KeePass Password Safe ReadMe

KeePass Password Safe

KeePass is copyright (c) 2003-2005 Dominik Reichl. KeePass is OSI Certified Open Source Software. OSI Certified is a certification mark of the Open Source Initiative. For more information see the License page.

Index:
  • Installation and Uninstallation
  • First Steps Tutorial
  • Features Overview
  • Passwords and Key-Disks
  • Security Information
  • Plugin Architecture
  • Frequently Asked Questions (FAQ)
  • Thanks and Acknowledgements
  • Online Resources
  • License
Feature descriptions:
  • The auto-type feature (sequences, window definition for global hot key, ...)
  • The URL field (capabilities, command-lines, substitutions, ...)
  • TAN support
Miscellaneous:
  • Command-line options
  • File formats (CSV/XML)

  • Secure Edit Controls

Introduction

Today you need to remember many passwords. You need a password for the Windows network logon, your e-mail account, your homepage's ftp password, online passwords (like CodeProject member account), etc. etc. etc. The list is endless. Also, you should use different passwords for each account. Because if you use only one password everywhere and someone gets this password you have a problem... A serious problem. He would have access to your e-mail account, homepage, etc. Unimaginable.

But who can remember all those passwords? Nobody, but KeePass can. KeePass is a free, open-source, light-weight and easy-to-use password manager for Windows.

The program stores your passwords in a highly encrypted database. This database consists of only one file, so it can be easily transferred from one computer to another.

KeePass supports password groups, you can sort your passwords (for example into Windows, Internet, My Homepage, etc.). You can drag-n-drop passwords into other windows. The powerful auto-type feature will type usernames and passwords for you into other windows. The program can export the database to various formats (like TXT, HTML, XML, CSV, ...). It can also import data from various other formats (Password Safe v2 TXT files, CSV files, ...).

Of course, you can also print the password list or current list view (see groups). Using the context menu of the password list you can quickly copy password or user name to the Windows clipboard. Searching in password database is possible.

KeePass can be translated into other languages very easily (over 20 languages are available already). The program has a strong random password generator (you can define the possible output characters).

The program features a plugin architecture. Other people can write plugins for KeePass, extending its functionality: support for even more data import/export formats, backup features, network features, etc. See the plugins page on the KeePass homepage for downloadable plugins and an introduction on how to write your own plugins.

And the best: it's free and you have full access to its source code!

KeePass is a Windows application. It has been developed using Microsoft Visual C++ with MFC classes. No .NET framework is required, nor any other special DLLs. It should run on all Windows operating systems.

KeePass is distributed under the GPL license. See the file 'License.txt' in the downloadable KeePass package for details.


Installation / Uninstallation / Portability

Installation, Uninstallation and Portability

When downloading KeePass, you have the choice between 3 different packages:
  • KeePass-X.XXx.zip: The binary ZIP package.
  • KeePass-X.XXx-Setup.exe: A Windows installer package.
  • KeePass-X.XXx-Src.zip: The full source code.
KeePass does not need to be installed. Just download the binary ZIP package, unpack it with your favorite packer and KeePass is ready to be used. Copy it to a location of your choice (for example onto your portable USB stick), no additional configuration or installation is needed.

The KeePass development team also provides you an installer, which automates creating links in the startmenu etc. Apart from those integration options, there's nothing different from the binary ZIP package.

In contrast to many other applications, KeePass does not use any functions that require the latest Windows operating system, such like theming on XP or like a .NET application that requires the .NET framework.

The source code package contains everything you need to compile KeePass. It includes all C++ source code and header files, resource files, source files of the documentation, all the latest language/translation files, sources for building the installer, etc.

KeePass doesn't store anything on your system. The program doesn't create any new registry keys and it doesn't create any initialization files (ini) in your Windows directory. Deleting the KeePass directory (in case you downloaded the binary zip package) or using the uninstaller (in case you downloaded the installer package) leaves no trace of KeePass on your system.

When using the portable version, make sure that KeePass has write access to its application directory. Otherwise, if it doesn't have, it'll attempt to store the configuration options (nothing security-relevant though) into the application configuration directory of the currently logged on user. For more about that, see this page: Option Saving.


First Steps

This short tutorial will show you how to actually use KeePass. It describes only the basic usage, advanced features are covered on separate pages.

Creating a new database

The very first step is creating a new password database. KeePass will store all your passwords in such a database. To create one, click 'File - New Database' in the main menu or click the leftmost toolbar button. A window will appear, which prompts you for a master password and/or key-disk. The database will be encrypted with the password you enter here. The password you enter here will be the only password you'll ever have to remember from on now. It should be long and built up of mixed characters. Keep in mind that when someone gets your database file and guesses the password, he could access all passwords you stored in the database.

For this tutorial, we'll just use a simple password. Click into the password edit field and enter a password of your choice. The password edit control isn't limited in length, so feel free to even enter a whole sentence (just keep in mind that you'll need to remember it).

When you've entered a nice password/passphrase, click [OK]. A second window appears, prompting you for the password again. This is to prevent you from accidently mistyping the password. So, just enter the password again which you've entered at the first window and click [OK]. If you entered the same password as before (i.e. didn't mistype any of the characters), KeePass will now show the main database window.

Now you see the main window. On the left, you see the password groups. On the right, you see the actual password entries. The password entries are grouped together into the password groups you see on the left. So, depending on which group on the left you selected, it'll show you the entries in this group in the right view. KeePass has created a few default groups for you, but you're totally free to delete them and create your own ones.

Adding an entry

Time to store your very first password in the KeePass database! Right-click into the right password entry view and choose 'Add Entry...'. A window will pop up. In this window you can now edit your entry: enter some title for it, an username, an URL, the actual password, etc. If you don't need some of the fields, just leave them empty. When you're done, click [OK].

You'll see your new entry in the password list on the right now.

Using entries

You got the new entry in the password list now. What can you actually do with it now? Right-click onto the entry.

You have several options now. You can for example copy the username of the entry to the Windows clipboard. When you've copied it, you can post it into any other program of your choice. The same works for copying passwords.

KeePass can open the URL you specified. To do this, just click 'Open URL(s)...' in the context menu. KeePass will start the default browser and open the specified URL.

Saving the database

It's time to save our database. Click onto the 'save' toolbar button (looks like a disk; 3rd toolbar button). You now have to specify a location where you want the database file to be stored.

More

That's it! You've made the first steps in using KeePass! You can now have a look at the more advanced features of KeePass.

Passwords and key-disks: In the tutorial above we've encrypted the database using a password. But KeePass also supports key-disks, i.e. you can lock your database using a file (which you can carry around on your USB stick for example). It even supports combining those two methods for maximum security!

TAN entries: TAN entries are one-time passwords. Many banks are using TANs for better security. KeePass supports TAN entries by making them expire automatically when using them.

Auto-Type: The auto-typing functionality is a very powerful feature. In the tutorial above you've copied the username and password of an entry to the clipboard. Wouldn't it be nice if KeePass would just type those strings for you into other windows? Wouldn't it be nice if you could define whole sequences of key-presses that KeePass should type for you? That's exactly what the Auto-Typing feature does: it sends simulated key-presses for you to other windows!

