The KeePass family: KeePass, KeePassXC, and KeePassDx explained

Ask three people what KeePass is and you will get three different products. One means a Windows program their uncle installed in 2009. One means the polished cross-platform app they use on Linux. One means the thing on their Android phone with the bear icon. All three are right, which is exactly why the ecosystem confuses everyone who arrives at it from the managed-cloud side of the password-manager world.

This is the map. One file format, a handful of apps that speak it, no accounts anywhere, and a few decisions the cloud products make for you that KeePass hands back to you on purpose.

The original: KeePass 2.x

KeePass, the Windows application by Dominik Reichl, is where the format began — open source since 2003, which makes it older than every cloud password manager on the market. The current line is KeePass 2.x, a Windows-native program that stores everything in a single encrypted database file, the .kdbx format. The KDBX 4 generation of that format derives its key with Argon2, the same memory-hard function the password-hashing contest crowned, and it remains the plainest expression of the idea: your passwords are a file on your disk, encrypted with a key derived from one master password.

The original is also the least convenient member of the family. It is Windows-first, its interface dates it honestly, and the features everyone else ships built in arrive here as community plugins — TOTP support included. If you run Windows and like a program that has outlived every trend since Slashdot, it is still maintained, still free, and still the format's reference implementation.

The flagship: KeePassXC

KeePassXC is the cross-platform edition most people should actually use — Windows, macOS, and Linux, GPLv3, no cloud, no ads, no subscriptions, maintained by an independent team. The current stable release, 2.8.0, shipped on October 21, 2026, and the project carries a credential few password managers of any kind can claim: a Security Visa from ANSSI, the French national cybersecurity agency, awarded for passing its first-level CSPN certification.

The pitch is the same file, opened everywhere, with modern ergonomics: browser integration, database-level TOTP, passkey storage, and a keyboard-driven interface that people either love or never learn. If you want the KeePass model with the fewest rough edges, KeePassXC is the default answer, and it is the one the free-manager roundup points to as the ecosystem's flagship.

TOTP in KeePass, done right

KeePassXC stores TOTP secrets and generates codes natively — right-click an entry, set up TOTP, paste the seed or the otpauth link, and the code appears in the entry list and in the browser integration. It even supports the odd variants: custom digits, custom periods, and the Steam algorithm that some gaming accounts use.

The project is also unusually honest about what this costs. KeePassXC's own documentation fields the question directly — doesn't storing TOTP secrets undermine two-factor authentication? — and answers yes, if the secrets sit in the same database as the passwords. Their recommendation is to keep a separate database for TOTP, secured with a different password, possibly on a different computer. That is the correct answer, and it comes from inside the project, not from a competing product's marketing.

It is also precisely the arrangement a dedicated 2FA vault exists for. 2FA by DependsiT holds the second factor and nothing else — TOTP, HOTP, and Steam Guard entries, encrypted in your browser before upload, readable on any device once you sign in — which pairs naturally with a KeePass database holding the first factor. The guest generator is the zero-commitment version of that idea: paste a Base32 secret, an otpauth link, a QR image, or a Google Authenticator export, and the code appears with nothing stored and nothing sent.

For KeePass 2.x on Windows, built-in TOTP does not exist — the original relies on community plugins such as KeeTrayTOTP to add code generation, which works, with the usual plugin caveats about updates and trust.

The phone apps

App	Platforms	License	TOTP	Notes
KeePass 2.x	Windows	Open source	Via plugins	The original, reference implementation
KeePassXC	Windows, macOS, Linux	GPLv3	Built in	ANSSI-certified, the flagship
KeePassDX	Android	Open source	Built in	Offline by design, passkey support
KeePassium	iOS, macOS	GPLv3	Built in	Freemium, works from the Files app
Strongbox	iOS, macOS	Closed source	Built in	Also speaks the Password Safe format

On Android, KeePassDX — "Passkey Vault" in its current 4.5.x releases — is the open-source client of record, with autofill, passkey support, and a design language that matches Android conventions. The F-Droid listing makes the privacy posture plain: the app requires no internet connection, which is the entire philosophy expressed as a permission.

