How to Use KeePassXC: The Beginner's Guide (First Database, Master Password, Browser Fill, and the Backup Rule)

CodexFuse Team · 2026-10-30T10:19:15.340Z · 17 min read

Learning how to use KeePassXC takes about twenty minutes, and the whole skill comes down to one idea: your passwords live in a single encrypted file that you own. KeePassXC is a free, open-source password manager for Windows, Mac, and Linux — no accounts, no servers, no subscriptions. You create one encrypted database, lock it with one master password, and from then on you only have to remember that one password while every site gets its own long, random one. This guide walks the complete beginner path in order: install it on your system, create your first database, choose a master password you will never forget, add your first entries, fill logins in your browser, add two-factor codes, and set up sync and backups so the file is never lost. If you are brand new to password managers, the first step — a truly strong master password — is worth doing properly: a free password generator can create one a human could never guess, though for a master password a long passphrase you can type from memory is usually the better pick. KeePassXC is the cross-platform fork of the older program this is modeled on, so if you are on Windows and curious about the original, our KeePass beginner guide covers that lane — the rest of this guide is for KeePassXC itself.

How do you use KeePassXC for the first time?

To use KeePassXC for the first time, install it from keepassxc.org, create a new encrypted database with the built-in wizard, choose a master password you will never forget, and save the database file somewhere it gets backed up. The program's first launch is a blank welcome screen with two big buttons — "Create new database" and "Open existing database" — and there is nothing to sign up for, because there is no company account behind it. Once the database exists, you add entries for your logins, generate random passwords for each site, and use the browser extension or Auto-Type to fill them in.

1. Download and install KeePassXC from keepassxc.org (version 2.8.0, checked October 30, 2026).
2. Click Create new database, give it a name, leave the encryption settings at their defaults, and choose a long master password.
3. Save the database file (a .kdbx file) somewhere your computer backs up, like a cloud-synced folder.
4. Press Ctrl+N to add your first entry: title, username, URL, and a generated password.
5. Install the KeePassXC-Browser extension in your browser and connect it once — after that, logins fill themselves.

Should a beginner use KeePass or KeePassXC?

Beginners should use KeePassXC unless they are on Windows and specifically want the reference implementation's plugin library. The official KeePass 2.x (current release 2.61.1) is a Windows-only program by Dominik Reichl, while KeePassXC is the community-built cross-platform fork that runs on Windows, macOS, and Linux — and keepass.info itself lists KeePassXC as the alternative for Linux and macOS users. Both open the same .kdbx database files, so you can switch later without migrating anything. The old KeePassX project is listed as discontinued; KeePassXC is its living successor.

The practical difference for a beginner is that KeePassXC includes modern conveniences out of the box: browser integration via the KeePassXC-Browser extension, built-in TOTP code generation for two-factor logins, passkey support through the extension, and a built-in command-line tool (keepassxc-cli). The official KeePass reaches similar features through third-party plugins. If your priority is no company's server ever holding your passwords, either one satisfies it — KeePassXC just gets you there on more platforms with less assembly.

How do you install KeePassXC?

Install KeePassXC only from keepassxc.org/download — every supported platform is linked there, and the current version is 2.8.0. The install itself is ordinary on every system, and there is no account step hiding inside it. Pick your path from the table below.

On Linux the download page calls the Flatpak install "the most reliable way to run KeePassXC with automatic updates." On Windows, the portable ZIP is the pick if you do not have installation rights on the machine — it runs from any folder with no install. The browser extension (KeePassXC-Browser) is installed separately from your browser's own extension store later in this guide.

How do you create your first KeePassXC database?

You create your first KeePassXC database by clicking the "Create new database" button on the welcome screen and following the three-page wizard. A database is just an encrypted file — everything in this guide is a detail about that one file. Name it something plain like "Personal," add a short description if you like, and click Continue.

The second page shows encryption settings. The official user guide's advice is to leave them alone, aside from optionally nudging the decryption-time slider — higher values make the database slower to open but harder to brute-force. For a beginner, the defaults are the right call: they are chosen so the database opens quickly on a normal computer while remaining infeasible to crack with a strong master password.

The third page is the one that matters: database credentials. Enter your master password here. Two optional extras appear on the same page: a key file (a file that becomes part of your credentials) and a hardware key such as a YubiKey or OnlyKey. The master-password section below explains when each makes sense. Then click Done and save the file. It gets the .kdbx extension, and it is fully encrypted from the first save — KeePassXC never writes your data unencrypted to disk. Save it somewhere deliberate: a folder that is already backed up, ideally one that syncs to your other devices, because where this file goes, your passwords go.

How do you choose a master password — and should you add a key file?

Choose a master password as a long passphrase of several random words, not a clever short password — length beats complexity. Four or five unrelated words you can type from memory give you a password nobody can guess and everybody can type. Our guide to how long should a password be covers the current NIST guidance behind that rule, and a university KeePass guide recommends more than 16 characters. Type it twice carefully, then immediately do the one test that catches typos: close the database, reopen it, and type the password again while it is still empty.