URL field capabilities: The URL field supports URLs of course. In the tutorial, you've learned that you can enter simple URLs into this field and KeePass will open the browser window for you. But the URL field can do more! It actually supports many different protocols (not just http), is able to use PuTTY for ssh:// URLs and supports executing Windows command-lines through the cmd:// virtual protocol. The field also features a powerful substitution engine, replacing special sequences of characters by other fields (username, password, ...) of this entry.

Command-line capabilities: You can open .kdb files by passing the filename to the KeePass executable file. But did you know that you can also send the password for the database and key-file location over the command-line? You can also use the command-line to pre-select a key-drive for you.

Plugins: KeePass features a powerful plugin architecture. If you miss some functionality, have a look at the plugins page to see if there are other people that have already written plugins for this. Many plugins exist to import/export data from/to other file formats.


Features

KeePass Password Safe

Here are the "selling points" of KeePass. To get a first impression, you can also have a look at some of the screenshots.
  • Highly encrypted databases
  • Support of master passwords and key-disks
  • Runs on all Windows operating systems and doesn't need to be installed
  • Export password list to TXT, HTML, XML or CSV files
  • Import from CSV, CodeWallet(Pro) TXT and Password Safe v2 TXT files
  • Easy database transfer
  • Support of password groups
  • Time fields and entry attachment support
  • Auto-type, global auto-type hot key combination and drag-n-drop support
  • Intuitive and secure Windows clipboard handling
  • Searching and sorting
  • Multi-language support
  • Strong random password generator
  • Low memory requirement
  • Plugin architecture
  • Open-Source!

Highly encrypted databases
  • KeePass supports the Advanced Encryption Standard (AES) and the Twofish algorithms to encrypt its password databases.
  • Both ciphers are regarded as very secure by the cryptography community. Banks are using these algorithms, too.
  • Even if you would use all computers in the world to attack one database, decrypting it would take longer than the age of the universe.
  • Even quantum computers won't help that much. The algorithms are symmetric so its complexity would be reduced a bit, anyway, the sun will go nova before you have decrypted the database.
  • The complete database is encrypted, not only the password fields. So your usernames, notes, etc. are hidden, too.
  • SHA-256 is used as password hash. SHA-256 is a 256-bit cryptographically secure one-way hash function. Your master password is hashed using this algorithm and its output is used as key for the encryption algorithms (AES and Twofish).
  • In contrast to many other hashing algorithms, no attacks are known yet against SHA-256.
  • In-memory passwords protection: your passwords are encrypted while KeePass is running, so even if Windows caches the KeePass process to disk, this wouldn't reveal your passwords anyway.
  • Security-enhanced password edit controls: KeePass is the first password safe that has security-enhanced password edit controls. None of the available password edit control spies work against the controls used in KeePass. The passwords entered in those controls aren't even visible in the process memory of KeePass.
  • Also see the security information page.

Support of master passwords and key-disks
  • One master password decrypts the complete database.
  • Alternatively you can use key-disks. Key-disks provide better security than master passwords in most cases. You only have to carry the key-file with you, for example on a floppy disk, or you can burn it on CD. Of course, you shouldn't lose this disk then.
  • For even more security you can combine the above two methods: the database then requires the key-disk and the password in order to be unlocked. Even if you lose your key-disk, the database would remain secure.
  • Also see keys information page.

Runs on all Windows operating systems and doesn't need to be installed
  • KeePass doesn't, in contrast to many other applications, use any functions that require the latest Windows operating system, such like theming on XP or like a .NET application that requires a .NET framework (KeePass supports XP themes, but doesn't require this operating system capability).
  • The application doesn't need to be installed. The KeePass development team provides you an installer which automates creating links in the startmenu etc., but you also can download the binary zip package which contains only the main executable. This executable runs fine without installing anything.
  • KeePass doesn't store anything on your system. The program doesn't create any new registry keys and it doesn't create any initialization files (ini) in your Windows directory. Deleting the KeePass directory (in case you downloaded the binary zip package) or using the uninstaller (in case you downloaded the installer package) leaves no trace of KeePass on your system.
  • KeePass runs, without downloading any additional libraries, on Windows 95, 98, 98SE, ME, NT, 2000, XP, 2003 and most probably Longhorn.
  • 1
  • Even a 100% compatible version for the PocketPC is available (visit KeePass PocketPC page).

Export password list to TXT, HTML, XML or CSV files
  • The password list can be exported to various formats like TXT, HTML, XML and CSV.
  • The XML output can be easily used in other applications (you can re-import XML files into KeePass using a plugin).
  • The CSV output is fully compatible with most other password safes like the commercial closed-source Password Keeper and the closed-source Password Agent, also the CSVs can be imported by spreadsheet applications like Microsofts Excel or OpenOffice's Calc.
  • The HTML output uses cascading style sheets (CSS) to format the table, so you can easily change the layout.
  • Many other file formats are supported through KeePass plugins.

Import from CSV, CodeWallet(Pro) TXT and Password Safe v2 TXT files
  • KeePass uses the common CSV export format of various passwords safes like Password Keeper and Password Agent. Exports from these programs can be easily imported to your KeePass databases.
  • KeePass can parse and import TXT outputs of CodeWalletPro, a commercial closed-source password safe.
  • KeePass can import TXT files created by Bruce Schneier's Password Safe v2.
  • Many other file formats are supported through KeePass plugins.

Easy database transfer
  • A password database consists of only one file that can be transferred from one computer to another easily.

Support of password groups
  • You can create, modify and delete groups, in which passwords can be sorted into.
  • The groups can be arranged as a tree, so a group can have subgroups, those subgroups can have subgroups themselves, etc.
  • Also see this screenshot.

Time fields and entry attachment support
  • KeePass supports time fields: creation time, last modification time, last access time and expiration time.
  • You can attach files to password entries (useful to store PGP signature files in KeePass for example).

Auto-type, global auto-type hot key combination and drag-n-drop support
  • KeePass can minimize itself and type the information of the currently selected entry into dialogs, webforms, etc. Of course, the typing-sequence is 100% user-customizable, read the documentation file for more.
  • KeePass features a global auto-type hot key. When KeePass is running in the background (with opened database) and you press the hot key, it looks up the correct entry and executes its auto-type sequence.
  • All fields, title, username, password, URL and notes can be drag-n-dropped into other windows.

Intuitive and secure Windows clipboard handling
  • Just double-click on any field of the password list to copy its value to the Windows clipboard.
  • Timed clipboard clearing: KeePass can clear the clipboard automatically some time after you've copied one of your passwords into it.
  • Protection against clipboard monitors (other applications won't get notifications that the clipboard content has been changed).
  • Paste-once functionality: allow only one paste operation, after pasting the clipboard is cleared automatically by KeePass.