On iOS and macOS, the two names are KeePassium and Strongbox. KeePassium is GPLv3, reads databases from anywhere the Files app reaches, and includes TOTP generation. Strongbox, closed source with a freemium model, speaks both KeePass and Password Safe formats and carries a 4.7 rating across years of releases. Either is a competent front door to a .kdbx file in iCloud, Dropbox, or wherever you keep it.

And then there is Keeweb, the web-based client that once looked like the ecosystem's future. Its site still runs and the desktop app still downloads, but the project has been effectively dormant for years. Passing it by is not a judgment — it is just reading the commit history.

The sync question is yours now

The cloud products fold sync into the product. KeePass folds it into your life. The database is a file, so sync means the same thing it means for any file: put it in Dropbox, iCloud Drive, Syncthing, a USB stick, or a folder your own server serves. Every device opens the same file, and every app speaks the same format, so nothing is locked in — the database is the export, forever, by construction.

The costs are the mirror image. Two devices editing the same database simultaneously produce a conflict the file will not resolve for you, so the rhythm matters: open, edit, close, let sync settle. The cloud products absorb that problem because they own the server. KeePass hands it back because owning the problem is the point.

For teams who want KeePass-style control with hosted sharing rather than a shared file's choreography, Passpack occupies that exact niche from the opposite direction. And for anyone weighing the whole model against a managed service, the Bitwarden guide is the honest comparison point — open source on both sides, different answers to who runs the storage.

Who this suits

The KeePass model earns its keep for people with a specific shape of requirements. Privacy maximalists who want their credentials to touch no server they did not choose. Homelab owners already running self-hosted infrastructure where one more file is nothing. Air-gapped or offline-first setups, where TOTP without a network is a feature rather than a workaround. People who read "zero-knowledge architecture" on a marketing page and hear "trust us."

For everyone else — multiple devices, no interest in file choreography, a preference for polish — the hosted products are the pragmatic answer, and saying so is not a knock on KeePass. The family has outlived a dozen commercial rivals precisely by refusing to become a service.

Frequently asked questions

Is KeePass still maintained?

Yes, along two tracks. KeePass 2.x, the Windows original, remains in active development by its original author. KeePassXC, the cross-platform edition, shipped version 2.8.0 in October 2026 and holds an ANSSI Security Visa. The phone apps are maintained independently. The one dated corner is Keeweb, the web client, which still runs but has been dormant for years.

Can KeePass store TOTP codes?

KeePassXC, KeePassDX, KeePassium, and Strongbox all generate codes natively. KeePass 2.x on Windows needs a community plugin. All of them can store the secret — the honest question is whether they should, and KeePassXC's own documentation recommends a separate database with a different password so the two factors stay separated, which is also what a dedicated 2FA vault accomplishes.

How do I sync KeePass across devices?

However you sync any file. Keep the .kdbx database in iCloud Drive, Dropbox, Google Drive, or a Syncthing folder, and point every app at it. The format is the same everywhere, so nothing converts. The discipline is closing the database before switching devices, because simultaneous edits create conflicts the file format will not merge for you.

Is KeePass better than Bitwarden?

Neither, differently. KeePass wins on trust surface — a local file, no account, no server, code you can read — and on price, which is permanently zero. Bitwarden wins on convenience — managed sync, polished apps, browser integration that just works — while staying open source and cheap at $19.80 a year for the extras. The people happiest with KeePass are the people who would otherwise be running their own server anyway.

What is the best KeePass app for my phone?

On Android, KeePassDX — open source, offline by design, current at 4.5.x with passkey support. On iOS, KeePassium if you want open source and Files-app integration, Strongbox if you want the most polished interface and do not mind closed source. Both read the same database your desktop apps read, so the choice is about the app, not the format.

If keeping codes out of the database sounds like the right instinct, the guest generator holds one secret at a time and forgets it on reload, and the features page describes the encrypted vault that remembers them properly.