computer ever again, the file is leaked forever. As KeePass is designed to be portable, i.e. may be securely used on many computers, this temporary leakage is unacceptable.

Info Does KeePass support a mini mode?

A mini mode is not supported yet.

Info Why doesn't KeePass lock after Auto-Type?

This does not apply to KeePass 2.x.

Info Why doesn't Auto-Type work correctly on Polish systems?

On Polish systems, the default auto-type hot key Ctrl-Alt-A conflicts with a system command and is frequently used in typing. Therefore, auto-type is often executed accidentally.

The global auto-type hot key can be changed to a different key combination in the KeePass options (see Auto-Type for details).

Info Why doesn't printing work in KeePass 1.x?

Symptoms: When trying to print a password list in KeePass 1.x, nothing happens after clicking OK in the 'Print Options' dialog.

Cause: KeePass 1.x uses the application associated with .html files to print the password list. If this application doesn't support the "print" shell verb (like Mozilla Firefox), nothing happens.

Resolution: Associate .html files with a different application that supports the "print" shell verb (like Internet Explorer).

Alternative Resolution / Workaround: Click 'File' -> 'Print Preview' in KeePass 1.x and manually print the document in the application that just opened the file.

Info Is Auto-Type keylogger-safe?

Is the Auto-Type feature resistant to keyloggers?

By default: no. The Auto-Type method in KeePass 2.x works the same as the one in 1.x and consequently is not keylogger-safe.

However, KeePass features an alternative method called Two-Channel Auto-Type Obfuscation (TCATO), which renders keyloggers completely useless. This is an opt-in feature (because it doesn't work with all windows) and must be enabled for entries manually. See the TCATO documentation for details.

Key Can Auto-Type locate child controls?

No. Auto-Type only checks whether the title of the currently active top level window matches.

Browsers like Mozilla Firefox completely draw the window (all controls) themselves, without using standard Windows controls. Consequently it is technically impossible for KeePass to check whether an URL matches (methods like creating a screenshot and using optical character recognition are not reliable and secure). Also, it's impossible to check which child control currently has the focus. These problems can only be avoided by using browser integration plugins, i.e. not using auto-type at all.

The user must make sure that the focus is placed in the correct control before starting auto-type.

Info Could you add the ... encryption algorithm to KeePass?

Only Rijndael (AES) is supported, but KeePass supports additional algorithms through encryption plugins. You can find encryption plugins on the plugins page.

If you'd like to implement an algorithm, have a look at the ArcFourCipher sample plugin.

Info Why doesn't KeePass lock when Windows locks and a KeePass sub-dialog is open?

KeePass automatically tries to lock its workspace when Windows is locked, with one exception: when a KeePass sub-dialog (like the 'Edit Entry' window) is currently opened, the workspace is not locked.

To understand why this behavior makes sense, it is first important to know what happens when the workspace is locked. When locking, KeePass completely closes the database and only remembers several view parameters, like the last selected group, the top visible entry, selected entries, etc. From a security point of view, this achieves best security possible: breaking a locked workspace is equal to breaking the database itself.

Now back to the original question. Let's assume an edit dialog is open and the workstation locks. What should KeePass do now? Obviously, it's too late to ask the user what to do (the workstation is locked already and no window can't be displayed), consequently KeePass must make an automatic decision. There are several possibilities:

  • Do not save the database and lock.
    In this case, all unsaved data of the database would be lost. This not only applies to the data entered in the current dialog, but to all other entries that have been modified previously.
  • Save the database and lock.
    In this case, possibly unwanted changes are saved. Often you open files, try something, having in mind that you can just close the file without saving the changes. KeePass has an option 'Automatically save database when KeePass closes or the workspace is locked'. If this option is enabled and no sub-dialog is open, it's clear what to do: try to save the database and if successful: lock the workspace. But what to do with the unsaved changes in the sub-dialog? Should it be saved automatically, taking away the possibility of pressing the 'Cancel' button?
  • Save to a temporary location and lock.
    While this sounds the best alternative at first glance, there are several problems with it, too. First of all, saving to a temporary location could fail (for example there could be too few disk space or some other program like virus scanner could have blocked it). Secondly, saving to a temporary location isn't uncritical from a security point of view. When having to choose such a location, mostly the user's temporary directory on the hard disk is chosen (because it likely has enough free space, required rights for access, etc.). Therefore, KeePass databases could be leaked and accumulated there. It's not clear what should happen if the computer is shutdown or crashes while being locked. When the database is opened the next time, should it use the database stored in the temporary directory instead? What should happen if the 'real' database has been modified in the meanwhile (quite a realistic situation if you're carrying your database on an USB stick)?

Obviously, none of these alternatives is satisfactory. Therefore, KeePass implements the following simple and easy to understand behavior:

When Windows is locked and a KeePass sub-dialog is opened, the KeePass workspace is not locked.

This simple concept avoids all the problems above. The user is responsible for the state of the program.

Security consequence: the database is left open when Windows locks. Normally, you are the only one who can log back in to Windows. When someone else logs in (like administrator), he can't use your programs anyway. By default, KeePass keeps in-memory passwords encrypted, therefore it does not matter if Windows caches the process to disk at some time. So, your passwords are pretty safe anyway.

Note. On Windows ≤ XP, the 'Terminal Services' Windows service should be enabled. If this service is disabled, locking KeePass when Windows locks might not work. This service isn't required on newer operating systems.

Info Printing creates a temporary file. Will it be erased securely?

KeePass creates a temporary HTML file when printing password lists and showing print previews. This file is securely erased (i.e. overwritten multiple times before being removed from the file system tree) when closing the database.

You must wait for the file being printed completely before closing KeePass (and close the print preview before closing KeePass), otherwise it could happen that the printing application blocks KeePass from deleting the file.

There is no way around the temporary file in the current printing system. If you want to write a plugin that directly sends the data to the printer, you can find a plugin development tutorial here: KeePass 2.x Plugin Development.

Info How to store and work with large amounts of (formatted) text?

KeePass has a built-in editor that allows working conveniently with large amounts of (formatted) texts.

To add a large text to an entry, import the file as attachment. The built-in editor supports *.TXT (simple text) and *.RTF (formatted text) files.

In order to edit an attachment, right-click onto the entry in the main window, point on 'Attachments' and click 'Edit YourFile.*'. Alternatively, if the text file is the only attachment, you can even open it by just double-clicking onto it in the main window (enable showing the attachment column in 'View' -> 'Show Columns' -> 'Attachments'). Alternatively, it's also possible to click the name of the attachment in the entry details view in the main window.