Searching and sorting
  • You can search for specific entries in the databases.
  • To sort a password group, just click on one of the column headers in the password list, you can sort by any column.

Multi-language support
  • KeePass can be translated into other languages very easily.
  • Over 20 different languages are available already.
  • See the translations page.

Strong random password generator
  • KeePass can generate strong random passwords for you.
  • You can define the possible output characters of the generator (number of characters and type).
  • Random seeding through user input: mouse movement and random keyboard input.

Low memory requirement
  • KeePass uses very few memory, only the memory really needed is allocated.
  • No unnecessary memory- and cpu-consuming things like any animations are used.

Plugin architecture
  • Other people can write plugins for KeePass.
  • Plugins can extend the functionality of KeePass, like providing additional import/export methods for other file formats.
  • Go to the plugins page for more information and plugin downloads.

Open-Source!
  • KeePass free and you have full access to its source code!
  • Open-Source prevents from backdoors. You can have a look at its source code and compile it yourself.
  • You can yourself check if the security is implemented correctly, you can, if you want, use any other encryption algorithm.
  • Opening the sources also encourages other people to port the application to other systems (PocketPC version already in development) or write translations.
  • KeePass is OSI Certified Open Source Software. OSI Certified is a certification mark of the Open Source Initiative.

1 The Windows logo and "Windows" are trademarks and are copyright © Microsoft Corporation.


Passwords and Key-Disks

KeePass stores your passwords securely in an encrypted database. This database is locked with a master password and/or a key-disk.

Master passwords

If you use a master password, you only have to remember one password or passphrase (which should be good then!). KeePass has some basic protection against brute-force and dictionary attacks, read the security information page for more about this.

If you forget this master password, all your other passwords in the database are lost, too. There isn't any backdoor or a key which can open all databases. There is no way of recovering your passwords.

Key-disks

But you don't even have to remember a long, complicated master passphrase. The database can alternatively be locked using a key-disk. A 'key-disk' is just a normal disk which holds a file with password bytes (KeePass can generate such disks for you). If you want, you can also select the key-file (which is stored on the key-disk) manually, i.e. one disk can store multiple keys for multiple databases. In this case, you have to tell KeePass which file it should use, you cannot simply select a drive then any more (when you just select a drive, KeePass assumes that it should load the 'pwsafe.key' file in the root directory of the disk).

If you lose the key-disk (or more precise: the key-file) and have no backup copy of the key-file, your passwords in the database are lost, too. It's just the same as forgetting the master password.

To backup a key-disk, backup the file 'pwsafe.key', which is stored in the root directory of your key-disk. If you've chosen to select the key-file manually (i.e. it's not automatically named 'pwsafe.key'), you need to backup this file.

Master password and key-disk

Last but not least KeePass supports combining the two locking method above. Databases can be locked using a key-file and a master password. If you lose one of them, you cannot unlock your database. On the other hand: if someone steals your key-disk and password database, the database is still secure because the attacker doesn't know your master password.


Security Information

Jump to: [Database encryption] - [Hashing] - [Random number generation] - [Protection against dictionary attacks] - [Process memory protection] - [Locking the workspace] - [Plugins] - [Self-tests] - [References]

Database encryption

All databases are encrypted. KeePass always encrypts the whole database, i.e. not only your passwords. Your usernames, notes, even the entry times and UUIDs, etc. are encrypted, too.

The databases are encrypted using one of the following two block ciphers:

Cipher | Block size | Key size
Advanced Encryption Standard (AES / Rijndael) | 128 bits | 256 bits
Twofish | 128 bits | 256 bits

For those who don't know: these algorithms are well-known, well-analyzed and generally considered to be secure by the cryptographic community (see [1] for comments by the NIST on AES for example).

The block ciphers are used in the CBC (cipher-block chaining) block cipher mode.

For both algorithms, a 128-bit initialization vector (IV) is generated randomly each time you save the database.

Hashing

In order to generate the 256-bit key for the ciphers the secure hash algorithm SHA-256 is used. Please note that the recently discovered attack against SHA-1 [2] doesn't affect the security of SHA-256. SHA-256 is still considered as being secure [3].

The user key (the passphrase the user enters or the byte string in the key-file) plus an 128-bit random salt is hashed using SHA-256. This random salt prevents attacks that are based on pre-computed hashes.

When using both master key and key-disk together, the final key is derived as follows: SHA-256(SHA-256(master password), key-file contents), i.e. the hash of the master password is concatenated with the key-file bytes and the resulting byte string is hashed with SHA-256 again. If the key-file contents aren't exactly 32 bytes (256 bits), they are hashed with SHA-256, too, to form a 256-bit key, i.e. the formula above changes to: SHA-256(SHA-256(master password), SHA-256(key-file contents)).

Random number generation

We need to generate several 'random' bytes (for the IV, the master key salt, etc.). For this, several pseudo-random sources are used: current tick count, performance counter, system date/time, mouse cursor position, memory status (free virtual memory, etc.), active window, clipboard owner, various process and thread IDs, various window focus handles (active window, desktop, ...), window message stack, process heap status, process startup information and several system information structures.

This pseudo-random data is collected in a random pool. To generate 16 random bytes, the pool is hashed (SHA-256) with a counter to form the final 16 random bytes. The counter is increased after 16 generated bytes, this way we can produce as many secure random bytes as we need.

Protection against dictionary and brute-force attacks

KeePass offers some protection against brute-force and dictionary attacks. This is only needed when using master passwords, key-disks don't need this, they are more secure anyway [4].

You can't really prevent dictionary and brute-force attacks, nothing prevents an attacker to just try all possible keys and look if the database decrypts. But what we can do (and KeePass does) is to make it harder: by adding a constant time factor to the key initialization, we can make them as hard as we want [5] [6].

To generate the 'final' 256-bit key that is used for the block cipher, KeePass first hashes the users key (SHA-256), encrypts the result N times using the Advanced Encryption Standard (AES) and then hashes it again (SHA-256). Since the AES transformations aren't pre-computable, an attacker has to perform all the encryptions, too, otherwise he cannot try and see if the key he is currently trying is correct. The key used for the AES transformation is randomly generated and stored in the database header (this prevents pre-computing the AES transformations, although this is almost impossible anyway).

By default, KeePass sets N to 6000 encryption 'rounds' (full encryptions are meant, has nothing to do with the internal encryption rounds of AES). This has been done in order to provide compatibility to the PocketPC version (PocketPC processors are slower, therefore the key computation takes longer). Nothing prevents you from setting this to a much larger value (you can set it in the database options dialog), if you accept a one-second delay on your PC when opening a KeePass database, you can even set it to a few 100.000s. Think about this: an attacker now also needs much longer to try a key. If it takes him one second for one key, he can almost forget any dictionary and brute-force attacks.

In-memory passwords protection

While KeePass is running, your passwords are encrypted using a 'session key' (randomly generated at startup). This means, that even if you would dump the whole KeePass process memory to disk, you couldn't find the passwords (at least not in plain text). Note that this only applies to the passwords field, not to the usernames, etc. because of speed reasons. When you want to copy a password to the clipboard for example, KeePass first decrypts the password field using the session key, copies it to the clipboard and immediately re-encrypts it using the session key. Here, ARC4 is used as encryption algorithm, the session key has a fixed size of 12 bytes.

