How to Use KeePass: The Beginner's Guide (First Database, Master Password, Auto-Type, and the Backup Rule)

CodexFuse Team · 2026-10-30T04:22:19.768Z · 12 min read

Most password managers ask you to trust a company with your secrets: your passwords live on their servers, and you hope their security team is having a good decade. KeePass takes the opposite deal. Learning how to use KeePass means learning to keep an encrypted database file that you own — on your own computer, your own USB stick, your own cloud folder — locked with one master password that nobody else can ever reset. It is free, open source, and has been doing this since long before password managers were fashionable.

There is a trade-off, and the guide should say it up front: because no company holds your data, no company can sync it or recover it for you. That makes KeePass the right choice for anyone who refuses to store passwords on a third-party server, and the wrong choice for anyone who wants everything automatic. This guide walks the full beginner path — pick the right edition, create your first database, choose a master key, add entries, fill logins with Auto-Type, sync between devices, and back it up so a lost laptop never means lost passwords. Before you pick your master password, it is worth generating something genuinely strong — a free password generator gives you a random, high-entropy string that no human brain could guess.

What is KeePass, exactly?

KeePass is a free, open-source password manager that stores your passwords in a single encrypted database file (with a .kdbx extension) instead of on a company's servers. You unlock the file with one master password — optionally plus a key file — and inside, your logins are organized into groups like folders. Everything stays local: the database, the entries, and the encryption all live on your own devices, so your passwords are never synced to a third party unless you deliberately place the file somewhere shared.

Which KeePass should you install: official KeePass, KeePassXC, or a mobile app?

The KeePass ecosystem is one program with many compatible clients, and picking the right one saves you confusion later. The official KeePass by Dominik Reichl is a Windows application (current release 2.61.1, per the official download page checked today), while the community-built clients keep your same .kdbx file working everywhere else.

Two notes that matter. First, the official download page is explicit: "Unsure which edition (1.x or 2.x) to choose? If in doubt, use KeePass 2.x" — the 1.x branch (currently 1.43) is legacy. Second, the old KeePassX project is listed by keepass.info as discontinued; KeePassXC is its living successor. The rest of this guide uses the official KeePass 2.x client, but every step maps directly onto KeePassXC's equivalent menus.

Step 1: Download and install KeePass

Get KeePass only from the official site, keepass.info — the download page offers the 2.61.1 installer and a portable ZIP. If you have local installation rights, run the installer and accept the defaults; if you do not (a work laptop, a library machine), grab the portable ZIP, unpack it to a folder or USB stick, and double-click KeePass.exe — it runs with no installation and stores nothing outside its own directory.

When the program first starts, let it check for updates automatically. That is the one piece of housekeeping the program will happily do for you.

Step 2: Create your first database

Your database is the product — everything else in this guide is a detail about that one file. Click File → New (or the leftmost toolbar button) and choose where the .kdbx file will live. Pick the location deliberately: it should sit somewhere you already back up, and ideally somewhere your other devices can reach (a synced folder like OneDrive or Dropbox), because syncing is your job later in this guide.

KeePass then asks for your master key — which deserves its own step, below. After that, a database-settings dialog appears; the official first-steps tutorial says to leave the defaults and click OK. The main window opens with a few sample groups on the left and the entry list on the right — delete the sample groups or rename them, then make your own: Banking, Email, Social, Work, Shopping.

Step 3: Choose your master key — password, key file, or both

The master key is the single point of security for everything you will ever put in this database. KeePass gives you three options, and the official documentation supports all of them — it even notes you can combine a password and a key file "for maximum security."

If you choose a master password, make it a long passphrase rather than a clever short password — length beats complexity, as our guide to how long should a password be explains with the current NIST rules. A university KeePass guide (University of Windsor) recommends more than 16 characters and suggests a phrase or sentence you will actually remember. The official tutorial puts it bluntly: the master password "will be the only password you will ever have to remember from now on," so write the passphrase down once on paper, lock it away, and never store it inside the database itself. And if you use a key file, back up that file with the same care as the database — it is half of your lock.

Step 4: Add your first entries and organize them into groups

Select a group, then right-click the entry list and choose Add Entry. The dialog gives you Title, User Name, URL, Password, and an expiry date — fill what you need and leave the rest empty. When you create an entry, KeePass can generate a strong random password for it right there (the built-in generator defaults to a 20-character, 110-bit password you can tune by length and character set), so your stored passwords no longer need to be memorable at all.

Two habits make the entries actually useful later. First, always fill in the URL field with the site's real login page — Auto-Type and browser shortcuts use it to match entries to the window in front of you. Second, put entries in groups from day one instead of letting everything pile up in "General"; the search box finds anything instantly, but groups keep a hundred logins navigable when search is not enough.

How do you actually use your passwords each day?

KeePass never takes over your browser the way cloud managers do, so you pick a fill method that matches how you work. There are three, and each is a different trade-off between convenience and how often your passwords touch the clipboard.

Most beginners should start with double-click copy, graduate to Auto-Type once they have ten or more entries, and only add a browser extension if they miss the cloud-manager feel. Whichever you pick, lock the database (the padlock button or Ctrl+L) when you walk away — KeePass will ask you to save changes and re-prompt for the master password next time you unlock.

