Author: KeePassXC Team

# KeePassXC: User Guide

KeePassXC Team
team@keepassxc.org
version 2.6.0

## License and Disclaimers

KeePassXC is licensed with the GNU General Public License Version 3. All copyrights and additional licenses are recorded in COPYING.

### Disclaimer of Warranty

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. Except when otherwise stated in writing the copyright holders and/or other parties provide the program "as is" without Warranty of any kind, either expressed or implied, including, but not limited to, the implied warranties of Merchantability and fitness for a particular purpose. The entire risk as to the quality and performance of the program Is with you. Should the program prove defective, you assume the cost of all necessary servicing, repair or correction.

### Limitation of Liability

In no event unless required by applicable law or agreed to in writing will any copyright holder, or any other party Who modifies and/or conveys the program as permitted above, be liable to you for damages, including any general, Special, incidental or consequential damages arising out of the use or inability to use the program (including but not Limited to loss of data or data being rendered inaccurate or losses sustained by you or third parties or a failure of The program to operate with any other programs), even if such holder or other party has been advised of the possibility Of such damages.

## Contact Us

We are committed to continually improve KeePassXC through customer experience and your feedback is important to us. Please send us your feedback or comments to team@keepassxc.org. To report issues, visit: https://github.com/keepassxreboot/keepassxc.

Thank You,
Team KeePassXC

## Interface Overview

### Application Layout

The KeePassXC interface is designed for simplicity and easy access to your information. The main database view is split into three main partitions detailed below. You can open multiple databases at the same time, they will appear in tabs.

Figure 1. Main database interface

(A) Groups - Organize your entries into discrete groups to bring order to all of your sensitive information. Groups can be nested under each other to create a hierarchy. Settings from parent groups get applied to their children.

(B) Entries - Entries contain all the information for each website or application you are storing in KeePassXC. This view shows all the entries in the selected group. Each column can be resized, reordered, and shown or hidden based on your preference. Right click the header row to see all available options.

(C) Preview - Shows a preview of the selected group or entry. You can temporarily hide this preview using the close button on the right hand side or completely disabled in the application settings.

| Double clicking on the text in the entries list copies that field to the clipboard. Double clicking the entry title will open the entry for editing.

### Toolbar

The toolbar provides a quick way to perform common tasks with your database. Some entries in the toolbar are dynamically disabled based on the information contained in the selected entry. Every common action in KeePassXC can be controlled with a keyboard shortcut as well.

Figure 2. Toolbar overview

(A) Database - Open Database, Save Database
(B) Entries - Create Entry, Edit Selected Entry, Delete Selected Entry
(C) Entry Data - Copy Username, Copy Password, Copy URL, Perform Auto-Type
(D) Lock All Databases
(E) Tools - Password Generator, Application Settings
(F) Search

### Application Settings

Users can configure KeePassXC to their personal tastes with a wide variety of general and security settings that apply to the whole application. These settings are accessible from Tools → Settings or the cog wheel icon from the toolbar. Settings include: startup options, file management, entry management, user interface, language, security timeouts, and convenience.

#### Setting the Theme

KeePassXC ships with light and dark themes specifically designed to meet accessibility standards. In most cases, the appropriate theme for your system will be determined automatically, but you can always set a specific theme by using the View menu. When a new theme is selected you will be prompted to restart KeePassXC to apply the theme immediately.

Figure 3. Setting the theme

#### Compact Mode

For users with smaller screens or those who desire seeing more entries at once, KeePassXC offers a compact view mode. This mode shows smaller toolbar, group, and entry icons. The effect of compact mode (left side) can be seen below.