For TXT files, the built-in editor supports standard operations like cut, copy, paste, undo, word wrap, etc. For RTF files, additionally standard formatting commands are available: choosing the font, font size, bold, italic, underline, strikeout, text and background colors, align left / center / right, etc. 		Editor screenshot


Plugin Development - KeePass

Settings

Plugin Development

How to develop plugins for KeePass 2.x.

This documentation applies to KeePass 2.x plugins. 2.x plugins are fundamentally different from 1.x plugins. 1.x plugins cannot be loaded by KeePass 2.x.

  • Requirements
  • Step-by-Step Tutorial
  • Common Operations
  • Plugin Conventions
  • Can KeePass 2.x Plugins be written in Unmanaged C++?
  • PLGX Files

Info Requirements

Before you can start developing a KeePass plugin, you need the following prerequisites:

  • Latest KeePass source code package. You can get it from the KeePass homepage.
  • A C# 2.0 development IDE (Microsoft Visual Studio, SharpDevelop or any other IDE).

Info Step-by-Step Tutorial

Start your favorite IDE and create a new C# Class Library project. In this tutorial the example plugin we're developing is called SamplePlugin. The first thing you need to do now is to add a reference to KeePass: go to the references dialog and select the KeePass.exe file. After you added the reference, the namespaces KeePass and KeePassLib should be available.

KeePass plugins all need to derive from a base KeePass plugin class (Plugin in the KeePass.Plugins namespace). By overriding methods of this class, you can customize the behaviour of your plugin.

A minimal plugin looks like this:

using System;
using System.Collections.Generic;

using KeePass.Plugins;

namespace SamplePlugin
{
    public sealed class SamplePluginExt : Plugin
    {
        private IPluginHost m_host = null;

        public override bool Initialize(IPluginHost host)
        {
            m_host = host;
            return true;
        }
    }
}

You can find a fully documented and extended version of this simple plugin on the KeePass plugins web page.

This plugin does exactly nothing, but it shows some important conventions already, which must be followed by all plugins:

  • The namespace must be named like the DLL file without extension. Our DLL file is named SamplePlugin.dll, therefore the namespace must be called SamplePlugin.
  • The main plugin class (which KeePass will instanciate when it loads your plugin) must be called exactly the same as the namespace plus "Ext". In this case: "SamplePlugin" + "Ext" = "SamplePluginExt".
  • The main plugin class must be derived from the KeePass.Plugins.Plugin base class.

The Initialize function is the most important one and you probably will always override it. In this function, you get an interface to the KeePass internals: an IPluginHost interface reference. By using this interface, you can access the KeePass main menu, the currently opened database, etc. The Initialize function is called immediately after KeePass loads your plugin. All initialization should be done in this function (not in the constructor of your plugin class!). If you successfully initialized everything, you must return true. If you return false, KeePass will immediately unload your plugin.

A second function that you will need very often is the Terminate function:

public override void Terminate()
{
}

This function is called shortly before KeePass unloads your plugin. You cannot abort this process (it's just a notification and your last chance to clean up all used resources, etc.). Immediately after you return from this function, KeePass can unload your plugin. It is highly recommended to free all resources in this function (not in the destructor of your plugin class!).

We're almost done! We now need to tell KeePass that our file is a KeePass plugin. This is done by editing the Version Information Block of the file. Open the file version editing dialog (in Visual Studio 2005: right-click onto the project name - 'Properties' - button 'Assembly Information'). All fields can be assigned freely except the Product Name field (for more information see Plugin Conventions). This field must be set to "KeePass Plugin" (without the quotes).

That's it! Now try to compile your plugin and copy the resulting DLL file into the KeePass directory. If you start KeePass and go to the plugins dialog, you should see your plugin in the list of loaded plugins!

Info Common Operations

Adding Menu Items:

Very often you want to add some menu items for your plugin. When clicked by the user, your plugin should get some notification. This can be done like follows. First of all you need to get a reference to the KeePass main menu or one of the special submenus (like Import, Tools, etc.). For this you can use the IPluginHost interface, which you received in the Initialize function. Then you can use standard tool strip operations to add a new menu item for your plugin. A very simple example, which adds a menu item to the Tools menu:

private ToolStripSeparator m_tsSeparator = null;
private ToolStripMenuItem m_tsmiMenuItem = null;

public override bool Initialize(IPluginHost host)
{
    m_host = host;

    // Get a reference to the 'Tools' menu item container
    ToolStripItemCollection tsMenu = m_host.MainWindow.ToolsMenu.DropDownItems;

    // Add a separator at the bottom
    m_tsSeparator = new ToolStripSeparator();
    tsMenu.Add(m_tsSeparator);

    // Add menu item 'Do Something'
    m_tsmiMenuItem = new ToolStripMenuItem();
    m_tsmiMenuItem.Text = "Do Something";
    m_tsmiMenuItem.Click += OnMenuDoSomething;
    tsMenu.Add(m_tsmiMenuItem);
}

public override void Terminate()
{
    // Remove all of our menu items
    ToolStripItemCollection tsMenu = m_host.MainWindow.ToolsMenu.DropDownItems;
    tsMenu.Remove(m_tsSeparator);
    tsMenu.Remove(m_tsmiMenuItem);
}

private void OnMenuDoSomething(object sender, EventArgs e)
{
    // Called when the menu item is clicked
}

If you are working with tool strips, you of course have to add a reference to System.Windows.Forms of the .NET framework.

It is highly recommended that you remove all menu items created by your plugin in the Terminate function (as shown in the example above). After the Terminate function has been called, everything should look like before loading your plugin.

In the example, we created a separator and one menu item. To this menu item an event handler for the Click event is attached. There's nothing special, this is all standard Windows.Forms stuff.

For examples of adding popup menus, see the SamplePlugin sample plugin (obtainable from the KeePass plugins page).

Adding Groups and Entries:

For this, see the sample plugin and the KeePassLib documentation.

