942026-03-15 10:33:40crose932026-03-15 10:32:57crose922026-02-24 17:47:43crose912026-02-17 22:33:01crose902026-02-17 22:32:42crose892026-02-17 22:31:30crose882026-02-16 11:58:29crose872026-02-14 17:09:23crose862026-02-05 14:43:38crose852026-02-05 14:43:12crose842026-02-02 19:50:28crose832026-01-05 15:27:29crose822026-01-05 15:26:52crose812026-01-05 15:23:18crose802025-12-11 07:29:00crose792025-12-11 07:28:22crose782025-12-11 07:27:20crose772025-07-02 10:06:57crose762025-05-11 08:48:11crose752025-05-11 08:45:43crose742025-05-11 08:45:06crose732025-05-11 08:43:39crose722025-05-11 08:42:27crose712025-05-11 08:38:13crose702025-05-11 08:18:46crose692025-05-11 08:11:58crose682025-05-06 16:31:47crose672025-05-06 16:31:04crose662025-05-06 09:13:26crose652025-05-06 06:28:45crose642025-05-06 06:24:48crose632025-03-30 10:03:17crose622025-03-30 09:05:22crose612025-03-30 09:00:57crose602025-03-30 08:58:23crose592025-03-30 08:57:26crose582025-03-30 08:53:15crose572025-03-30 08:49:15crose562025-03-30 08:40:34crose552025-03-30 08:39:00crose542025-03-30 08:38:52crose532025-03-30 08:38:16crose522025-03-30 08:38:04crose512025-03-30 08:25:00crose502025-03-30 08:24:13crose492025-03-30 08:22:39crose482025-03-29 21:51:21crose472025-03-29 21:50:53crose462025-03-29 21:19:54crose452025-03-29 20:35:14crose442025-03-29 20:18:18crose432025-03-29 20:12:22crose422025-03-29 20:05:18crose412025-03-29 20:02:16crose402021-12-11 16:34:15crose392021-02-03 15:16:37eseide382021-02-03 15:13:46eseide372020-06-25 10:47:25crose362020-01-13 21:31:27crose352020-01-13 21:26:47crose342020-01-13 21:26:04crose332020-01-13 21:21:58crose322018-04-10 07:17:45crose312018-04-10 07:14:45crose302018-04-10 07:07:01crose292018-04-10 07:06:23crose282018-04-10 07:06:11crose272018-04-10 07:05:56crose262018-04-10 07:05:43crose252018-04-10 07:03:08crose242018-04-10 06:47:50crose232018-04-10 06:47:32crose222013-04-25 14:00:23frankm212010-12-21 10:26:39sericm202010-12-21 10:25:55sericm192010-12-17 16:18:12crose182010-12-17 16:14:09crose172010-07-12 15:57:22sericm162010-07-12 15:54:48sericm152010-07-12 15:33:07sericm142010-07-12 15:14:36sericm132010-07-12 15:12:19sericm122010-07-12 15:06:47sericm112010-07-12 15:06:38sericm102010-07-12 15:01:40sericm92010-07-12 14:59:51sericm82010-07-12 14:58:19sericm72010-07-12 14:55:44sericm62010-07-12 14:55:27sericm52010-07-12 14:55:20sericm42010-07-12 14:54:56sericm32010-07-12 14:42:46sericm22010-07-12 14:42:18sericm12010-07-12 14:42:04sericm

Download Basics Background information

keepassx.png

Different passwords for different accounts. MFA for modern accounts/services- this becomes so easy, use it wherever it is possible. No single device dependency. Your passwords are where you are. Splitted security levels (multiple vaults). Awesome browser integration. Sharing credentials (multiple vaults, shared via cloud storage). E.g. a) team: sharing credentials, b) family: shared WLAN password, children school accounts.

KeePassXC is a tool to store and manage passwords. Apps are freely available for MacOS/Windows/Linux - KeePassXC: . Android: KeepassDX iOS - Mobile Integration: We have tested KeePassXC on mobile devices only very roughly. The integration is not as good ('simple to use') as on the desktop app or in the browser. Never the less: most persons see's it as an advantage to have the personal vault on their mobile device accessible.

KeePassXC create/open/edit/save password-vaults in a single file. A password-vault is basically an encrypted file, where you can store your various usernames/passwords/URLs and also attachments like pictures or other important / private documents. A password-vault can only be opened if you know the Master-Password. The Master Password is the key to all your stored passwords. If you forgot your Master-Password, you cannot access your stored passwords anymore. Encryption -- either the Advanced Encryption Standard (AES) or the Twofish algorithm are used for encryption of the vault in 256 bit sized increments All features:

Click on "File" --> "New Database..." You will be prompted to set a master key. Input your master password (the master password for all your other stored passwords). Then click "OK" Repeat your master password. click "OK". Chose a group. (Standard choices are Internet of eMail. You can also create your own groups). Click on "Entries" --> "Add New Entry..." Input the information you need Title: a short description of the entry Username: your username URL: on what homepage do you need the password Password: your password Repeat: repeat your password Comment: a longer description of the entry Click on "File" --> "Save Database" Chose a location and a name for your password database. click "OK"

