Placeholders

KeePass supports various placeholders.

In many places in KeePass (auto-type, URL field, triggers, ...), placeholders can be used.

Entry Field Placeholders
Entry Field References
Paths and Date/Time Placeholders
Environment Variables
More Placeholders

Placeholders are case-insensitive.

Entry Field Placeholders

Field	Placeholder
Title	{TITLE}
User Name	{USERNAME}
URL	{URL}
Password	{PASSWORD}
Notes	{NOTES}

Custom strings can be referenced using {S:Name}. For example, if you have a custom string named "eMail", you can use the placeholder {S:eMail}.

Placeholder	Is Replaced By
{URL:RMVSCM}	Entry URL without scheme specifier.

Entry Field References

Fields of other entries can be inserted using Field References.

Paths and Date/Time Placeholders

Placeholder	Is Replaced By
{INTERNETEXPLORER}	Path of Internet Explorer, if installed.
{FIREFOX}	Path of Mozilla Firefox, if installed.
{OPERA}	Path of Opera, if installed.
{GOOGLECHROME}	Path of Google Chrome, if installed.

Placeholder	Is Replaced By
{APPDIR}	KeePass application directory path.

Placeholder	Is Replaced By
{GROUP}	Name of the entry's parent group.
{GROUPPATH}	Full group path of the entry.
{DB_PATH}	Full path of the current database.
{DB_DIR}	Directory of the current database.
{DB_NAME}	File name (including extension) of the current database.
{DB_BASENAME}	File name (excluding extension) of the current database.
{DB_EXT}	File name extension of the current database.
{ENV_DIRSEP}	Directory separator ('\' on Windows, '/' on Unix).
{DT_SIMPLE}	Current local date/time as a simple, sortable string.
{DT_YEAR}	Year component of the current local date/time.
{DT_MONTH}	Month component of the current local date/time.
{DT_DAY}	Day component of the current local date/time.
{DT_HOUR}	Hour component of the current local date/time.
{DT_MINUTE}	Minute component of the current local date/time.
{DT_SECOND}	Seconds component of the current local date/time.
{DT_UTC_SIMPLE}	Current UTC date/time as a simple, sortable string.
{DT_UTC_YEAR}	Year component of the current UTC date/time.
{DT_UTC_MONTH}	Month component of the current UTC date/time.
{DT_UTC_DAY}	Day component of the current UTC date/time.
{DT_UTC_HOUR}	Hour component of the current UTC date/time.
{DT_UTC_MINUTE}	Minute component of the current UTC date/time.
{DT_UTC_SECOND}	Seconds component of the current UTC date/time.

Environment Variables

System environment variables are supported. The name of the variable must be enclosed in '%' characters. For example %TEMP% is replaced by the user's temporary path.

Other Placeholders

Placeholder	Action
{PICKCHARS} {PICKCHARS:Fld:Opt}	Shows a dialog to pick certain characters from an entry string. See below.
{NEWPASSWORD}	Generates a new password. See below.
{PASSWORD_ENC}	Password in encrypted form. See below.
{HMACOTP}	Generates a one-time password. See below.

{PICKCHARS} – Picking Characters:

In KeePass ≥ 2.15, the {PICKCHARS} placeholder shows a dialog, in which you can pick characters of an entry string (like the password) at certain positions.

{PICKCHARS} without any parameters lets you pick an arbitrary amount of characters from the password of the entry. A different entry string can be specified by appending a ':' and the name of the field; e.g. {PICKCHARS:UserName}. The names of the standard fields are Title, UserName (without a space), Password, URL and Notes. A custom entry string can be referenced by its name (without an S: prefix).

Additionally, the placeholder supports various (optional!) options. Options are appended after the field name, separated by a ':'. If you want to specify multiple options, separate them by a comma ','. Options are key-value pairs, separated by a '='. The following options are supported:

ID: Specifies an alphanumeric ID for the placeholder (see below).
C or Count: Specifies the number of characters to pick from the string. When enough characters have been picked, the dialog closes automatically (i.e. you don't need to manually click [OK] anymore).
Hide: If set to False, the picked characters in the dialog are shown as plain text by default, i.e. not hidden by asterisks. By default, KeePass uses the hiding setting of passwords in the main window.
Conv: Specifies how to convert the picked characters. When this parameter is omitted, no conversion is performed, i.e. the selected characters are auto-typed directly. The option supports the following values:
- D: Convert the picked characters to down arrow keypresses; e.g. '2', 'c' and 'C' are converted to 2 down arrow keypresses.
  