Info Plugin Conventions

File Version Information Block:

KeePass uses the file version information block to detect if a DLL file is a KeePass plugin and retrieves information from it to show in the plugins dialog. The fields are used as follows:

  • Title: Should contain the full name of the plugin.
  • Description: Should contain a short description (not more than 5 lines) of your plugin.
  • Company: Should contain the author name of the plugin.
  • Product Name: Must be set to "KeePass Plugin" (without the quotes).
  • Copyright: Not used by KeePass; freely assignable by the plugin.
  • Trademarks: Not used by KeePass; freely assignable by the plugin.
  • Assembly Version: Should be set to the recommended KeePass version (i.e. the KeePass version your plugin is built for).
  • File Version: Should be set to the version of your plugin. It is up to you how you are versioning your plugin builds, but it should be a scheme that allows version comparisons (based on string comparisons).
  • GUID: Not used by KeePass; freely assignable by the plugin.

Namespace and Class Naming:

The namespace must be named like the DLL file without extension. For example, if the DLL file is named SecretImporter.dll, you must call the namespace SecretImporter.

The plugin class must be named like the namespace plus "Ext". For the SecretImporter plugin, this would be SecretImporterExt.

Info Can KeePass 2.x Plugins be written in Unmanaged C++?

Yes and no. You can write the complete logic of your plugin in unmanaged C++ (native Win32 APIs can be used). Anyway you must provide a managed interface to your plugin, i.e. you must export a managed class derived from the Plugin base class as described in the step-by-step tutorial.

Also, managed C++ will be required to modify the KeePass internals (i.e. entries, groups, main window, ...).

For an example how to use unmanaged APIs in a managed C++ plugin assembly, see the SamplePluginCpp sample plugin (obtainable from the KeePass plugins page).

Info PLGX Files

PLGX is an optional plugin file format for KeePass ≥ 2.09. Instead of compiling your plugin to a DLL assembly, the plugin source code files can be packed into a PLGX file and KeePass will compile the plugin itself when loading it. The advantage of this approach is that plugins don't need to be recompiled by the plugin developers for each KeePass release anymore (as KeePass compiles the plugin itself, the generated plugin assembly references the current, correct KeePass assembly). Instead of shipping a plugin DLL assembly, you ship the PLGX.

For users, nothing changes. Instead of putting the plugin DLL assembly into the KeePass application directory, the PLGX file needs to be put there.

Creating PLGX files. PLGX files can be created from plugin sources by calling KeePass.exe with the --plgx-create command line parameter. If you additionally pass a path to the plugin sources directory (without terminating separator), KeePass will use this one; otherwise it'll show a folder browser dialog to allow you selecting the directory. If you want to pass the directory location using the command line, make sure that you're specifying a full, absolute path -- relative paths will not work.

In order to keep the size of the PLGX file small, it is recommended that you clean up the plugin sources directory before compiling the PLGX. Remove all unnecessary binary files (files in the bin and obj directory); especially, delete any plugin assembly DLL that you compiled yourself. Temporary files by the IDE (like .suo and .user files) can also be deleted.

PLGX features:

  • Extensible, object-oriented file format.
  • Compression support (data files are compressed using GZip).
  • .csproj support. KeePass retrieves all information required for compiling the plugin assembly from the .csproj file in the plugin sources.
  • Embedded resources support.
  • Referenced .NET assemblies support. References information is read from the .csproj file.
  • Referenced custom assemblies support. Third-party assemblies required by the plugin (references to DLLs) are supported, provided that the third-party assembly is located in the plugin source code directory (or any subdirectory of it).
  • ResX support. .resx files are automatically compiled to binary .resources files.
  • .NET 3.5 support (if the default compiler, which is the one of .NET 2.0, can't compile the code, KeePass tries using the .NET 3.5 compiler).
  • PLGX cache. PLGX files are compiled once and the generated assembly is stored in a cache. For all following KeePass starts, no compiling is required.
  • PLGX cache maintenance. The size of the PLGX cache can be seen in the KeePass plugins dialog. Here, the cache can also be marked to be cleared (it will be cleared when KeePass is started the next time). An option to automatically delete old files from the cache is supported and enabled by default.

PLGX limitations:

  • Currently only C# is supported (not Visual Basic or any other .NET language).
  • Linked resources (in different assemblies) are unsupported.
  • Dependencies on other projects are unsupported (reorganize your project to use custom assembly references instead).

Defining prerequisites. You can optionally specify a minimum KeePass version, a minimum installed .NET Framework, an operating system and the minimum size of a pointer (x86 vs. x64) using the --plgx-prereq-kp:, --plgx-prereq-net:, --plgx-prereq-os: and --plgx-prereq-ptr: command line options. If one of the plugin prerequisites isn't met, KeePass shows a detailed error message to the end-user (instead of a generic plugin incompatibility message). Build example:
KeePass.exe --plgx-create C:\YourPluginDir --plgx-prereq-kp:2.09 --plgx-prereq-net:3.5

Valid operating system values are Windows and Unix. When running on an unknown operating system, KeePass defaults to Windows. Pointer sizes (checking for x86 vs. x64) are specified in bytes; for example, to only allow running on x64, you specify --plgx-prereq-ptr:8.

Build commands. Optionally you can specify pre-build and post-build commands using --plgx-build-pre: and --plgx-build-post:. These commands are embedded in the PLGX file and executed when compiling the plugin on the end-user's system.

In the build commands, the placeholder {PLGX_TEMP_DIR} specifies the temporary directory (including a terminating separator), to which the files were extracted. In the post-build command, {PLGX_CACHE_DIR} is replaced by the cache directory of the plugin (including a terminating separator), into which the generated assembly was stored.

These build commands can for example be used to copy additional files into the cache directory. Example:
KeePass.exe --plgx-create C:\YourPluginDir --plgx-build-post:"cmd /c COPY """{PLGX_TEMP_DIR}MyFile.txt""" """{PLGX_CACHE_DIR}MyFile.txt""""

In order to specify a quote character on the command line, it has to be encoded using three quotes (this is Windows standard, see MSDN: SHELLEXECUTEINFO). So, the command line above will actually embed the post-build command cmd /c COPY "{PLGX_TEMP_DIR}MyFile.txt" "{PLGX_CACHE_DIR}MyFile.txt" into the PLGX, which is correct. It is highly recommended to surround paths including PLGX placeholders using quotes, otherwise the command will not run correctly if the path contains a space character (which happens very often).

If you need to run multiple commands, write them into a batch file and execute it (with cmd). If you need to perform more complex build tasks, write an own building executable and run it using the build commands (typically it is useful to pass the directory locations as arguments to your building executable), for example:
KeePass.exe --plgx-create C:\YourPluginDir --plgx-build-post:"{PLGX_TEMP_DIR}MyBuild.exe {PLGX_TEMP_DIR} {PLGX_CACHE_DIR}"


Scripting Introduction - KeePass

Console

Scripting KeePass (2.x)

How to automate database operations in KeePass 2.x.