Figure 4. Compact mode comparison

### Keyboard Shortcuts

Action | Keyboard Shortcut
--- | ---
Open Database | Ctrl + O
Save Database | Ctrl + S
Save Database As | Ctrl + Shift + S
New Database | Ctrl + Shift + N
Close Database | Ctrl + W ; Ctrl + F4
Lock All Databases | Ctrl + L
Quit | Ctrl + Q
New Entry | Ctrl + N
Edit Entry | Enter ; Ctrl + E
Delete Entry | Delete
Clone Entry | Ctrl + K
Copy Username | Ctrl + B
Copy Password | Ctrl + C
Copy URL | Ctrl + U
Open URL | Ctrl + Shift + U
Copy TOTP | Ctrl + T
Show TOTP | Ctrl + Shift + T
Trigger AutoType | Ctrl + Shift + V
Add key to SSH Agent | Ctrl + H
Remove key from SSH Agent | Ctrl + Shift + H
Minimize Window | Ctrl + M
Hide Window | Ctrl + Shift + M
Select Next Database Tab | Ctrl + Tab ; Ctrl + PageDn
Select Previous Database Tab | Ctrl + Shift + Tab ; Ctrl + PageUp
Toggle Passwords Hidden | Ctrl + Shift + C
Toggle Usernames Hidden | Ctrl + Shift + B
Focus Groups (edit if focused) | F1
Focus Entries (edit if focused) | F2
Focus Search | F3 ; Ctrl + F
Clear Search | Escape
Show Keyboard Shortcuts | Ctrl + /

## Database Operations

### Creating Your First Database

To start using KeePassXC, you need to first create a database that will store the password and other details.

To create a database, perform the following steps:

1. Open your KeePassXC application. Click the create new database button (A):

   Figure 5. Create database - Welcome screen

2. The database creation wizard appears. Enter the desired database name and a short description (optional):

   Figure 6. Create database - General information

3. Click Continue. The Encryption Settings screen appears, we don’t recommend making any changes besides increasing or decreasing the decryption time using the slider. Setting the Decryption Time slider at a higher values means that the database will have higher level of protection but the time taken by the database to open will increase.

   Figure 7. Create database - Encryption settings

4. Click the Continue button. The Database Credentials screen appears, enter your desired database password. We recommend using a long, randomized password.

   Figure 8. Create database - Database credentials

   (A) Open the password generator
   (B) Toggle password visibility

   | Keep this password for your database safe. Either memorize it or note it down somewhere. Losing the database password might result in permanent locking of your database and you will not be able to retrieve information stored in the database.

5. Click Done. You will be prompted to select a location to save your database file. The database file is saved on to your computer with the default `.kdbx` extension. You can store your database wherever you wish, it is fully encrypted at all times preventing unauthorized access.

### Opening an Existing Database

To open an existing database, perform the following steps:

1. Open your KeePassXC application. Click the Open existing database button (A) or select a recent database from the Recent Databases list (B).

   Figure 9. Open an existing database

2. Navigate to the location of the your database on your computer and open the database file. The database unlock screen will appear:

   Figure 10. Database unlock screen

3. Enter the password for your database.

4. (Optional) Browse for the Key File if you have chosen it as an additional authentication factor while creating the database. Refer to the KeePassXC User Guide for more information on setting a Key File as an additional authentication factor.

5. Click OK. The database opens and the following screen is displayed:

   Figure 11. Unlocked database

### Adding an Entry

All the details such as usernames, passwords, URLs, attachments, notes, and so on are stored in database entries. You can create as many entries as you want in the database.

To add an entry, perform the following step:

1. Navigate to Entries > New Entry (Or, press Ctrl+N). The following screen appears:

   Figure 12. Adding a new entry

2. Enter a desired title for the entry, username, password, URL, and notes on this screen.

3. (Optional) Select the Expires check-box to set the expiry date for the password. You can manually enter the date and time or click the Presets button to select a expiry date and time for your password.

4. Click OK to add the entry to your database.

### Editing an Entry

To edit the details in an entry, perform the following steps:

1. Select the entry you want to edit.

2. Press `Enter`, click the edit toolbar icon, or right-click and select Edit Entry from the menu.

3. Make the desired changes.

4. Click OK.

### Deleting an Entry

To delete an entry, perform the following steps:

1. Select the entry you want to delete and press the `Delete` button on your keyboard.

2. You will be prompted to move the entry to the Recycle Bin (if enabled).

   | You can disable the recycle bin within the Database Settings. If the recycle bin is disabled then deleted entries will be permanently removed from the database.