KeePass securely erases all security-critical memory when it's not needed any more, i.e. it overwrites those memory areas with random data before zeroing and releasing it (this applies to all security-critical memory, not only the passwords field).

Locking the workspace

What happens when you lock the workspace? Why are you sometimes prompted to save the database first? It's simple: locking the workspace just closes the database completely, but remembers the last view settings (i.e. which group and entry you selected, list position, etc.). This provides maximum security (unlocking the workspace is as hard as opening the database the normal way) and prevents data-loss (what if your computer crashes while the workspace is locked?).

Plugin security

A separate page exists about the security of plugins: Plugin Security.

Self-tests

Each time you start KeePass, the program will perform a quick self-test to see whether the block ciphers and the hash are compiled correctly and pass their test-vectors. If one of the algorithms doesn't pass its test-vector, KeePass will show you a security exception message box at startup.

References

[1] National Institute of Standards and Technology: Report on the Development of the Advanced Encryption Standard (AES) (PDF).

[2] Bruce Schneier's blog: SHA-1 broken.

[3] Bruce Schneier's blog: Cryptanalysis of SHA-1, with comments about the impact of that discovery and what to do now.

[4] KeePass Open Discussion: Number of encryption rounds when using key file.

[5] KeePass Open Discussion: Security improvement by multiple hashing.

[6] KeePass Open Discussion: What stops brute force attacks on KeePass?.


Plugins

KeePass Plugins

Introduction

KeePass features a plugin framework. Plugins can provide additional functionality, like support of more file formats for import/export, network functionalities, backup features, etc.

Online Resources

You can download the latest KeePass plugins (and their source code) from:
http://keepass.sourceforge.net/plugins.php

Plugin installation

To install a plugin, follow these steps:
  1. Download the plugin from the page above and unpack the .ZIP file to a directory of your choice.
  2. Copy the plugin .DLL file into the KeePass directory (where the KeePass.exe is).
  3. Start KeePass and enable the plugin in the plugin manager ('Extras - Plugin Manager').
  4. Restart KeePass in order to load the new plugin.
To uninstall a plugin, just delete its .DLL file. You don't need to disable it in the plugin manager first.

Security

Some people had doubts about the security of plugins: can't malicious spyware plugins 'inject' themselves into KeePass? Of course, they theoretically can, but if plugins can register themselves (i.e. have write access to the KeePass directory), they could also just replace the whole KeePass.exe. It's rather a problem of the file system security, not the plugin system.

If you worry about this, you can do the following:

  1. Install KeePass as administrator.
  2. Delete the KeePass.ini in the KeePass directory.
  3. Write-protect the KeePass directory. Nobody must have write-access.
  4. Log on as normal user (with no administrator privileges).
This will solve the problem above. Since the KeePass directory is write-protected, no other program can copy files into it. KeePass requires the plugins to be in the application directory, paths with characters like '.' and '\' are simply rejected. Therefore, plugins cannot inject themselves anymore.

Because you have deleted the .INI file and KeePass cannot create a new one in its application directory, it'll use your users directory.


FAQ

Frequently Asked Questions (FAQ)

  • How can I help you?
  • My options aren't saved! Why?
  • Rename columns / other "card types" feature requests
  • Will there be KeePass versions for other OSs than Windows?
  • What are those 'Secure Edit Controls'?

How can I help you?

If you like KeePass and would like to help me in some way:
  • Donate
    This is maybe the best way of helping me, if you don't have that much time or experience in application development. This is the recommended way of helping me for "standard users".
  • Make a translation
    If you have some free time, you could make a translation of KeePass (of course only if you're language isn't offered already)!
  • Test new releases and submit bugfixes
    KeePass is under constant development, new features get implemented, bugs get fixed. If you have some free time, you could just test the new releases thoroughly and if you're a programmer, look through the sources to find bugs and maybe even submit fixes.
  • Spread the word
    KeePass isn't that widely-known yet. If you like KeePass, tell all your friends how great KeePass is, publish articles about it, press it on CDs/DVDs, sell it with your USB sticks, submit it to software archives, talk in forums about it, etc.!

My options aren't saved! Why?

When saving the options, KeePass does the following:
  • Try to save the options to the global KeePass.ini file in the KeePass program directory.
  • If this fails (for example if the program directory is protected), write the options to a KeePass.ini file in the users directory (subdirectory 'KeePass' in application data).
When loading, KeePass performs the following:
  • Try to find the key (the option) in the global KeePass.ini file.
  • If this fails (file inaccessible or key doesn't exist), try loading it from the KeePass.ini file in the users directory (subdirectory 'KeePass' in application data).
Now, if you use the KeePass installer and install it with admin rights, the program directory will be write-protected when working as a normal user. That means that KeePass saves your options into your users directory, but loads them from the global KeePass.ini.

If you want KeePass to use just the users directory, logon to Windows with admin rights and delete the global KeePass.ini in the program directory. This forces KeePass to use the KeePass.ini in the users directory for both reading and writing when logging on as normal Windows user (without admin rights).

A note to network administrators: all settings in the global KeePass.ini file override the settings of the users. That means that you can selectively force some options, but leave other options to the users. For this, open the global KeePass.ini file on the network drive and have a look at it. Delete all entries that you want to leave up to the user (don't just set it to nothing, delete the line completely!). The options you set in the global KeePass.ini are forced for all users, all other options are configurable by the users (they are written to the KeePass.ini in the users directory). Make sure you write-protect the global KeePass.ini on the network drive so nobody can overwrite it.

Rename columns / other "card types" feature requests

Many feature requests like these have been posted over and over again: rename the columns, add more URL fields, add an entry-type field (let the user define whether that entry is a login account, credit card, etc.), hide some dialog elements for some special entry-type, support different "card types" (you could choose "credit card" as entry-type and KeePass would show fields needed for credit card information), etc.

KeePass has been designed from ground up to have the fixed fields you see in the add-entry dialog. All parts of KeePass, starting from the core password manager, all the dialogs, up to the main GUI code, are based on this. Supporting different card types would require a total rewrite of almost all the code. Really almost everything would have to be changed, the tree/listview layout system wouldn't work any more, the database format would have to be rewritten from scratch, many of the dialogs would have to be redesigned totally. Short: it's impossible. Creating a completely new project would be far less work than implementing this into KeePass.

Even if I would provide the ability to rename the columns/fields, the structure would remain. For example, the URL field would continue to be a clickable URL field, though you would have declared it as "PIN" field. This would confuse more users than help some, therefore I won't implement any renaming ability.