How do you sync KeePass between your devices?

KeePass has no sync feature, and that is by design — the database file IS the product, and wherever the file goes, your passwords go. So pick one sync target and commit to it: drop your .kdbx into OneDrive, Dropbox, Nextcloud, a Syncthing folder, or your own NAS share, and open that same file from KeePass2Android, KeePassium, or KeePassXC on your other devices.

Two rules keep this from biting you. First, edit the database on one device at a time — sync tools version whole files, not individual entries, so two devices saving at once can silently drop one side's changes. Second, if the file is in a cloud folder, your master password is the only thing standing between that provider and your logins, which is exactly why Step 3 said to make it long. KeePass never phones home, but your sync tool does, so treat the cloud folder as semi-public and let the encryption do its job.

The backup rule: two backups before anything else

Here is the truth no ranking page leads with: there is no "forgot password" link. If you lose the .kdbx file and its master key together, every password inside is gone — the official tutorial warns that anyone who gets your database file and guesses the password owns everything in it, and the University of Windsor's guide tells staff flatly that IT cannot restore a lost master password. KeePass's strength and its one weakness are the same fact: nobody holds a spare key, including you.

So make the backup rule the first entry in your system, not the last. Keep at least two independent copies of the .kdbx file (and of your key file, if you use one) in places that fail independently — for example, the synced folder on your computer plus an encrypted USB stick in a drawer. After any big session of adding accounts, close KeePass, copy the .kdbx somewhere else, and verify the copy opens. A database you have never restored from a backup is a database you have never tested.

KeePass vs Bitwarden vs LastPass: which lane are you in?

KeePass owns the offline lane, but it is worth naming the neighboring lanes so you can check you are in the right one. If you want passwords that sync themselves across every device with zero file management, the cloud-sync lane — covered in our Bitwarden beginner guide — is the honest pick. If you want a commercial product with a company behind it and built-in family plans, the commercial lane — covered in our LastPass beginner guide — fits better.

Choose KeePass when your priority is that no company's server ever holds your passwords, when you are comfortable owning one file, and when you would rather trust open-source encryption than a vendor's promises. The price of that control is the whole guide above: your sync, your backups, your recovery plan. For many security-minded users, that is not a drawback — it is the point.

Sources

• KeePass official "First Steps Tutorial" (keepass.info/help/base/firststeps.html) — database creation, master password and key file setup, groups, adding entries, copying credentials, saving; fetched 2026-10-30.
• KeePass official Downloads page (keepass.info/download.html) — current release 2.61.1 (installer and portable), legacy 1.43, "if in doubt, use KeePass 2.x," contributed ports (KeePassXC, KeePass2Android, KeePassDX, KeePassium, Strongbox, KeeWeb), KeePassX listed as discontinued; fetched 2026-10-30.
• University of Windsor, "Using KeePass to Manage Passwords" (uwindsor.teamdynamix.com) — Windows install steps, new-database walkthrough, 16+ character master-password recommendation, "IT Services can not restore" a lost master password; via live search 2026-10-30.
• InformatiWeb, "Store your passwords securely with KeePass Password Safe" (us.informatiweb.net) — built-in generator defaults (20 characters, 110 bits), double-click clipboard copy with auto-clear, Perform Auto-Type walkthrough, browser-extension option; via live search 2026-10-30.
• KeePass SourceForge discussion thread, "How to use Keepass" (sourceforge.net) — Auto-Type default global hotkey (Ctrl+Alt+A) and the default username/Tab/password/Enter sequence; via live search 2026-10-30.

Frequently asked questions

Is KeePass still safe and maintained in 2026?

Yes. The official download page lists KeePass 2.61.1 as the current release, and the .kdbx format uses AES/ChaCha20 encryption with key-derivation functions that make brute-forcing a strong master password infeasible. Its age is an asset here: the format has survived two decades of scrutiny, and the source code is open for anyone to audit.

What happens if I forget my KeePass master password?

You lose access to every password in that database, permanently. There is no recovery flow because there is no company — not even KeePass's developer can reset it. This is why the guide insists on a memorable long passphrase (or a passphrase plus a key file) and on testing your backups before you need them.

Should a beginner pick KeePass or KeePassXC?

On Windows, start with official KeePass 2.x — it is the reference implementation with the largest plugin library. On macOS or Linux, start with KeePassXC, which keepass.info itself lists as the Linux/MacOS alternative. Both open the same .kdbx files, so you can switch later without migrating anything.

Can I use KeePass on my phone?

Yes, by opening the same .kdbx file with a compatible mobile client: KeePass2Android or KeePassDX on Android, KeePassium or Strongbox on iPhone and iPad. Put the database in a synced folder (OneDrive, Dropbox, Syncthing) so your phone and computer read the same file, and remember to edit on one device at a time.

Where should I keep the .kdbx database file?

Somewhere you back up and somewhere your other devices can reach — typically a cloud-synced folder for daily use, plus an encrypted USB stick or external drive as an independent second copy. Never keep your only copy on a single laptop, and never store the master password inside the database it unlocks.