KeePassXC 2.8.0

Open source password manager for Mac, fully offline

Screenshots

Click to enlarge

KeePassXC is a modern, secure, open-source password manager for Mac. It stores your usernames, passwords, URLs, attachments, and notes in an encrypted file and auto-fills your logins into your favorite apps, so you can forget all about them.

Private by design
Your passwords remain encrypted at all times, and no data is stored on remote servers, so you stay in full control. KeePassXC is ad-free, tracker-free, and cloud-free, with no subscriptions.

Your data, your location
KeePassXC saves your information in an offline, encrypted file that can be stored in any location, including private and public cloud solutions. It is made for people with extremely high demands for secure personal data management.

Key features

Strong encryption: the complete database is always encrypted with the industry-standard AES (Rijndael) algorithm using a 256-bit key.
Offline use: your wallet works offline and requires no Internet connection.
Auto-Type: fill in your credentials automatically without retyping them.
KeePass compatibility: the database format is compatible with KeePass Password Safe.
Many data types: store usernames, passwords, URLs, attachments, and notes in one place.
Open source: the full source code is published under the GNU General Public License (GPLv3) and is openly available on GitHub.
Free forever: KeePassXC is and always will be free as in freedom (and in beer).

Open and community-driven
Open source is a vital prerequisite for any security-critical software product. You can inspect, share, and contribute to the code, and contributions from everyone are welcome.

Version 2.8.0

New Features

Add remote database synchronization and import using external tools [#7222, #10896, #11271]
Allow configuring keyboard shortcuts [#9643]
SSH Agent: Add support for generating RSA, ECDSA, and Ed25519 keys [#7215]
Linux: Add Wayland Auto-Type support using XDG Desktop Portals [#13359, #13449, #13579, #13770, #13810]
Linux: Add Quick Unlock using Polkit (adds a UUID to public metadata, marking database as modified on first launch) [#8983]
Linux Add AArch64 AppImage [#13816]
macOS: Allow Quick Unlock using the device password when Touch ID is unavailable [#11410]
Windows: Allow administrators to enforce certain user settings via global Group Policy overrides [#11223]
Windows: Add native Arm64 builds [#13678, #13727]

Major Changes

Migrate to Qt 6 [#11651, #7783, #13456, #13473, #13684, #13784]
Linux: Store application state in XDG_STATE_HOME instead of XDG_CACHE_HOME [#9755]
Build: Bundle build features under a single KPXC_MINIMAL CMake option [#11003]

Security Fixes

Fix use-after-free when importing crafted KDB files (CVE-2026-69150; Credits: A. Ramos (@aramosf)) [#13500]
Browser: Prevent entry reference injection when creating or updating entries via browser extension (CVE-PENDING; Credits: Davonte (@BadPingHere)) [#13580, #13670, #13688]
Browser: Fix out-of-bounds writes when encrypting and decrypting native messaging messages (CVE-2026-118673; Credits: @sigure21) [#13679]
Windows: Randomize shared memory mapping names when sending SSH keys to Pageant (CVE-PENDING; Credits: NATO Cyber Security Centre (NCSC), Viktor Markopoulos NCIA/NCSC) [#13680]
Fix integer overflow and out-of-bounds read in legacy KDB importer (CVE-PENDING; Credits: NATO Cyber Security Centre (NCSC), Viktor Markopoulos NCIA/NCSC) [#13682]
Secret Service: Exclude protected attributes from attribute listings (Credits: Koda Reef (@kodareef5)) [#13674]
Windows: Fix clipboard exclusion format name (Credits: @ByeWhiteLists) [#13352]
Improve clearing of decrypted database fragments from memory used by zlib [#13677]

Changes

Change Clone Entry shortcut to Ctrl+D [#10903]
Show suggestions when adding or renaming additional attributes [#13633]
Add passkey and TOTP entry counts to database statistics in GUI and CLI [#13632]
Remove legacy KeePassHTTP attribute conversion [#8007]
Browser: Support get-database-entries request to list entry titles, URLs, and UUIDs [#7292]
CLI: Reduce GUI library dependencies and simplify line reader code [#9701, #13330]
Proton Pass Importer: Support Wi-Fi, SSH keys, and unknown entry types [#13148]
Update translations and clean up code [#9702, #12611, #13258, #8008, #7999, #7998]

Fixes

Fix application lockups on systems with one or two CPU cores [#13296]
Preserve entry custom data in newly created history items [#13573]
Fix password strength evaluation for referenced passwords [#13479]
Respect password generator settings when auto-generating passwords for new entries [#13277]
Fix case-sensitive search with the + prefix modifier [#13493]
Fix directory creation error handling [#13508]
Fix favicon download redirect limit being ignored [#13663]
Fix showing challenge-response credentials without a password [#13615]
Fix key file selection link not being clickable when translated incorrectly [#13396]
Prevent database unlock controls from shrinking vertically [#13428]
Prevent mouse wheel scrolling from changing the unfocused alternative save method setting [#13358]
Fix password font size not following application font size [#13658]
Fix typos and documentation links [#10124, #10893, #9993]
Fix null pointer dereference in Secret Service integration [#13655]
Fix ellipsis password reuse tooltip in database reports [#13091]
Fix database lock after autosave due to external changes [#13733]
Auto-Type: Support {PGDN} placeholder [#13463]
Auto-Type: Refactor Auto-Type plugins to integrate them into the main binary [#13469]
Browser: Fix showing and closing the password generator [#9984, #9743]
Browser: Respect selected database when storing a new passkey [#13798]
CSV Import: Fix automatic column mapping for English headers with non-English UI languages [#13531]
Secret Service: Fix crash when a database locks while the item access dialog is open [#13598, #13602]
SSH Agent: Prevent recursive updates when changing entry settings and attachments [#13068]
Linux: Improve AppImage desktop integration [#13470, #13476]
Linux: Include keyutils in Snap builds [#10687]
Linux: Fix race condition in dark mode detection at startup [#13366]
Linux: Do not query X root window without a display with QT_QPA_PLATFORM=offscreen [#13761]
Linux: Improve TLS handling im AppImages [#13805]
macOS: Improve window tray hide and restore behaviour [#13645]
macOS: Use the native temporary directory for the browser integration socket [#13484]
macOS: Prevent deleting entries and groups while a modal dialog is open [#13383]
macOS: Prevent hiding the menu bar [#13147]
macOS: Fix application icon installation for IDE builds [#12679]
Windows: Fix SSH Agent builds with MSYS2 [#8708]
Build: Fix build-system-related issues [#13278, #13275]