E-mail address field feature request

Especially one feature request is made very often: add an e-mail field. For e-mail accounts for example you would need such a field. I won't add an e-mail field, you can use the username field for this. There are mostly two "types" of e-mail accounts: either enter a username and a password (standard e-mail servers) or enter your e-mail address and a password (web-based e-mail services) to login. The first one isn't a problem anyway and for the second one you can just store your e-mail address in the username field. Even if your provider requires 3 fields (username and e-mail address and password) to login, you can for example just modify the auto-type sequence (so practically store your e-mail address in the auto-type sequence) or store the additional data in the title, URL or notes field.

The end-user must be flexible enough to use the username or URL field for e-mail addresses, the password fields for credit card numbers, etc. The notes field accepts the rest, i.e. everything that doesn't fit into the title / user-name / URL / password field scheme.

Will there be KeePass versions for other OSs than Windows?

The desktop KeePass application has been developed from start on to work on Windows operating systems. It uses the Microsoft Foundation Classes (MFC) and several other platform-dependent stuff that makes porting relatively hard.

Anyway, the KeePass core (i.e. the password management code, simply everything except the graphical user interface [GUI]) is platform-independent and therefor "ports" are theoretically possible, although you cannot really speak of a port here, since the whole user interface needs to be rewritten.

Also, KeePass is written in C++. No chance to convert it to Java to make it platform-independent. If you would like a KeePass written in Java, have fun rewriting it completely from scratch. Although C++ and Java are relatively similar, converting the existing C++ code to Java involves much work, most probably more work than just writing a completely new password manager in Java.

But people can make KeePass "ports", as one can easily see: KeePass for PocketPC. I assume that, when rewriting the GUI code, you can "port" KeePass to almost any platform, since the core password manager code is totally platform-independent.

Now before you ask when the Linux/PalmOS/etc. versions are ready: I don't know. I myself just don't have the time to develop these versions. Keep in mind that I'm developing KeePass in my free time and, apart from donations, don't get anything for it. I will happily develop KeePass for Windows, also in the future yes, but I don't have the time to develop a Linux version for example. I also never programmed any single PalmOS program, I don't even own a PalmOS.

KeePass is Open-Source. If you have the time to develop KeePass-compatible applications (as said, it cannot be really "ported"), feel free to contact me and I will happily support you as good as I can.

Additional reading:
Open Discussion: KeePass for PalmOS...?
Open Discussion: WxWidgets support?

What are those 'Secure Edit Controls'?

Secure Edit Controls are special password edit controls that are resistant to window spies and memory dumpers.

There are many tools that read out the entered passwords of standard Windows password edit controls. These standard edit controls aren't secure: other applications can easily get the entered texts, even though Windows shows the nice password asterisks/dots. Secure edit controls are resistant to this. None of the window spies are able to read out the contents of a Secure Edit Control.

Additionally, Secure Edit Controls scramble the entered password in a way that it cannot even be found in the process memory of the application. If Windows caches the whole application to disk while entering the password, this wouldn't reveal the entered text anyway! The standard edit controls provided by Windows react completely different: the password would be easily readable as plain-text.

KeePass was the first application offering this level of security. Since the source code for Secure Edit Controls is open-source, most probably many other password managers will adopt and integrate them soon, too.

See the additional reading link [1] below for a detailed article on Secure Edit Controls (how they work, their limitations, etc.).

Additional reading:
[1] An article by Dominik Reichl on Secure Edit Controls


Thanks and Acknowledgements

At this place I want to thank a few people very much for their help, source code, classes and suggestions: (no particular order)
  • Szymon Stefanek - for his C++ implementation of the Rijndael cipher.
  • Dr Brian Gladman - for his C implementation of the SHA-2 (256/384/512) hashing algorithms.
  • Brent Corkum - for his XP-like menu (BCMenu).
  • Davide Calabro - for his CButtonST class.
  • Paul S. Vickery - for his hyperlink edit control.
  • Peter Mares - for his side banner window class.
  • Chris Maunder - for his CSystemTray class.
  • Hans Dietrich - for his XHyperLink class.
  • Daniel Turini - for suggesting "KeePass" as name of the project.
  • Christopher Bolin - for the nice icons.
  • Lallous - for the nice SendKeys engine.
  • PJ Naughter - for the single instance checking class.
  • DonAngel - for creating and maintaining the Bulgarian translation.
  • Petr Chramosta - for creating and maintaining the Czech translation.
  • Henrik Gregersen - for creating and maintaining the Danish translation.
  • Kees Koenders - for creating and maintaining the Dutch translation.
  • Andri Viiand - for creating and maintaining the Estonian translation.
  • Marc Tissot - for creating and maintaining the French translation.
  • Tomer Shalev - for creating and maintaining the Hebrew translation.
  • documan - for creating and maintaining the Hungarian translation.
  • Mauro Rossi - for creating and maintaining the Italian translation.
  • Hiroki Matsumoto - for creating and maintaining the Japanese translation.
  • Park Dae Beom - for creating and maintaining the Korean translation.
  • Oliver Noveski - for creating and maintaining the Macedonian translation.
  • Jo Chapparal - for creating and maintaining the Norwegian translation.
  • Maciej Chojnacki - for creating and maintaining the Polish translation.
  • Fabio Negri Cicotti - for creating and maintaining the Portuguese translation.
  • Varrey - for creating and maintaining the Russian translation.
  • Leo Dou - for creating and maintaining the Simplified Chinese translation.
  • Radoslav Bielik - for creating and maintaining the Slovak translation.
  • Marcel Trujillo - for creating and maintaining the Spanish translation.
  • Michael Åström - for creating and maintaining the Swedish translation.
  • Kao Shiang-Yuan - for creating and maintaining the traditional Chinese translation.
  • Erhan Burhan - for creating and maintaining the Turkish translation.
  • Alexey Zinchuk - for creating and maintaining the Ukrainian translation.
  • (see the translations page for all translations)
  • The UPX team - for the UPX executable compressor


Online Resources

KeePass Homepage
http://keepass.sourceforge.net/

Donations: support KeePass!
http://sourceforge.net/donate/index.php?group_id=95013

Translations: get KeePass in your language!
http://keepass.sourceforge.net/translations.php

Plugins: adding new functionalities to KeePass!
http://keepass.sourceforge.net/plugins.php

Forums and Documentation

KeePass FAQ (Frequently Asked Questions)
http://keepass.sourceforge.net/faq.php

Submit a Bug
http://sourceforge.net/tracker/?atid=609908&group_id=95013&func=browse

Submit a Feature Request
http://sourceforge.net/tracker/?atid=609911&group_id=95013&func=browse

KeePass Open Discussion Forum
http://sourceforge.net/forum/forum.php?forum_id=329220

Developer Resources

For Developers: KeePass CVS
http://sourceforge.net/cvs/?group_id=95013


License

KeePass License

KeePass is Copyright (C) 2003-2005 Dominik Reichl <dominik.reichl@t-online.de>.

The program is distributed under the terms of the GNU General Public License version 2 or later. The full source code can be obtained from the official KeePass homepage.
            GNU GENERAL PUBLIC LICENSE
               Version 2, June 1991

 Copyright (C) 1989, 1991 Free Software Foundation, Inc.
                       51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                Preamble

  The licenses for most software are designed to take away your
freedom to share and change it.  By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users.  This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it.  (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.)  You can apply it to
your programs, too.

