Is KeePass safe? What the 2016, 2023 and 2024 documents say

The short answer, and what it rests on

The pages we read do not call KeePass safe or unsafe in one word, and neither do we. What they give is a set of dated documents, each about a different version. The European Commission’s code review, written in October 2016, covered KeePass 1.31, from the 1.x line. The German Federal Office for Information Security, the BSI, had the contractor mgm security partners analyse KeePass 2.56, and the report is dated April 2024 on its cover page. Between the two, in May 2023, a researcher published a way to recover nearly all of the master password from a memory dump, and version 2.54 was released with a fix.

The download page showed version 2.61.1 as the current one on 3 November 2026. The pages we read do not say whether a third party has reviewed that version. The newest outside analysis we found is the one of 2.56, and the KeePass site has published notes on it with the changes it prompted in 2.57.1.

Two limits sit next to all of this. The Commission report says its review does not guarantee that every vulnerability was detected. The BSI report says its testers had only the ZIP archive of the 2.56 code, held no interviews with the developers, and tested the client alone, so attacks on the system underneath, the clipboard for one, were not considered.

Review sites tell the story differently. CyberInsider writes that KeePass was audited twice, with the latest audit in 2016, and does not mention the BSI report. Cybernews says the BSI commissioned mgm security partners to analyse KeePass 2.x and that the 2023 flaw was fixed in 2.54, without figures from the report. The PasswordManager.com review, as we read it, mentions neither an audit nor the 2023 flaw. This page puts the documents themselves side by side.

What the file does

The KeePass site’s security page says KeePass encrypts the whole database, so user names, URLs and notes are covered as well as passwords. Version 2.x offers AES and ChaCha20, both with 256-bit keys; version 1.x offers AES and Twofish. In 2.x the page says the integrity of the file is checked with HMAC-SHA-256 over the encrypted text, and in 1.x with SHA-256 of the plain text.

The key comes from the master key, which can combine a password, a key file, the Windows account and a key from a plugin, all compressed with SHA-256. A key derivation function with a random salt then slows down every guess. Version 2.x offers AES-KDF and Argon2; Argon2 is offered only in 2.x. The page advises Argon2d over Argon2id for a program like KeePass and says Argon2id suits servers better. For the memory setting it advises two iterations and the smaller of half the RAM of the weakest device and 1 GB.

The defaults are where the sources part. The BSI report notes that KeePass 2.56 uses AES-KDF with 600 thousand rounds by default and calls it a weak key derivation function, rated informational. It points to the BSI technical guideline TR-02102-1, which recommends Argon2id for password-based derivation, notes that KeePass offers it but does not enable it by default, and suggests either switching or multiplying the AES-KDF rounds by twenty. On its test laptop one transformation took 0.021 seconds with the AES-KDF default and 0.214 seconds with the Argon2id default. The KeePass site answers that its defaults follow the OWASP recommendations of 2024, that AES-KDF runs much faster on processors with AES-NI and closer to Argon2 without it, as on devices such as smartphones, and that in its opinion the current values are a good compromise. We do not choose between the two.

Inside the running program, the security page says the master key and the entry passwords are kept encrypted in memory: through the Windows DPAPI on Windows, and otherwise with ChaCha20 under a random key that sits in swappable memory, which the page calls less secure. It lists operations that put data in plain text in memory, among them the standard controls, the clipboard, drag and drop, placeholders, search and any import or export other than KDBX, and it says Windows and .NET may make copies that KeePass cannot erase. Entering the master key on a separate secure desktop, a defence against keyloggers, exists in 2.x and is off by default for compatibility. The program also tests its own algorithms against test vectors at start-up.

The 2016 European Commission review

A Commission news item of 19 August 2016 says KeePass had been selected for a code review by the EU-FOSSA pilot and invites the KeePass community to take part. The report, dated October 2016, covers KeePass Password Safe version 1.31, a C++ program of over 84 thousand lines, reviewed from 24 August to 23 September 2016 for the Commission’s DG DIGIT at the level it calls a security code review. The reviewers used CodeLite for the manual reading and FlawFinder as an automatic tool.

The report lists 14 findings: none critical, none high, five medium, three low and six informational. After an exchange with the KeePass contact, six findings were judged to be already checked in the code, and the report says they do not represent a vulnerability. Its summary says that, from a security point of view, the program can be considered mature, that the findings can be solved without complex developments, and that the risk of exploiting them is low or not possible without changing the source. It sets priorities by time: medium findings in the short term, low ones in the medium term, informational ones in the long term.

Two cautions come with it. The review covers 1.31, the older line, and not the 2.x versions in use today. And the report states that it does not guarantee that all vulnerabilities were found.

The KeePass site describes this review differently. Its ratings page says no security issues were found, while the report lists 14 findings, five of them medium. Both statements are in the sources, and the table below puts them next to the other points where the documents differ. The same ratings page also says the Commission funded bug bounties for KeePass 2.x in 2019 and 2020 and that a few minor issues were found and fixed. That sentence is the KeePass site’s own; we did not read the bounty platform’s page.

The 2024 German analysis

The report is titled as the results report of the BSI project on open-source code analysis, CAOS 3.0, work package 3: KeePass 2.56. It is version 1.1 with the status Final, written by mgm security partners for the BSI. The cover page says 25 April 2024 and the page footers say 25 March 2024; the report disagrees with itself, and we use the cover. The analysis ran from 20 February to 18 April 2024 as a whitebox test, with the code and a running instance. The attacker modelled for the file can read and write the KDBX file but does not know the master password. The testers used static analysis tools including Coverity, Semgrep Pro, DevSkim, CodeQL, Application Inspector and Snyk Code, and CredScan to look for secrets.