Only use a cloud service if you need to sync your passwords across several devices! (Recommendation: yes, use a cloud service) Decide on your own: Pro 'cloud': all of your confidental data on all devices. implicit backups (data on multiple devices, and also in the cloud). Contra 'cloud': all of your confidental data on all devices - higher chance that your (encrypted) vaults are accessible to others. If your cloud access is compromised or the cloud service provider is compromised: the thief owns the (enrypted) vault. US based cloud provider like Google Drive, Dropbox, Apple iDrive, Microsoft OneDrive: Those services are very attractive to hackers. The NSA has the right to get all data from US companies. After Snowden it's for sure, the NSA is not friendly. Rule of thumb: Don't use US hosted / company based services for confidential data. Local cloud storage provider: - Switch Eduction cloud service - switchdrive - I-MATH How to: On all devices where you like to sync your KeePassXC Vault file, install and configure drive.math.uzh.ch Open the KeePassXC vault file on all of your devices directly from the cloud folder. Automatic merge of vault: Even if KeePassXC has a vault opened, changes on a different device (e.g. phone) and sync via cloud, becomes immediately active. If you work in a team: no change, everyone can open the local copy - changes will be merged.

KeePassXC can be used from within a browser (Chrome, Chromium, Firefox, Vivaldi, Brave, ...) Browser connection to KeePassXC is nice: different browsers offer the same accounts/credentials - if synced via cloud than also on different computers. TOTP service (one time token). Passkeys support. Again, think on this: There is only one source of truth (=one KeePassXC vault), in all browsers you have all your credentials available. Finally: no more MS-Authenticator app needed no more single device dependency (Phone at home, ...) login to any MFA protected website without a mobile phone - Biggest advantage: your second token are controlled by you, not any provider. still secure - the second factor is now your KeePassXC.

kp-browserintegration.png Settings > Browser Integration > Enable integration ...: Chrome, Firefox, ...

Install the corresponding browser plugin (links to app store: check above the settings dialog '5' )

Passkeys have to explicitly enabled in the browser plugin: kp-passskeys.png

Take care that the KeePassXC icon on the top right is 'green' = connection to vault is active. Open the login page in the browser. kp-fill.png Click on the small green kp icon. Choose the account.

To use TOTP with Microsoft Office 365 login: Add another (than MS-Authenticator-) app, as second factor How To kp-totp.png Add TOTP functionality to individual accounts: Account > right mouse click > TOTP > Setup TOTP On a MFA-TOTP secured login website, just login as usual with KeePassXC, on the next page, where the one time token is requested, click again on the green symbol. Hint: On the TOTP setup you have to provide the 'shared secret'. The shared scecret is provided by the website which hosts the login, typically where the MFA can be configured. Either in plaintext like 'ABCD EFGH 1234 IJKL 5678 MNOP QRST UV89'. As a QR code to scan. Here sometimes it's a URL or a fido string. If it is not in plaintext in the URL, hopefully the assigned app (=keepassdx) opens. Option: be creative - scan the QR, look at the url (or send the URL via 'share' to yourself): you should see the shared secret as an argument in the URL.

Passkey / webauthn are offered as an additional way to use MFA. Passkeys are significant more secure than MFA via a) email code or b) One Time Token, c) Authenticator App, cause they use pairing between store and the application. But: Some websites work better than others. E.g. eduid.ch is ok, gitlab is ok but with popup, Microsoft is broken for Linux/Chrome/KeePassXC, ... The paring is also a disadvantage: you need different keys for each store. Sure, KeepassXC acts like 'one store'. Logging to a passkey secured application only works with a running passkey device / software. In contrast: TOTP is fine if you get the code from your Mobile/Keepass App and type it in a browser on a computer. Using passkeys is recommended, but only after you got experience with KeepassXC and the corresponding browser plugin.

Some services offers recovery keys. Copy the keys in corresponding account record in KeePassXC. If you used a key (it's burnt now), remove it from the list (if there was only one key, update it with the new one).

Some services, especially Microsoft (, ), uses different URLs to login. Per account, add further URLs: kp-addurl.png This is very powerful - add as many URLs you like to the same account record - the helps to keep your vault clean!

If connection to KeepassXC fails after (re)starting Brave: In KeepassXC open Settings > Browser Integration > Enable integration for there browsers: Off & On

Quit Brave. Optional: Check that there are no leftover processes. Check if keepassx gets a connection. No? Repeat the quit/restart at least 4 times - answer question like 'Restore pages' or 'Profile broken' (than quit). ... makes no sense, right? Try it!

Open the keepassx plugin options page. Change a setting. Close the tab. Open the keepassx plugin options page again. Is the setting still the one you choosed before? No: exit Brave (check that all processes are closed). Repeat the test - up to 3 times!!!

In Brave: Remove extension keepassxc plugin. Quit Brave. Check that really all brave processes are quit: ps -ef | grep brave | grep $USER Clean tempfiles: \rm -R /tmp/.cache-$USER/BraveSoftware Start Brave again. Install Brave plugin keepassxc. Optional: Import Brave plugin keepassxc settings (export them earlier when all is fine).

Close all Browser: Chrome, Brave, Firefox, Teams [PWA], Spotify [PWA] Close KeepassXC for II in keepassxc-proxy keepassxc brave firefox chrome; do pkill $II; pkill -9 $II; done (!) Start and quit brave Start KeepassXC Start brave. If necessary, remove keepassxc plugin and reinstall. Connect to KeepassXC