  When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.

  To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.

  For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have.  You must make sure that they, too, receive or can get the
source code.  And you must show them these terms so they know their
rights.

  We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.

  Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software.  If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.

  Finally, any free program is threatened constantly by software
patents.  We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary.  To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.

  The precise terms and conditions for copying, distribution and
modification follow.

            GNU GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License.  The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language.  (Hereinafter, translation is included without limitation in
the term "modification".)  Each licensee is addressed as "you".

Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope.  The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.

  1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.

You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.

  2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:

    a) You must cause the modified files to carry prominent notices
    stating that you changed the files and the date of any change.

    b) You must cause any work that you distribute or publish, that in
    whole or in part contains or is derived from the Program or any
    part thereof, to be licensed as a whole at no charge to all third
    parties under the terms of this License.

    c) If the modified program normally reads commands interactively
    when run, you must cause it, when started running for such
    interactive use in the most ordinary way, to print or display an
    announcement including an appropriate copyright notice and a
    notice that there is no warranty (or else, saying that you provide
    a warranty) and that users may redistribute the program under
    these conditions, and telling the user how to view a copy of this
    License.  (Exception: if the Program itself is interactive but
    does not normally print such an announcement, your work based on
    the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole.  If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works.  But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.

In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.

  3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

    a) Accompany it with the complete corresponding machine-readable
    source code, which must be distributed under the terms of Sections
    1 and 2 above on a medium customarily used for software interchange; or,

    b) Accompany it with a written offer, valid for at least three
    years, to give any third party, for a charge no more than your
    cost of physically performing source distribution, a complete
    machine-readable copy of the corresponding source code, to be
    distributed under the terms of Sections 1 and 2 above on a medium
    customarily used for software interchange; or,

    c) Accompany it with the information you received as to the offer
    to distribute corresponding source code.  (This alternative is
    allowed only for noncommercial distribution and only if you
    received the program in object code or executable form with such
    an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for
making modifications to it.  For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable.  However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.

If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.

  4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License.  Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.

  5. You are not required to accept this License, since you have not
signed it.  However, nothing else grants you permission to modify or
distribute the Program or its derivative works.  These actions are
prohibited by law if you do not accept this License.  Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.

  6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions.  You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.

  7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all.  For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.

If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.

It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices.  Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.

This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.

  8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded.  In such case, this License incorporates
the limitation as if written in the body of this License.

  9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time.  Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

Each version is given a distinguishing version number.  If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation.  If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.

  10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission.  For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this.  Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.

                NO WARRANTY

  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.

  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.

             END OF TERMS AND CONDITIONS

        How to Apply These Terms to Your New Programs

  If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.

  To do so, attach the following notices to the program.  It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.

    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

Also add information on how to contact you by electronic and paper mail.

If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:

    Gnomovision version 69, Copyright (C) year name of author
    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License.  Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.

You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary.  Here is a sample; alter the names:

  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
  `Gnomovision' (which makes passes at compilers) written by James Hacker.

  <signature of Ty Coon>, 1 April 1989
  Ty Coon, President of Vice

This General Public License does not permit incorporating your program into
proprietary programs.  If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library.  If this is what you want to do, use the GNU Library General
Public License instead of this License.


Auto-Type feature

  • Basic information about the auto-type feature
  • Global auto-type hotkey, defining the target window
  • An example
KeePass features an "auto-type" functionality. This feature allows you to define a sequence of keypresses, which KeePass can automatically perform for you.

The default auto-type sequence is:

{USERNAME}{TAB}{PASSWORD}{ENTER}

If you don't define your own auto-type sequence, this sequence is sent. {USERNAME} is replaced by the username field contents of the currently selected entry. {TAB} simulates a TAB keypress, {PASSWORD} enters the password of the entry and {ENTER} finally simulates an ENTER keypress.

But you can freely define your own Auto-Type sequence: simply write the sequence into the notes field of the entry, prefixed with "Auto-Type:". Your notes could look something like this:

You can write any notes here.
My e-mail I used to register: test@nowhere.com

Auto-Type: {USERNAME}{TAB}{TAB}Some fixed string{TAB}{PASSWORD}{ENTER}

Here you can continue with your notes if you wish...
As you can see, the only important thing is that the auto-type sequence is prefixed using "Auto-Type:" and is one single line. An auto-type sequence cannot be defined using two or more lines. If you define two auto-type sequences, the first one is used.

KeePass supports the following tags that are automatically substituted by their field contents:

Field | Code
Title field | {TITLE} or %TITLE%
Username field | {USERNAME} or %USERNAME%
URL field | {URL} or %URL%
Password field | {PASSWORD} or %PASSWORD%
Notes field | {NOTES} or %NOTES%

In the example above, {TAB} has been substituted by a TAB keypress. The following codes for special keys are supported:

Special key | Code
Backspace | {BACKSPACE}, {BS} or {BKSP}
Break | {BREAK}
Caps Lock | {CAPSLOCK}
Del or Delete | {DEL} or {DELETE}
End | {END}
Enter | {ENTER}
Esc | {ESC}
Help | {HELP}
Home | {HOME}
Ins or Insert | {INS}
Num Lock | {NUMLOCK}
Scroll lock | {SCROLL}
Page down | {PGDN}
Page up | {PGUP}
Print screen | {PRTSC}
Arrow left | {LEFT}
Arrow right | {RIGHT}
Arrow up | {UP}
Arrow down | {DOWN}
F1 ... F16 | {F1} ... {F16}
Keypad add | {ADD}
Keypad subtract | {SUBTRACT}
Keypad multiply | {MULTIPLY}
Keypad divide | {DIVIDE}
+ | {PLUS}
@ | {AT}
% | {PERCENT}
Apps | {APPS}
^ | {CARET}
~ | {TILDE}
{ } | {LEFTBRACE} {RIGHTBRACE}
( ) | {LEFTPAREN} {RIGHTPAREN}
Windows key left, right | {WINL} {WINR}
Windows key | {WIN} (equ. to WINL)
Windows key | @
Shift | +
Control | ^
Alt | %

Additionally, some special commands are supported:

Command syntax | Action
{VKEY X} | Sends the VKEY of value X.
{BEEP X Y} | Beeps with a frequency of X and a duration of Y milliseconds.
{DELAY X} | Delays X milliseconds.
{DELAY=X} | Sets the default delay to X milliseconds for all following keypresses.
{APPACTIVATE WindowTitle} | Activates the window "WindowTitle".

Here are some examples:

{DELAY=50}{WIN}{UP}{UP}{UP}{ENTER}notepad{ENTER}
Starts Notepad.

{TITLE}{TAB}{USERNAME}{TAB}{PASSWORD}{ENTER}
Types the title, a tab, the username, a tab and the password of the currently selected item.

{TAB}{PASSWORD}{ENTER}
Presses the tab key, enters the password and presses return.