Prerequisites:

In order to automate KeePass, you need the KPScript plugin/extension. You can find the latest version of KPScript on the KeePass plugins web page. The KPScript.exe file needs to be copied into the directory where KeePass is installed (where the KeePass.exe file is).

There are two ways to automate KeePass: single command operations and KPS script files.

  • Single Command Operations: KPScript can be invoked using single commands. By passing the database location, its key, a command and eventually some parameters, simple operations like adding an entry can be performed. The syntax is very simple, no scripting knowledge is required. This method is ideal when you quickly want to do some small changes to the database. It is not recommended when you need to perform many operations, because for each command the database needs to be loaded from file, decrypted, modified, encrypted and written back to file.

  • KPS Script Files: These files are a lot more powerful than single command operations, but are also more complicated. You need to have heavy experience in C# programming and the KeePass 2.x internals. Within KPS files you can do everything that KeePass does.


Acknowledgements - KeePass

Help

Nuvola Icons License

License of the 'Nuvola' icon theme by David Vignoni.

Usage of the 'Nuvola' icons is allowed under the terms of the LGPL license (which you can find here: GNU Lesser General Public License), plus an addition. Here's the original distribution notice:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
This copyright and license notice covers the images in this directory.
Note the license notice contains an add-on.
************************************************************************

TITLE:	NUVOLA ICON THEME for KDE 3.x
AUTHOR:	David Vignoni | ICON KING
SITE:	http://www.icon-king.com
MAILING LIST: http://mail.icon-king.com/mailman/listinfo/nuvola_icon-king.com

Copyright (c)  2003-2004  David Vignoni.

This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation,
version 2.1 of the License.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library (see the the license.txt file); if not, write to the
Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#######**** NOTE THIS ADD-ON ****#######
The GNU Lesser General Public License or LGPL is written for software libraries
in the first place. The LGPL has to be considered valid for this artwork
library too.
Nuvola icon theme for KDE 3.x is a special kind of software library, it is an
artwork library, it's elements can be used in a Graphical User Interface, or
GUI.
Source code, for this library means:
 - raster png image* .
The LGPL in some sections obliges you to make the files carry
notices. With images this is in some cases impossible or hardly usefull.
With this library a notice is placed at a prominent place in the directory
containing the elements. You may follow this practice.
The exception in section 6 of the GNU Lesser General Public License covers
the use of elements of this art library in a GUI.
dave [at] icon-king.com

Date:       15 october 2004
Version:    1.0

DESCRIPTION:

Icon theme for KDE 3.x.
Icons where designed using Adobe Illustrator, and then exported to PNG format.
Icons shadows and minor corrections were done using Adobe Photoshop.
Kiconedit was used to correct some 16x16 and 22x22 icons.

LICENSE

Released under GNU Lesser General Public License (LGPL)
Look at the license.txt file.

CONTACT

David Vignoni
e-mail :        david [at] icon-king.com
ICQ :           117761009
http:           http://www.icon-king.com


Disclaimer

This disclaimer applies to the KeePass program, website and help pages.
  • English Disclaimer
  • German Haftungsausschluss

Disclaimer

1. Content

The author reserves the right not to be responsible for the topicality, correctness, completeness or quality of the information provided. Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will therefore be rejected.

All offers are not-binding and without obligation. Parts of the pages or the complete publication including all offers and information might be extended, changed or partly or completely deleted by the author without separate announcement.

2. Referrals and links

The author is not responsible for any contents linked or referred to from his pages - unless he has full knowledge of illegal contents and would be able to prevent the visitors of his site from viewing those pages. If any damage occurs by the use of information presented there, only the author of the respective pages might be liable, not the one who has linked to these pages. Furthermore the author is not liable for any postings or messages published by users of discussion boards, guestbooks or mailinglists provided on his page.

3. Copyright

The author intended not to use any copyrighted material for the publication or, if not possible, to indicate the copyright of the respective object.

The copyright for any material created by the author is reserved. Any duplication or use of objects such as images, diagrams, sounds or texts in other electronic or printed publications is not permitted without the author's agreement.

4. Privacy policy

If the opportunity for the input of personal or business data (email addresses, name, addresses) is given, the input of these data takes place voluntarily. The use and payment of all offered services are permitted - if and so far technically possible and reasonable - without specification of any personal data or under specification of anonymized data or an alias. The use of published postal addresses, telephone or fax numbers and email addresses for marketing purposes is prohibited, offenders sending unwanted spam messages will be punished.

We use third-party advertising companies (Google) to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by Google, click here.

5. Legal validity of this disclaimer

This disclaimer is to be regarded as part of the internet publication which you were referred from. If sections or individual terms of this statement are not legal or correct, the content or validity of the other parts remain uninfluenced by this fact.

Haftungsausschluss

1. Inhalt des Onlineangebotes

Der Autor übernimmt keinerlei Gewähr für die Aktualität, Korrektheit, Vollständigkeit oder Qualität der bereitgestellten Informationen. Haftungsansprüche gegen den Autor, welche sich auf Schäden materieller oder ideeller Art beziehen, die durch die Nutzung oder Nichtnutzung der dargebotenen Informationen bzw. durch die Nutzung fehlerhafter und unvollständiger Informationen verursacht wurden, sind grundsätzlich ausgeschlossen, sofern seitens des Autors kein nachweislich vorsätzliches oder grob fahrlässiges Verschulden vorliegt.

Alle Angebote sind freibleibend und unverbindlich. Der Autor behält es sich ausdrücklich vor, Teile der Seiten oder das gesamte Angebot ohne gesonderte Ankündigung zu verändern, zu ergänzen, zu löschen oder die Veröffentlichung zeitweise oder endgültig einzustellen.

2. Verweise und Links

Bei direkten oder indirekten Verweisen auf fremde Webseiten ("Hyperlinks"), die außerhalb des Verantwortungsbereiches des Autors liegen, würde eine Haftungsverpflichtung ausschließlich in dem Fall in Kraft treten, in dem der Autor von den Inhalten Kenntnis hat und es ihm technisch möglich und zumutbar wäre, die Nutzung im Falle rechtswidriger Inhalte zu verhindern.