There is no reset link, and there never will be. The official user guide states it plainly: losing the database password can mean permanently losing the database, with no one — not even the developers — able to retrieve what is inside. That is the price of a system with no company server. Write the passphrase on paper once, store it somewhere physically secure and separate from your computer, and never store it inside the database itself.

One honest piece of beginner advice from the community guides: skip the key file at first. It adds a second thing to back up and to have available on every device, and most people who add one early end up locked out of their own vaults. Get your feet wet with the master password, add a key file later once you understand the backup discipline — KeePassXC lets you add one to an existing database at any time.

How do you add entries and generate passwords?

Add entries with Ctrl+N (or the key-with-green-arrow toolbar button): fill in a title, the username, the site's URL, and a password. Group your entries from day one — right-click in the left panel to create groups like Banking, Email, Social, Work, and Shopping — because search finds anything but groups keep a hundred logins navigable. The entries view also supports tags and saved searches, including one that finds expired and weak passwords.

The reason you use a password manager at all is right here: click the dice icon next to the password field and KeePassXC generates a strong random password for that site, which means your stored passwords never need to be memorable again. You can tune length and character sets per site, and there is a passphrase mode for the rare case you must type the password manually. Always fill in the URL field with the site's real login page — both the browser extension and Auto-Type use it to match entries to the site in front of you.

One setting worth knowing about: since version 2.7.0, double-clicking a username or password cell no longer copies it — a deliberate security change. If you miss that habit, re-enable it under Tools → Settings → General → Entry Management ("Copy data on double clicking field in entry view"). The clipboard clears itself after a short delay by default, so copied passwords do not linger. And when you walk away, lock the database with Ctrl+L or the padlock button — KeePassXC asks you to save and re-prompts for the master password next time.

How do you fill logins in your browser?

The smoothest way to fill logins is the KeePassXC-Browser extension: it pulls usernames and passwords straight from your unlocked database into website fields, with no copy-and-paste. It is available for Chrome, Chromium, Vivaldi, Brave, Firefox, Tor Browser, and Edge — one caution from the official guide: on Linux, Flatpak- and Snap-based browsers are generally not supported, with Ubuntu's Firefox Snap the only known exception. The older cloud managers do this automatically; with KeePassXC you connect the extension once, and it is just as fast afterwards.

1. In your browser's extension store, install KeePassXC-Browser and accept the confirmation dialogs.
2. In KeePassXC, go to Tools → Settings → Browser Integration, tick Enable browser integration, select the browsers you use, and click OK.
3. Make sure your database is unlocked, then restart your browser.
4. Click the KeePassXC-Browser icon in your browser and press Connect; when prompted, give the connection a unique name (for example firefox-laptop) and click Save and allow access. Reusing a name overwrites the previous connection.
5. On each login page, click Allow Selected on the Confirm Access dialog (tick Remember to skip it next time), then click the KeePassXC icon that appears in the username field to fill. If you have several credentials for one site, a dropdown lets you pick.

The extension icon itself tells you the state of the connection: disconnected, running but not connected to this database, connected but locked, or connected and ready — a number badge counts how many credentials match the current site. KeePassXC can also generate passwords directly in the browser: right-click a password field, choose the KeePassXC submenu's password generator, apply the password, and the extension offers to save it back to your database. A newer capability worth knowing: KeePassXC supports passkeys through the browser integration — enable it in the extension's settings page and the extension handles passkey creation and login where sites offer them.

The official guide's note is worth repeating: Auto-Type is a completely separate feature from browser integration — you do not need the extension installed to use it. Most beginners should start with the extension for browser logins and keep Auto-Type in reserve for desktop applications, where no extension exists.

How do you add two-factor codes (TOTP) in KeePassXC?

Add a TOTP code by right-clicking the entry, choosing TOTP → "Set up TOTP…", and pasting the secret the website showed you when you enabled two-factor authentication. TOTP codes are the six-digit numbers that change every 30 seconds — the same thing an authenticator app produces. Once set up, the entry shows a clock icon, the current code appears in the preview pane, and you can copy it with Ctrl+T, fill it with the browser extension, or include it in Auto-Type with the {TOTP} placeholder. If you need the secret on your phone later, the entry's TOTP menu can display it as a QR code for exporting.

Two cautions from the official user guide. First, your computer's clock must be synchronized with an internet time source, or the generated codes will not match the server's — enable automatic time in your OS settings. Second, the honest security note: keeping TOTP codes in the same database as the password removes the "second factor" advantage — anyone who opens the database gets both. If you want maximum security, keep TOTP secrets in a separate database that you only unlock when you need a code. For most beginners the convenience of one vault wins, but you should know the trade-off you are choosing.

How do you sync KeePassXC between devices?

KeePassXC has no sync feature by design — the database file IS the product, so syncing means putting that file where your devices can all reach it. Drop your .kdbx into OneDrive, Dropbox, Google Drive, Nextcloud, or a Syncthing folder, and open the same file from a compatible app on each device: KeePassDX or KeePass2Android on Android, KeePassium or Strongbox on iPhone and iPad. The official user guide confirms this is safe: the file is always fully encrypted, unencrypted data is never written to disk or exposed to the cloud provider, and it recommends a service that keeps version history in case of corruption or accidental deletion.