Global Auto-Type Hotkey, Defining The Target Window

KeePass supports a global hotkey, which executes the auto-type sequence of an entry as described above. When the hotkey is pressed, KeePass looks through all entries and compares their auto-type window associations with the actual current/active window title. If one matches, KeePass executes the auto-type sequence of that entry.

Similarly to the auto-type sequence string in the notes field above, you can define the matching window:
You can write any notes here.
My e-mail I used to register: test@nowhere.com

Auto-Type: {USERNAME}{TAB}{TAB}Some fixed string{TAB}{PASSWORD}{ENTER}
Auto-Type-Window: SourceForge.net*

Here you can continue with your notes if you wish...
If you now have a window open that starts with "SourceForge.net" and press the global auto-type hotkey combination, KeePass performs the auto-type sequence above.

The default Auto-Type-Window string is *{TITLE}*. So, if you don't define your own Auto-Type-Window string, KeePass will compare the titles of your entries with the actual window title and if an entry title is a substring of the window title, that entry is auto-typed.

As you can see in the example above, you can use simple wildcards:

String with wildcard | Meaning
STRING | Matches all window titles that are named exactly "STRING".
STRING* | Matches all window titles that start with "STRING".
*STRING | Matches all window titles that end with "STRING".
*STRING* | Matches all window titles that have "STRING" somewhere in the window title. This includes the string being directly at the start or at the end of the window title.

Other wildcards aren't supported. The * wildcard must not be in the middle of a string.

For example, this is invalid: "*Windows*Explorer*". This won't match "Windows Explorer", it will only match "Windows*Explorer", i.e. the middle * character is treated as '*' character instead of a wildcard.

An example

Now let's have a look at a real-world example: logging in at SourceForge.net. Write the following into the notes field of your SourceForge.net entry:
Auto-Type: {USERNAME}{TAB}{PASSWORD}{ENTER}
Auto-Type-Window: SourceForge.net*
Assume you have set the global auto-type hotkey to Ctrl-Alt-A in the options dialog (you can change the hotkey there). KeePass is running in the background, you have opened your database and the workspace is unlocked.

When you now navigate to SourceForge.net and are being prompted for your username and password, just click into the username field and press Ctrl-Alt-A. KeePass enters the username and password for you! Can it be easier?

And last but not least: since we have used a wildcard, it'll won't just work in one browser window, it'll even work with different browsers! Mozilla Firefox and Internet Explorer both put the page title first in the window title, followed by the product name (i.e. "SourceForge.net - Internet Explorer" and "SourceForge.net - Mozilla Firefox"). That means, that the sequence above will work for both browsers. Most other browsers create their window titles in the same way and the window definition sequence will work with them, too.

Thanks and acknowledgements

KeePass uses the CSendKeys engine, which can be found here: http://www.codeproject.com/cpp/sendkeys_cpp_Article.asp. Thanks to Lallous for creating this nice C++ class!


Auto-complete URLs feature

URLs Field Capabilities

Index:
  • Standard capabilities
  • Executing command-lines
  • Substitutions

Standard Capabilities

The URL field can execute any valid URL, for which you have defined a protocol handler. On most systems at least the http://, ftp:// and mailto: protocols are defined, but KeePass supports all registered protocols the Internet Explorer supports.

So, if you globally (i.e. using the Windows Explorer) register PuTTY for ssh:// URLs, KeePass will automatically use PuTTY for ssh:// URLs, too. KeePass uses the same settings as Windows and Internet Explorer do.

Executing command-lines

Instead of an URL, you can also execute command-lines. To tell KeePass that the data you entered is a command-line, prefix it using cmd://. If you would like to execute Notepad, your URL could look like this:

cmd://C:\WinNT\Notepad.exe C:\Test\MyTestFile.txt

The virtual cmd:// protocol also supports parameters for executed applications, in contrast to the file:// protocol. This was the main reason why cmd:// was introduced, with file:// you aren't able to pass any parameters to started applications. Use the cmd:// protocol instead.

The paths for the cmd:// protocol don't need to be encoded. For example, you do not have to replace space characters by %20, as it is normally required for other URLs. KeePass just cuts away the cmd:// virtual protocol prefix and passes the remaining command-line to Windows.

Substitutions

In the URL field, you can use several special strings that will get automatically replaced when the URL is executed. An example:

http://www.yoursite.com/default.php?user=%USERNAME%&pass=%PASSWORD%

For this entry, KeePass will replace %USERNAME% by the data of the username field and %PASSWORD% by the data in the password field when you execute the link.

The following substitutions are available:

Field | Code
Title field | {TITLE} or %TITLE%
Username field | {USERNAME} or %USERNAME%
URL field | {URL} or %URL%
Password field | {PASSWORD} or %PASSWORD%
Notes field | {NOTES} or %NOTES%


TAN support

KeePass supports TANs, i.e. passwords of a special form (only alphanumerical characters are allowed) that can be used only once. TAN entries are marked as expired when you use the "Copy Password" command on them.

These special passwords are mostly used by banks. For some banks, you need to confirm a transaction using such a TAN, this avoids several security problems and is a pretty secure system.

You can use the KeePass TAN Wizard to add several TANs at once to your database. Just open the TAN wizard dialog (menu Extras - TAN Wizard) and enter all your TANs. The formatting doesn't really matter, KeePass just uses all alphanumerical characters, i.e. characters like newlines, tabs, spaces, dots, etc. are used as separators.

The wizard will then generate several TAN entries from the data you entered into the dialog. Each TAN consists of a standard KeePass entry. The title of a TAN entry is always "<TAN>". This tells KeePass that the entry is a TAN entry, you cannot change the title, username or URL of a TAN (doesn't make sense).

When you use the TAN (i.e. execute the "Copy Password" command on it), its expiration date will be set to the current time, which expires the entry. It will get a red X as icon. If you later want to know when you used a specific TAN, you can just have a look at its expiration date.


Command-Line Options

You can pass a file path in the command-line in order to tell KeePass to open this file immediately after startup. Additionally, you can specify the password and/or key-file location for this database.

The database file location is passed as argument. Only one database file is allowed. It doesn't matter if you enclose the path in quotes (") or not.

Passwords are passed using the -pw: switch. In order to pass 'abc' as password, you would add the following argument to the command-line: -pw:abc. Note that there's no space between the ':' and the password.

For supplying the key-file location, the -keyfile: switch exists. The same rules as above apply, just that you specify the key-file location: -keyfile:D:\pwsafe.key.

In order to just pre-select a drive, without specifying the concrete key-file location and/or password, use the -preselect: option. For example, if you lock your database with a password and a key-disk, but just want to type in the password (so, without selecting the key-drive), your command-line would look like this:
KeePass.exe C:\My Documents\MyDatabase.kdb -preselect:C:\
KeePass would then show you a prompt for the password for the database, but in the key-disk list, the C:\ drive is selected already. When using the preselect switch, KeePass by default activates the 'and' checkbox and sets the focus to the password edit window.