Der Autor erklärt hiermit ausdrücklich, dass zum Zeitpunkt der Linksetzung keine illegalen Inhalte auf den zu verlinkenden Seiten erkennbar waren. Auf die aktuelle und zukünftige Gestaltung, die Inhalte oder die Urheberschaft der verlinkten / verknüpften Seiten hat der Autor keinerlei Einfluss. Deshalb distanziert er sich hiermit ausdrücklich von allen Inhalten aller verlinkten / verknüpften Seiten, die nach der Linksetzung verändert wurden. Diese Feststellung gilt für alle innerhalb des eigenen Internetangebotes gesetzten Links und Verweise sowie für Fremdeinträge in vom Autor eingerichteten Gästebüchern, Diskussionsforen, Linkverzeichnissen, Mailinglisten und in allen anderen Formen von Datenbanken, auf deren Inhalt externe Schreibzugriffe möglich sind. Für illegale, fehlerhafte oder unvollständige Inhalte und insbesondere für Schäden, die aus der Nutzung oder Nichtnutzung solcherart dargebotener Informationen entstehen, haftet allein der Anbieter der Seite, auf welche verwiesen wurde, nicht derjenige, der über Links auf die jeweilige Veröffentlichung lediglich verweist.

3. Urheber- und Kennzeichenrecht

Der Autor ist bestrebt, in allen Publikationen die Urheberrechte der verwendeten Bilder, Grafiken, Tondokumente, Videosequenzen und Texte zu beachten, von ihm selbst erstellte Bilder, Grafiken, Tondokumente, Videosequenzen und Texte zu nutzen oder auf lizenzfreie Grafiken, Tondokumente, Videosequenzen und Texte zurückzugreifen.

Alle innerhalb des Internetangebotes genannten und ggf. durch Dritte geschützten Marken- und Warenzeichen unterliegen uneingeschränkt den Bestimmungen des jeweils gültigen Kennzeichenrechts und den Besitzrechten der jeweiligen eingetragenen Eigentümer. Allein aufgrund der bloßen Nennung ist nicht der Schluss zu ziehen, dass Markenzeichen nicht durch Rechte Dritter geschützt sind!

Das Copyright für veröffentlichte, vom Autor selbst erstellte Objekte bleibt allein beim Autor der Seiten. Eine Vervielfältigung oder Verwendung solcher Grafiken, Tondokumente, Videosequenzen und Texte in anderen elektronischen oder gedruckten Publikationen ist ohne ausdrückliche Zustimmung des Autors nicht gestattet.

4. Datenschutz

Sofern innerhalb des Internetangebotes die Möglichkeit zur Eingabe persönlicher oder geschäftlicher Daten (Emailadressen, Namen, Anschriften) besteht, so erfolgt die Preisgabe dieser Daten seitens des Nutzers auf ausdrücklich freiwilliger Basis. Die Inanspruchnahme und Bezahlung aller angebotenen Dienste ist - soweit technisch möglich und zumutbar - auch ohne Angabe solcher Daten bzw. unter Angabe anonymisierter Daten oder eines Pseudonyms gestattet. Die Nutzung der im Rahmen des Impressums oder vergleichbarer Angaben veröffentlichten Kontaktdaten wie Postanschriften, Telefon- und Faxnummern sowie Emailadressen durch Dritte zur übersendung von nicht ausdrücklich angeforderten Informationen ist nicht gestattet. Rechtliche Schritte gegen die Versender von sogenannten Spam-Mails bei Verstössen gegen dieses Verbot sind ausdrücklich vorbehalten.

Wir greifen auf Drittanbieter (Google) zurück, um Anzeigen zu schalten, wenn Sie unsere Website besuchen. Diese Unternehmen nutzen möglicherweise Informationen (dies schließt nicht Ihren Namen, Ihre Adresse, E-Mail-Adresse oder Telefonnummer ein) zu Ihren Besuchen dieser und anderer Websites, damit Anzeigen zu Produkten und Diensten geschaltet werden können, die Sie interessieren. Falls Sie mehr über diese Methoden erfahren möchten oder wissen möchten, welche Möglichkeiten Sie haben, damit diese Informationen nicht von Google verwendet werden können, klicken Sie hier.

5. Rechtswirksamkeit dieses Haftungsausschlusses

Dieser Haftungsausschluss ist als Teil des Internetangebotes zu betrachten, von dem aus auf diese Seite verwiesen wurde. Sofern Teile oder einzelne Formulierungen dieses Textes der geltenden Rechtslage nicht, nicht mehr oder nicht vollständig entsprechen sollten, bleiben die übrigen Teile des Dokumentes in ihrem Inhalt und ihrer Gültigkeit davon unberührt.


LGPL License - KeePass

Help

LGPL License

GNU Lesser General Public License

          GNU LESSER GENERAL PUBLIC LICENSE
               Version 2.1, February 1999

 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

[This is the first released version of the Lesser GPL.  It also counts
 as the successor of the GNU Library Public License, version 2, hence
 the version number 2.1.]

                Preamble

  The licenses for most software are designed to take away your
freedom to share and change it.  By contrast, the GNU General Public
Licenses are intended to guarantee your freedom to share and change
free software--to make sure the software is free for all its users.

  This license, the Lesser General Public License, applies to some
specially designated software packages--typically libraries--of the
Free Software Foundation and other authors who decide to use it.  You
can use it too, but we suggest you first think carefully about whether
this license or the ordinary General Public License is the better
strategy to use in any particular case, based on the explanations below.

  When we speak of free software, we are referring to freedom of use,
not price.  Our General Public Licenses are designed to make sure that
you have the freedom to distribute copies of free software (and charge
for this service if you wish); that you receive source code or can get
it if you want it; that you can change the software and use pieces of
it in new free programs; and that you are informed that you can do
these things.

  To protect your rights, we need to make restrictions that forbid
distributors to deny you these rights or to ask you to surrender these
rights.  These restrictions translate to certain responsibilities for
you if you distribute copies of the library or if you modify it.

  For example, if you distribute copies of the library, whether gratis
or for a fee, you must give the recipients all the rights that we gave
you.  You must make sure that they, too, receive or can get the source
code.  If you link other code with the library, you must provide
complete object files to the recipients, so that they can relink them
with the library after making changes to the library and recompiling
it.  And you must show them these terms so they know their rights.

  We protect your rights with a two-step method: (1) we copyright the
library, and (2) we offer you this license, which gives you legal
permission to copy, distribute and/or modify the library.

  To protect each distributor, we want to make it very clear that
there is no warranty for the free library.  Also, if the library is
modified by someone else and passed on, the recipients should know
that what they have is not the original version, so that the original
author's reputation will not be affected by problems that might be
introduced by others.