  A fixed number of down arrow keypresses can be added by specifying them using the Conv-Offset option. For example, if you specify Conv=D, Conv-Offset=1, '2', 'c' and 'C' are converted to 3 down arrow keypresses.
  
  By using the Conv-Fmt option, you can specify the layout of comboboxes. By default, KeePass assumes a combobox containing values from 0 to 9 or from A to Z. If the combobox contains values 0-9A-Z (i.e. first all ten digits, immediately followed by all characters from A to Z), specify Conv=D, Conv-Fmt=0A. Similarly, if it contains values A-Z0-9, specify Conv=D, Conv-Fmt=A0. If digits start with 1 instead of 0 (i.e. the 0 appears after the 9), use 1A and A1 instead of 0A and A0.

If you want to show the character picking dialog multiple times within one sequence, assign different IDs to the placeholders. If an ID is specified multiple times (or no ID is specified and the placeholders are the same), KeePass shows the character picking dialog once and reuses the picked characters in all following placeholders with the same ID.

Usage examples:

{USERNAME}{TAB}{PICKCHARS:Password:C=5}{ENTER}
Types the user name, presses Tab, allows the user to pick exactly 5 characters from the entry password, types these 5 characters, and presses Enter.

{S:Memorable}{TAB}{PICKCHARS:Password:ID=1, C=1, Conv=D,
Conv-Offset=1}{TAB}{PICKCHARS:Password:ID=2, C=1, Conv=D,
Conv-Offset=1}{TAB}{PICKCHARS:Password:ID=3, C=1, Conv=D,
Conv-Offset=1}{ENTER}

This first types the contents of a custom entry string named "Memorable", and presses Tab. Then the character picking dialog allows to pick exactly one character from the password, and this character is converted to down arrow keypresses (with one additional keypress, e.g. a '1' is converted to two down arrow keypresses), and the focus is switched to the next control by pressing Tab. This is repeated two more times (the IDs are different, thus the dialog is shown two more times).

Note this is not equivalent to picking three characters at once. If you'd use {S:Memorable}{TAB}{PICKCHARS:Password:C=3, Conv=D, Conv-Offset=1}, all the down arrow keypresses are sent to the same, currently active control.

In some browsers (e.g. Opera), setting the focus to a combobox can be slow. If you experience auto-type failures, consider slowing down the focus changes, e.g. by adding {DELAY 250} after each {TAB}, or slowing down the whole sequence, e.g. by prepending {DELAY=150}.

{NEWPASSWORD} – Generating new passwords:
The {NEWPASSWORD} placeholder generates a new password for the current entry, based on the "Automatically generated passwords for new entries" generator profile.

This placeholder is replaced once in an auto-type process, i.e. for a typical 'Old Password'-'New Password'-'Repeat New Password' dialog you can use {PASSWORD}{TAB}{NEWPASSWORD}{TAB}{NEWPASSWORD}{ENTER} as auto-type sequence.

{PASSWORD_ENC} – Encrypting passwords:
The {PASSWORD_ENC} placeholder is replaced by the password of the current entry in encrypted form. The password is encrypted using credentials of the current Windows user. The encrypted password should not be stored and only works for the current user.

It is intended to be used in conjunction with the -pw-enc command line parameter (see the URL Field Capabilities page for an example how to define an URL to open an additional KeePass database). The placeholder cannot be used to transfer passwords to other applications (except KeePass), because the target applications don't know how to decrypt encrypted passwords generated by {PASSWORD_ENC}.

{HMACOTP} – Generating one-time passwords:
The {HMACOTP} placeholder generates a HMAC-based one-time password as specified in RFC 4226. The shared secret is the UTF-8 representation of the value of the 'HmacOtp-Secret' custom entry string field (case-sensitive), and the counter is stored in decimal form in the 'HmacOtp-Counter' field.