Note the difference! The preselect switch just pre-selects the key-disk for you and displays the login prompt. In contrast, the keyfile switch doesn't prompt you for the (maybe missing) password.

The order of the arguments doesn't matter.

Usage examples

Open the database file 'C:\My Documents\MyDatabase.kdb' (KeePass will prompt you for the password and/or key-file location):
KeePass.exe C:\My Documents\MyDatabase.kdb
If you got a database that is locked with a password 'abc', you could open it like this:
KeePass.exe C:\My Documents\MyDatabaseWithPw.kdb -pw:abc
If your USB stick always mounts to drive F: and you've locked your database with the USB stick as key-disk, you could open your database as follows:
KeePass.exe C:\My Documents\MyDatabaseWithFile.kdb -keyfile:F:\pwsafe.key
If you've locked your database using a password and a key-disk, you can combine the two switches and open your database as follows:
KeePass.exe C:\My Documents\MyDatabaseWithTwo.kdb -pw:abc -keyfile:F:\pwsafe.key
You have your database locked using a password and a key-disk, but only want to have the key-disk pre-selected (i.e. you want to get prompted for the password only), your command-line would look like:
KeePass.exe C:\My Documents\MyDatabaseWithTwo.kdb -preselect:F:\
KeePass would pre-select the drive F:\ for you.


File Formats

Though KeePass supports many more import/export formats, this document only details the CSV and XML file formats. These formats aren't specialized password database formats themselves, but almost all other password manager applications can export their data in some form of CSV and XML. Knowing the formats that KeePass expects when importing, you shouldn't have any problems manually reformating the files in order to get accepted by KeePass. Mostly you just have to rearrange the columns in CSV files for example (using a program like OpenOffice.org's spreadsheet application).

Unfortunately there isn't any standard password database format. Every password manager uses its own file format. Most users are a bit confused when application 1 exports data to a CSV file and application 2 cannot read the file though it claims it can read CSV files. This is because CSV and XML aren't specialized and standardized password database file formats, but just some form of data arrangement. Every program can arrange the data in a different form, making the applications incompatible to each other. Even worse, the files can be encoded in various forms (ANSI, Unicode, UTF-8, ...).

KeePass can import many file formats (for example: CSV, CodeWallet TXT, PwSafe v2 TXT, Personal Vault TXT, AnyPassword CSV, PINs TXT, XML, and many more). The list of supported import formats is increasing daily, have a look at the KeePass plugins page for import format plugins.

These import plugins are specialized on importing data from other password managers and you normally don't need to manually reformat/reencode the files. Therefore first look if a plugin exists for your password manager before experimenting with the CSV and XML formats.

If no import plugin exists for your password manager, feel free to post a request in the KeePass feature requests forum and/or in the open discussion forum.

Import/export: CSV

KeePass imports and exports data from/to CSV files in the following format:
"Account","Login Name","Password","Web Site","Comments"
Example file:
"Account","Login Name","Password","Web Site","Comments"
"Password of \"MyBank\" account","Michael Sample","wefntzuseu46z","www.mybank.com","Credit Card No.: xxxx-xxxx-xxxx-xxxx"
"My Online-Forum","myusername","enkl45h","http://www.myonlineforum.net","multi-line comment
multi-line comment
multi-line comment"
Notes:
  • The whole CSV file must be encoded in UTF-8 when importing. KeePass automatically encodes the file in UTF-8 when exporting data to a CSV file. Other encodings aren't supported.
  • CSV files only support title/user/password/URL/notes. Other fields like the last entry modification time, expiration time, icon, entry file attachments, etc. aren't supported. Use a different file format (like XML) if you need to transfer this information.
  • The strings must be enclosed in quotes ("), unquoted strings aren't allowed.
  • Quotes (") in strings are encoded as \". Backslashes (\) are encoded as \\. Unencoded quotes are not supported and will lead to an importing error message!
  • Multi-line comments and strings are realized through normal line-breaks. They are not encoded by \n or something like this.

Import/export: XML

A sample XML file:
<?xml version="1.0" encoding="UTF-8"?>
<pwlist>
<pwentry>
    <group>General</group>
    <title>I am expired " this was a quot</title>
    <username>Peter Sample</username>
    <url>http://www.google.com</url>
    <password>The Password</password>
    <notes>Some Notes</notes>
    <uuid>3055035d87adbdd617c9fd810e18d788</uuid>
    <image>2</image>
    <creationtime>2005-03-25T17:17:44</creationtime>
    <lastmodtime>2005-03-26T10:14:27</lastmodtime>
    <lastaccesstime>2005-03-26T10:14:27</lastaccesstime>
    <expiretime expires="true">2000-01-01T01:01:00</expiretime>
</pwentry>
<pwentry>
    <group>Internet</group>
    <title>I am expired</title>
    <username>Anonymous</username>
    <url>http://keepass.sourceforge.net</url>
    <password>The Password</password>
    <notes>Some Notes</notes>
    <uuid>8239f06b53cf4f06d1b7ffaa04734288</uuid>
    <image>0</image>
    <creationtime>2005-03-25T17:17:44</creationtime>
    <lastmodtime>2005-03-25T17:17:44</lastmodtime>
    <lastaccesstime>2005-03-25T17:17:44</lastaccesstime>
    <expiretime expires="true">2000-01-01T01:01:00</expiretime>
</pwentry>
</pwlist>
Notes:
  • KeePass exports XML files in UTF-8 encoded form. When importing, the XML files must encoded in UTF-8, too. Other encodings aren't supported.
  • KeePass can export data to XML files directly. It can import data from XML files through a XML import plugin.
  • The following five entities must be encoded: < > & " '. They are encoded by &lt; &gt; &amp; &quot; &apos;.
  • The UUID is a hex-encoded 16-byte string (i.e. an 32 ANSI hex character string in the XML file). The UUID is unique and can be used to identify entries.
  • Dates/times are encoded in the standard date/time XML format: first comes the date in the form YYYY-MM-DD, a 'T' character follows (indicates that a time string follows), the time follows in the form HH:mm:ss.


Secure Edit Controls

KeePass was the first password manager featuring more secure edit controls. The edit controls used in KeePass are resistant to password revealers and password control spies. Additionally, the entered passwords are protected against memory dumping attacks: the passwords aren't even visible in the process memory space of KeePass!

KeePass uses secure edit controls only when the hiding behind asterisks option is turned on! If you show the passwords in plaintext, they won't be protected (secure edit controls are just disabled then, replaced by standard Windows edit controls). In unprotected mode, secure edit controls behave like normal Windows edit controls (no selection limitation, etc.).

Selection Limitation

A 'natural' limitation of these secure edit controls is that you can't select a range of characters. You for example cannot select 3 characters and replace them by the current contents of the clipboard using the paste command.

If you want to delete all the contents of a secure edit control, press Shift-Home or Shift-End. This will remove all entered characters.

Technical background

If you want to know more about how it's working internally, read this article (by the KeePass author) about secure edit controls:

http://www.codeproject.com/editctrl/SecEditEx.asp.