  Finally, software patents pose a constant threat to the existence of
any free program.  We wish to make sure that a company cannot
effectively restrict the users of a free program by obtaining a
restrictive license from a patent holder.  Therefore, we insist that
any patent license obtained for a version of the library must be
consistent with the full freedom of use specified in this license.

  Most GNU software, including some libraries, is covered by the
ordinary GNU General Public License.  This license, the GNU Lesser
General Public License, applies to certain designated libraries, and
is quite different from the ordinary General Public License.  We use
this license for certain libraries in order to permit linking those
libraries into non-free programs.

  When a program is linked with a library, whether statically or using
a shared library, the combination of the two is legally speaking a
combined work, a derivative of the original library.  The ordinary
General Public License therefore permits such linking only if the
entire combination fits its criteria of freedom.  The Lesser General
Public License permits more lax criteria for linking other code with
the library.

  We call this license the "Lesser" General Public License because it
does Less to protect the user's freedom than the ordinary General
Public License.  It also provides other free software developers Less
of an advantage over competing non-free programs.  These disadvantages
are the reason we use the ordinary General Public License for many
libraries.  However, the Lesser license provides advantages in certain
special circumstances.

  For example, on rare occasions, there may be a special need to
encourage the widest possible use of a certain library, so that it becomes
a de-facto standard.  To achieve this, non-free programs must be
allowed to use the library.  A more frequent case is that a free
library does the same job as widely used non-free libraries.  In this
case, there is little to gain by limiting the free library to free
software only, so we use the Lesser General Public License.

  In other cases, permission to use a particular library in non-free
programs enables a greater number of people to use a large body of
free software.  For example, permission to use the GNU C Library in
non-free programs enables many more people to use the whole GNU
operating system, as well as its variant, the GNU/Linux operating
system.

  Although the Lesser General Public License is Less protective of the
users' freedom, it does ensure that the user of a program that is
linked with the Library has the freedom and the wherewithal to run
that program using a modified version of the Library.

  The precise terms and conditions for copying, distribution and
modification follow.  Pay close attention to the difference between a
"work based on the library" and a "work that uses the library".  The
former contains code derived from the library, whereas the latter must
be combined with the library in order to run.

          GNU LESSER GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License Agreement applies to any software library or other
program which contains a notice placed by the copyright holder or
other authorized party saying it may be distributed under the terms of
this Lesser General Public License (also called "this License").
Each licensee is addressed as "you".

  A "library" means a collection of software functions and/or data
prepared so as to be conveniently linked with application programs
(which use some of those functions and data) to form executables.

  The "Library", below, refers to any such software library or work
which has been distributed under these terms.  A "work based on the
Library" means either the Library or any derivative work under
copyright law: that is to say, a work containing the Library or a
portion of it, either verbatim or with modifications and/or translated
straightforwardly into another language.  (Hereinafter, translation is
included without limitation in the term "modification".)

  "Source code" for a work means the preferred form of the work for
making modifications to it.  For a library, complete source code means
all the source code for all modules it contains, plus any associated
interface definition files, plus the scripts used to control compilation
and installation of the library.

  Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope.  The act of
running a program using the Library is not restricted, and output from
such a program is covered only if its contents constitute a work based
on the Library (independent of the use of the Library in a tool for
writing it).  Whether that is true depends on what the Library does
and what the program that uses the Library does.

  1. You may copy and distribute verbatim copies of the Library's
complete source code as you receive it, in any medium, provided that
you conspicuously and appropriately publish on each copy an
appropriate copyright notice and disclaimer of warranty; keep intact
all the notices that refer to this License and to the absence of any
warranty; and distribute a copy of this License along with the
Library.

  You may charge a fee for the physical act of transferring a copy,
and you may at your option offer warranty protection in exchange for a
fee.

  2. You may modify your copy or copies of the Library or any portion
of it, thus forming a work based on the Library, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:

    a) The modified work must itself be a software library.

    b) You must cause the files modified to carry prominent notices
    stating that you changed the files and the date of any change.

    c) You must cause the whole of the work to be licensed at no
    charge to all third parties under the terms of this License.

    d) If a facility in the modified Library refers to a function or a
    table of data to be supplied by an application program that uses
    the facility, other than as an argument passed when the facility
    is invoked, then you must make a good faith effort to ensure that,
    in the event an application does not supply such function or
    table, the facility still operates, and performs whatever part of
    its purpose remains meaningful.

    (For example, a function in a library to compute square roots has
    a purpose that is entirely well-defined independent of the
    application.  Therefore, Subsection 2d requires that any
    application-supplied function or table used by this function must
    be optional: if the application does not supply it, the square
    root function must still compute square roots.)

These requirements apply to the modified work as a whole.  If
identifiable sections of that work are not derived from the Library,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works.  But when you
distribute the same sections as part of a whole which is a work based
on the Library, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote
it.

Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Library.

In addition, mere aggregation of another work not based on the Library
with the Library (or with a work based on the Library) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.

  3. You may opt to apply the terms of the ordinary GNU General Public
License instead of this License to a given copy of the Library.  To do
this, you must alter all the notices that refer to this License, so
that they refer to the ordinary GNU General Public License, version 2,
instead of to this License.  (If a newer version than version 2 of the
ordinary GNU General Public License has appeared, then you can specify
that version instead if you wish.)  Do not make any other change in
these notices.

  Once this change is made in a given copy, it is irreversible for
that copy, so the ordinary GNU General Public License applies to all
subsequent copies and derivative works made from that copy.

  This option is useful when you wish to copy part of the code of
the Library into a program that is not a library.

  4. You may copy and distribute the Library (or a portion or
derivative of it, under Section 2) in object code or executable form
under the terms of Sections 1 and 2 above provided that you accompany
it with the complete corresponding machine-readable source code, which
must be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange.

  If distribution of object code is made by offering access to copy
from a designated place, then offering equivalent access to copy the
source code from the same place satisfies the requirement to
distribute the source code, even though third parties are not
compelled to copy the source along with the object code.

  5. A program that contains no derivative of any portion of the
Library, but is designed to work with the Library by being compiled or
linked with it, is called a "work that uses the Library".  Such a
work, in isolation, is not a derivative work of the Library, and
therefore falls outside the scope of this License.

  However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library".  The executable is therefore covered by this License.
Section 6 states terms for distribution of such executables.