Two rules keep this from biting you. First, edit the database on one device at a time — sync tools version whole files, not individual entries, so two devices saving at once can silently drop one side's changes. A recent community guide for a KeePassXC-plus-Android setup states the working rule plainly: finish editing on one device, save, let the transfer finish, then open the other device; if conflicting copies appear, preserve both and use Database → "Merge From Database" after backing up both files. Second, if the file sits in a cloud folder, your master password is the only thing between that provider and your logins — which is exactly why the master-password section above said to make it long.

If the file-ownership model turns out to be more than you want, the cloud-sync lane is the honest alternative — our Bitwarden beginner guide covers the free open-source manager that syncs itself across devices with zero file management. Choose KeePassXC when your priority is that no company's server ever holds your passwords; the price of that control is the whole guide above — your sync, your backups, your recovery plan. For many security-minded users, that is not a drawback — it is the point.

The backup rule: two backups before anything else

Here is the truth no beginner guide should bury: there is no "forgot password" link. If you lose the .kdbx file and its master password together, every password inside is gone — the official documentation warns that anyone who gets the file and guesses the password owns everything in it, and there is no company to reset anything. KeePassXC's strength and its one weakness are the same fact: nobody holds a spare key, including you.

So make the backup rule the first entry in your system, not the last. Keep at least two independent copies of the .kdbx file (and of your key file, if you use one) in places that fail independently — for example, the synced folder on your computer plus an encrypted USB stick in a drawer. After any big session of adding accounts, close KeePassXC, copy the .kdbx somewhere else, and verify the copy opens. A database you have never restored from a backup is a database you have never tested.

Sources

• KeePassXC official Download page (keepassxc.org/download) — current version 2.8.0, Windows installer/portable/ARM64/winget/choco paths, macOS Apple Silicon and Intel builds, Linux Flatpak recommendation, AppImage, Snap, PPA and distro packages; fetched 2026-10-30.
• KeePassXC official User Guide (keepassxc.org/docs/KeePassXC_UserGuide) — first-database wizard, encryption defaults, database credentials and key file, cloud-storage safety note, browser integration setup and extension states, TOTP setup and the separate-database security note, passkey support, Auto-Type vs browser integration distinction, double-click copy default change, shortcuts; fetched 2026-10-30.
• RangeForce tutorial, "Installing and using the KeePassXC password manager" (materials.rangeforce.com) — install on Linux, first-database creation, master-key warning, adding entries, Auto-Type.
• PasswordBits, "How To Use KeePassXC" (passwordbits.com/how-to-use-keepassxc) — beginner flow, key-file advice for newcomers, built-in password generator walkthrough.
• Wu Clark, "Your Passwords, Your Vault: Set Up KeePassXC and KeePassDX for GitHub 2FA" (medium.com/@wuclark, 3 days ago) — KeePassXC plus KeePassDX pairing, master-passphrase guidance, TOTP setup, one-device-at-a-time sync rule and merge guidance.
• Philipps-Universität Marburg, "KeePassXC — Password management" guide (uni-marburg.de) — interface structure, browser integration setup steps.
• Serverspace, "KeePassXC Password Manager: Secure Offline Vault with Autofill and TOTP" (serverspace.io) — setup, entry usage, TOTP storage, sync across devices, database reports for weak passwords.

Frequently asked questions

Is KeePassXC safe to use in 2026?

Yes. KeePassXC is free and open source, stores everything locally in an encrypted .kdbx file, and is actively maintained — version 2.8.0 is the current release as of October 2026. Because there is no company server, there is no server to breach; your security rests entirely on your master password and your backups, which this guide covers.

Should a beginner pick KeePass or KeePassXC?

On Windows, official KeePass 2.x is the reference implementation with the largest plugin library. On macOS or Linux — or if you want browser integration and TOTP built in — start with KeePassXC, which keepass.info itself lists as the Linux/macOS alternative. Both open the same .kdbx files, so you can switch later without migrating anything.

What happens if I forget my KeePassXC master password?

You lose access to every password in that database, permanently. There is no recovery flow because there is no company — not even KeePassXC's developers can reset it. This is why the guide insists on a memorable long passphrase, a written copy stored somewhere physically secure, and backups you have actually tested.

Is KeePassXC free, or is there a paid version?

KeePassXC is completely free — there is no premium tier, no account, and no subscription. It is an open-source project maintained by its community team; the download page links a donations page for anyone who wants to support development, but every feature in this guide is available to every user.

Can I store my two-factor codes in the same database as my passwords?

You can, and most beginners do — the entry shows a clock icon and generates the current code for you. But know the trade-off the official guide states: keeping TOTP secrets in the same database as the password removes the second-factor advantage. For maximum security, keep them in a separate database that you only unlock when you need a code.