KeePassXC
KeePassXC stores passwords, usernames and notes in an encrypted file and can fill them into websites and apps. It’s made by KeePassXC Team.
Criminals have used its name in fake downloads or scams, so get it only from keepassxc.org.
What it is
KeePassXC helps people create and keep different passwords for their accounts. It stores them in an encrypted database file that you unlock with a master password. You can also store notes and attachments.
When unlocked, it can read the information in your database. Its optional browser extension fills saved logins into websites. Auto-Type can type them into other apps. On macOS, Auto-Type needs Accessibility permission, and matching entries to window titles also needs Screen Recording permission.
The project describes it as a good choice for people who want to keep passwords in a local file rather than an online password service. It is free and open source. Use a strong master password and keep backups of your database and any key file.
Who makes it
An international team of developers maintains KeePassXC as a free, open-source project. Its website is keepassxc.org.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of KeePassXC. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is org.keepassxc.keepassxc. Download it only from keepassxc.org, not from an ad or a link someone sends you.
Fakes. In March 2026, users reported a lookalike KeePassXC download website that asked for an email address before providing downloads. The warning said the real project does not ask for an email address.
What it connects to
In normal use, KeePassXC talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
api.github.com | Checks for new versions. |
icons.duckduckgo.com | Downloads website icons when the optional fallback service is enabled. |
api.pwnedpasswords.com | Optional leaked-password checks using partial password hashes. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Accessibility | Allows Auto-Type to enter saved usernames and passwords into other apps. |
| Screen Recording | Allows global Auto-Type to read window titles and find matching database entries. |
Security record
Problems with KeePassXC or KeePassXC Team in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| A malicious website could use saved login references to obtain information from other database entries through browser integration; fixed in KeePassXC 2.8.0. | ↗ | |
| An authorised browser client could trigger memory corruption with an oversized response, causing a crash in testing; fixed in KeePassXC 2.8.0. | ↗ | |
| Importing a specially crafted legacy KeePass database could corrupt memory and crash the app; fixed in KeePassXC 2.8.0. | ↗ | |
| On Windows, a local attacker could use an OpenSSL configuration file to run code inside another user's KeePassXC process; fixed in 2.7.12. | ↗ |
References
- KeePassXC official website keepassxc.org
- The KeePassXC Team keepassxc.org
- Documentation and FAQ keepassxc.org
- KeePassXC User Guide keepassxc.org
- Official downloads keepassxc.org
- Official release history github.com
- macOS bundle identifier in the build configuration github.com
- Update notification source raw.githubusercontent.com
- Update check network source raw.githubusercontent.com
- Website icon download source raw.githubusercontent.com
- Leaked-password check source raw.githubusercontent.com
- Auto-Type permission source raw.githubusercontent.com
- Community report of a fake KeePassXC download website reddit.com
- Browser entry reference disclosure advisory github.com
- Browser response memory corruption advisory github.com
- Legacy database importer memory corruption advisory github.com
- Windows OpenSSL configuration advisory github.com
- KeePassXC 2.8.0 release notes and security fixes keepassxc.org