  When a "work that uses the Library" uses material from a header file
that is part of the Library, the object code for the work may be a
derivative work of the Library even though the source code is not.
Whether this is true is especially significant if the work can be
linked without the Library, or if the work is itself a library.  The
threshold for this to be true is not precisely defined by law.

  If such an object file uses only numerical parameters, data
structure layouts and accessors, and small macros and small inline
functions (ten lines or less in length), then the use of the object
file is unrestricted, regardless of whether it is legally a derivative
work.  (Executables containing this object code plus portions of the
Library will still fall under Section 6.)

  Otherwise, if the work is a derivative of the Library, you may
distribute the object code for the work under the terms of Section 6.
Any executables containing that work also fall under Section 6,
whether or not they are linked directly with the Library itself.

  6. As an exception to the Sections above, you may also combine or
link a "work that uses the Library" with the Library to produce a
work containing portions of the Library, and distribute that work
under terms of your choice, provided that the terms permit
modification of the work for the customer's own use and reverse
engineering for debugging such modifications.

  You must give prominent notice with each copy of the work that the
Library is used in it and that the Library and its use are covered by
this License.  You must supply a copy of this License.  If the work
during execution displays copyright notices, you must include the
copyright notice for the Library among them, as well as a reference
directing the user to the copy of this License.  Also, you must do one
of these things:

    a) Accompany the work with the complete corresponding
    machine-readable source code for the Library including whatever
    changes were used in the work (which must be distributed under
    Sections 1 and 2 above); and, if the work is an executable linked
    with the Library, with the complete machine-readable "work that
    uses the Library", as object code and/or source code, so that the
    user can modify the Library and then relink to produce a modified
    executable containing the modified Library.  (It is understood
    that the user who changes the contents of definitions files in the
    Library will not necessarily be able to recompile the application
    to use the modified definitions.)

    b) Use a suitable shared library mechanism for linking with the
    Library.  A suitable mechanism is one that (1) uses at run time a
    copy of the library already present on the user's computer system,
    rather than copying library functions into the executable, and (2)
    will operate properly with a modified version of the library, if
    the user installs one, as long as the modified version is
    interface-compatible with the version that the work was made with.

    c) Accompany the work with a written offer, valid for at
    least three years, to give the same user the materials
    specified in Subsection 6a, above, for a charge no more
    than the cost of performing this distribution.

    d) If distribution of the work is made by offering access to copy
    from a designated place, offer equivalent access to copy the above
    specified materials from the same place.

    e) Verify that the user has already received a copy of these
    materials or that you have already sent this user a copy.

  For an executable, the required form of the "work that uses the
Library" must include any data and utility programs needed for
reproducing the executable from it.  However, as a special exception,
the materials to be distributed need not include anything that is
normally distributed (in either source or binary form) with the major
components (compiler, kernel, and so on) of the operating system on
which the executable runs, unless that component itself accompanies
the executable.

  It may happen that this requirement contradicts the license
restrictions of other proprietary libraries that do not normally
accompany the operating system.  Such a contradiction means you cannot
use both them and the Library together in an executable that you
distribute.

  7. You may place library facilities that are a work based on the
Library side-by-side in a single library together with other library
facilities not covered by this License, and distribute such a combined
library, provided that the separate distribution of the work based on
the Library and of the other library facilities is otherwise
permitted, and provided that you do these two things:

    a) Accompany the combined library with a copy of the same work
    based on the Library, uncombined with any other library
    facilities.  This must be distributed under the terms of the
    Sections above.

    b) Give prominent notice with the combined library of the fact
    that part of it is a work based on the Library, and explaining
    where to find the accompanying uncombined form of the same work.

  8. You may not copy, modify, sublicense, link with, or distribute
the Library except as expressly provided under this License.  Any
attempt otherwise to copy, modify, sublicense, link with, or
distribute the Library is void, and will automatically terminate your
rights under this License.  However, parties who have received copies,
or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.

  9. You are not required to accept this License, since you have not
signed it.  However, nothing else grants you permission to modify or
distribute the Library or its derivative works.  These actions are
prohibited by law if you do not accept this License.  Therefore, by
modifying or distributing the Library (or any work based on the
Library), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Library or works based on it.

  10. Each time you redistribute the Library (or any work based on the
Library), the recipient automatically receives a license from the
original licensor to copy, distribute, link with or modify the Library
subject to these terms and conditions.  You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties with
this License.

  11. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Library at all.  For example, if a patent
license would not permit royalty-free redistribution of the Library by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Library.

If any portion of this section is held invalid or unenforceable under any
particular circumstance, the balance of the section is intended to apply,
and the section as a whole is intended to apply in other circumstances.

It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system which is
implemented by public license practices.  Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.

This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.

  12. If the distribution and/or use of the Library is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Library under this License may add
an explicit geographical distribution limitation excluding those countries,
so that distribution is permitted only in or among countries not thus
excluded.  In such case, this License incorporates the limitation as if
written in the body of this License.

  13. The Free Software Foundation may publish revised and/or new
versions of the Lesser General Public License from time to time.
Such new versions will be similar in spirit to the present version,
but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number.  If the Library
specifies a version number of this License which applies to it and
"any later version", you have the option of following the terms and
conditions either of that version or of any later version published by
the Free Software Foundation.  If the Library does not specify a
license version number, you may choose any version ever published by
the Free Software Foundation.

  14. If you wish to incorporate parts of the Library into other free
programs whose distribution conditions are incompatible with these,
write to the author to ask for permission.  For software which is
copyrighted by the Free Software Foundation, write to the Free
Software Foundation; we sometimes make exceptions for this.  Our
decision will be guided by the two goals of preserving the free status
of all derivatives of our free software and of promoting the sharing
and reuse of software generally.

                NO WARRANTY

  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.

             END OF TERMS AND CONDITIONS

           How to Apply These Terms to Your New Libraries

  If you develop a new library, and you want it to be of the greatest
possible use to the public, we recommend making it free software that
everyone can redistribute and change.  You can do so by permitting
redistribution under these terms (or, alternatively, under the terms of the
ordinary General Public License).

  To apply these terms, attach the following notices to the library.  It is
safest to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least the
"copyright" line and a pointer to where the full notice is found.

    <one line to give the library's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>

    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License as published by the Free Software Foundation; either
    version 2.1 of the License, or (at your option) any later version.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

Also add information on how to contact you by electronic and paper mail.

You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the library, if
necessary.  Here is a sample; alter the names:

  Yoyodyne, Inc., hereby disclaims all copyright interest in the
  library `Frob' (a library for tweaking knobs) written by James Random Hacker.