The result is that the application has no vulnerability classed as medium, high or critical. There are two low findings and four informational ones, and the report says the informational items are information, not vulnerabilities. The two low findings are these. First, the global auto-type feature fills in the user name and password when the page title contains the entry title, so a malicious page could shape its title to receive the login. Second, one import module, for the service spamex.com, skipped the validation of the SSL certificate, which in theory opens a man-in-the-middle attack. The four informational items are the default key derivation described above, code execution through the cmd:// scheme, passwords that may be carried in a URL, and the following of redirects when a remote database is opened.

The report also counts about 170 duplicated code passages above 100 tokens, the largest match being 649 tokens over 75 lines (the report also lists two matches of 90 lines), and advises refactoring.

The KeePass site answers in the notes for version 2.57.1, thanking the BSI and mgm. It confirms that no medium, high or critical vulnerability was found and that two minor potential vulnerabilities were. It did not adopt the exact title match for auto-type, giving two reasons, and explains how to enforce exact matches with existing settings. It says the cmd:// finding is not a security issue, for the reasons in its Malicious Data section, but liked the suggestion of a warning, so it added confirmation dialogs for the cmd:// scheme and the {CMD:...} placeholder, both on by default, and one for the {REF:P@...} placeholder. It added a Follow redirects option, left on Automatic by default. It removed the Spamex.com import module. For the code duplication, it says it combined or revised part of the files and does not want to change the few remaining findings.

The May 2023 flaw

The flaw has the identifier CVE-2023-32784. The BSI report reproduces its entry: in KeePass 2.x before 2.54, the cleartext master password can be recovered from a memory dump, even with the workspace locked or the program closed. The dump can be of the process, of the swap file pagefile.sys, of the hibernation file hiberfil.sys, or of the memory of the whole system. The entry was published on 15 May 2023, carries a base score of 7.5 assigned by the CNA, and is classed under CWE-312, cleartext storage of sensitive information.

BleepingComputer reported on 5 June 2023 that a researcher using the name vdohney had disclosed it in May with a proof of concept. The report says the dumper recovers almost all characters except the first one or two, while the CVE text in the BSI report says the first character cannot be recovered. We give both. The researcher’s own explanation, quoted by BleepingComputer, puts the problem in a component called SecureTextBoxEx, which leaves strings behind as the password is typed. BleepingComputer adds that a password pasted into the box leaves no such strings, and that KeePass 1.x, Strongbox and KeePassXC are not affected.

Version 2.54 changed two things, according to BleepingComputer: it uses a Windows interface for the text boxes so that no dumpable managed strings are created, and it fills the process memory with dummy strings of random characters. It also moved triggers, global URL overrides and password generator profiles into the enforced configuration, and disabled any that were created with an older version until the user switches them on. BleepingComputer adds that people who could not upgrade were advised to reset the master password and delete crash dumps, hibernation files and swap files, or reinstall the operating system.

The BSI report rates the correction as OK. It describes that from 2.54 the master key and the logon password are encrypted in memory with DPAPI, while user name, notes and attachments are left out for performance reasons. The pages we read do not say how many people were affected or whether the flaw was exploited.

A second identifier, CVE-2023-24055, dated 22 January 2023 with a score of 5.5, concerns someone who can write to the XML configuration file: adding an export trigger could expose the passwords in cleartext. The entry records the KeePass position that the database is not meant to resist anyone with that kind of local access, and the BSI report marks it as disputed. The KeePass site’s security issues page says the same, that write access to the configuration is not something it counts as a vulnerability.

What stays with you

Some limits come from the way KeePass is used, and the KeePass site states them itself. On specialised spyware, it says no feature, whether encrypting the configuration or blocking plugins, adds security if a program built against KeePass runs on the PC, and it recommends antivirus software and a firewall. It refers to the Microsoft article on the Ten Immutable Laws of Security. On malicious data, it says URLs with {CMD:...}, placeholders, {REF:...}, triggers and generator profiles can run code or send data out if a user enters them without checking, and that if the user checks the data they enter or run, none of those attacks works.

The download page lists phone apps only as contributed, unofficial ports: the Android and iPhone/iPad apps, created by other developers. The pages we read say nothing about how safe those apps are, or about synchronisation, which the site covers on a page we did not read.

On downloads, the page offers version 2.61.1 as a portable ZIP and an installer, and version 1.44. Version 2.x runs on Windows 7, 8, 10 and 11, and on Mono for Linux, macOS and BSD, with x86, x64 and ARM64 builds. Windows may show a SmartScreen warning, which the page says can be ignored, with a link to a FAQ. The executable and library files are signed with Authenticode, and the page points to hashes and OpenPGP signatures. KeePass does not update itself: it checks for a newer version using a version file signed with RSA-4096 and SHA-512, fetched over HTTPS and accepted from version 2.34 on, and the person downloads and installs the new one by hand. The site claims over 139 million downloads of 2.x and over 19 million of 1.x from its own site up to January 2026, a figure we could not check elsewhere.

The same security issues page lists points KeePass rejects as problems, among them a timing attack on a comparison function, the KeeFarce tool, formulas in exported CSV files and the matching of windows in auto-type. These are the site’s positions, and we report them as such. On how it compares with other managers, our pages on Bitwarden’s published audits, the 1Password Secret Key and moving passwords between managers follow the same approach.