  <signature of Ty Coon>, 1 April 1990
  Ty Coon, President of Vice

That's all there is to it!


KPS Script Files - KeePass

Console

KPS Script Files

How to use KPS script files to automate KeePass 2.x.

KPS script files are a lot more powerful than single command operations, but are also more complicated. You need to have heavy experience in C# programming and the KeePass 2.x internals. Within KPS files you can do everything that KeePass does.

What are KPS files?

KPS files are C# files that are loaded, compiled and executed by the KPScript.exe program. Within the script file, you got full access to the KeePass internals.

The main differences to "normal" C# files are:

  • No need for using directives.
  • No need to add a reference to the KeePass assembly.
  • No need to write a wrapper class. Simply start with Main(). The complete script file is embedded in a static class.

Here's the famous Hello World program as KPS script:

public static void Main()
{
    MessageService.ShowInfo("Hello World!");
}

For the most important namespaces, KPScript automatically adds using directives at the start of the file before compiling it. MessageService for example is located in KeePassLib.Utility, but as it's included automatically by KPScript, you can use it directly.

Executing a KPS file:

To run a KPS file, you simply pass it to KPScript:

KPScript.exe C:\KeePass\MyScriptFile.kps

It is important that the file extension is .kps, otherwise KPScript won't recognize the file and will interpret it as database for single command operations.


Single Command Operations - KeePass

Console

Single Command Operations

How to use KPScript with single command operations to perform simple database operations.

KPScript can be invoked using single commands. By passing the database location, its key, a command and eventually some parameters, simple operations like adding an entry can be performed. The syntax is very simple, no scripting knowledge is required. This method is ideal when you quickly want to do some small changes to the database. It is not recommended when you need to perform many operations, because for each command the database needs to be loaded from file, decrypted, modified, encrypted and written back to file.

Commands are specified by passing -c:COMMAND to KPScript, where COMMAND is the command to execute (see below for a list of available commands).

The database location is passed to KPScript by just passing it as a parameter, without any option prefix.

The composite key for the database can be given to KPScript using one of the following ways:

  • Command Line Parameters.. Using the -pw:, -keyfile: and -useraccount parameters. For example, to pass "Secret" as password, you'd give KPScript the following parameter: -pw:Secret. If the password contains spaces or other special characters, it must be enclosed in quotes: -pw:"My Top Secret Password". Similarly, the -keyfile: parameter can specify the key file location. If -useraccount is passed to KPScript, the user account credentials of the currently logged on user are used, otherwise not.

  • Entering interactively using the command line. If you pass -keyprompt to KPScript, it will prompt you for the key. You can enter the password, key file location and user account directly in the console window.

  • Entering interactively using graphical user interface. If you pass -guikeyprompt to KPScript, it will prompt you for the key using the standard key dialog of KeePass.

Available Commands:

Please note that commands are added incrementally based on user requests. If you are missing a command, please let the KeePass team know and it will be added to the next release of KPScript.

Currently, the following commands are available:

  • ListGroups
  • ListEntries
  • AddEntry
  • EditEntry
  • DeleteEntry
  • Export
  • Sync
  • ChangeMasterKey

Command: ListGroups

This command lists all groups in a format that easily machine-readable. The output is not intended to be printed/used directly. Usage example:

KPScript -c:ListGroups "C:\KeePass\MyDb.kdbx" -pw:MyPassword
This will list all groups contained in the MyDb.kdbx database file.

Command: ListEntries

This command lists all entries in a format that easily machine-readable. The output is not intended to be printed/used directly. Usage example:

KPScript -c:ListEntries "C:\KeePass\MyDb.kdbx" -pw:MyPassword -keyfile:"C:\KeePass\MyDb.key"
Opens the MyDb.kdbx database using 'MyPassword' as password and the MyDb.key file as key file. It will output a list of all entries contained in the MyDb.kdbx database file.

Command: AddEntry

This command adds an entry to the database. To specify the entry details, use the standard string field identifiers as parameter names and their values for the contents. Supported standard string fields are: Title, UserName, Password, URL, and Notes. Usage examples:

KPScript -c:AddEntry "C:\KeePass\MyDb.kdbx" -pw:MyPw -Title:"New entry title"

KPScript -c:AddEntry "C:\KeePass\MyDb.kdbx" -pw:MyPw -Title:SomeWebsite -UserName:Don -Password:pao5j3eg -URL:http://website.com

The -GroupName: parameter can be used to specify the group in which the entry is created. For searching, KPScript performs a pre-order traversal and uses the first matching group (the name is case-sensitive). If no group with the specified name is found, it will be created in the root group. If you do not specify a group name, the entry will be created in the root group. Example:

KPScript -c:AddEntry "C:\KeePass\MyDb.kdbx" -pw:MyPw -Title:"My Provider" -GroupName:"Internet Sites"

Command: EditEntry

This command edits existing entries. To identify the entries to be edited, specify string fields to be compared. The syntax is -ref-FIELDNAME:FIELDVALUE. To specify one or more new entry string values, use the following syntax: -set-FIELDNAME:FIELDVALUE. Usage examples:

KPScript -c:EditEntry "C:\KeePass\MyDb.kdbx" -pw:MyPw -ref-Title:"Existing entry title" -set-UserName:"New user name"

KPScript -c:EditEntry "C:\KeePass\MyDb.kdbx" -pw:MyPw -ref-UserName:MyName -set-UserName:NewName -set-Password:"Top Secret"

If you additionally pass -CreateBackup, KPScript will first create backups of entries before modifying them.

Command: DeleteEntry

This command deletes one or more existing entries. The entry identification syntax is exactly the same as in the EditEntry command.

Command: Export

This command exports the complete database. The format is specified by setting the "-Format" parameter (see names in KeePass' export dialog). The file to export to is specified using the "-OutFile" parameter. Usage example:

KPScript -c:Export "C:\KeePass\MyDb.kdbx" -pw:MyPw -Format:"KeePass XML (2.x)" -OutFile:TargetFile.xml

Command: Sync

This command synchronizes the database with another one. The other database path has to be specified using the "-File" command line parameter.

Command: ChangeMasterKey

This command changes the master key of the database. The new key values are specified using the standard options prefixed with 'new', i.e. -newpw:, -newkeyfile: and -newuseraccount (all are optional). Usage example:

KPScript -c:ChangeMasterKey "C:\KeePass\MyDb.kdbx" -pw:MyPw -newpw:MyNewPw