3. To permanently delete the entry, navigate to the Recycle Bin, select the entry you want to delete and press the `Delete` button on your keyboard.

### Clone an Entry

Creating a clone of an entry provides you a ready-to-use template for creating new entries with similar details of a master entry.

To create a clone of an existing entry, perform the following steps:

1. Right-click on the entry for which you want to create a clone and select Clone Entry. Alternatively, select the desired entry and press `Ctrl+K`.

   Figure 13. Clone entry from context menu

2. The clone dialog will appear.

   Figure 14. Clone entry dialog

   - Select the Append ‘ - Clone’ to title check-box to create a new entry with the word Clone as the suffix to the name of the new entry.

   - Select the Replace username and password with references check-box to create the new entry where the username and the password fields contain the references to the username and password to the master entry.

   - Select the Copy history checkbox to copy the history of the master entry to the clone.

3. If you chose to replace username and password entries with references, then the new entry will point these fields to the original entry’s values. Changing the original entry will automatically change the resolved value of the cloned entry. This is useful if you have multiple accounts for the same service that use a similar username or password combination.

   Figure 15. References in a cloned entry

4. You can create your own references using the following syntax:

   `{REF:<ShortCode>@I:<UUID>}`

   Where `<UUID>` is the Unique Identifier of the entry to pull data from and `<ShortCode>` is from the following:

   - T - Title

   - U - Username

   - P - Password

   - A - URL

   - N - Notes

   - I - UUID

## Searching the Database

KeePassXC provides an enhanced and granular search features the enables you to search for specific entries in the databases using the different modifiers, wild card characters, and logical operators.

### Modifiers and Fields

Modifier | Description
--- | ---
- | Exclude this term from results
! | Exclude this term from results
+ | Match this term exactly
* | Term is handled as a regular expression

The following fields can be searched along with their abbreviated name in parenthesis:

- Title (t)

- Username (u)

- Password (p, pw)

- URL

- Notes (n)

- Attribute (attr)

- Attachment (attach)

- Group (g)

### Wild Card Characters and Logical Operators

Wild Card Character | Description
--- | ---
* | Match anything
? | Match one character
| | Logical OR

### Sample Search Queries

The following tables lists a few samples search queries for your reference:

Query | Description
--- | ---
`user:johnsmith url:www.google.com` | Searches the Username field for johnsmith and the URL field for www.google.com.
`user:john|smith` | Searches the Username field for john OR smith.
`+user:johnsmith -url:www.google.com *notes:"secret note \d"` | Search the username field for exactly johnsmith, the URL must not contain www.google.com, and notes contains secret note [digit].

## Advanced Entry Options

### Additional Attributes

A lot of applications and web sites now require to provide additional information when you create accounts. The additional information is used to block hackers if any suspicious activity is detected. In addition, the additional information you provide can be used to reset passwords if you forget them. You can also store arbitrary information here that can be copied to the clipboard or Auto-Typed using the `{S:<ATTR_NAME}` action code.

To protect an attribute from being displayed by default, activate the Protect checkbox (A). To show the contents of the attribute while keeping it protected, press the Reveal button (B).

Figure 16. Additional attributes example

### Attachments

You can attach files to any entry in your database by pressing the Add button (A). These files are added to the database and stored as encrypted binaries. You can open, save, or delete attachments from this interface (B).

| When you try to open the attached file, KeePassXC extracts the attachment to a temporary file and opens it using the default application associated with the file type. After finishing viewing or editing the file, you can choose between importing or discarding the changes that you made to the temporary file. KeePassXC securely deletes the temporary file by overwriting it.

Figure 17. Attachments interface

### Foreground and Background Color

You can change the foreground (A) and/or background (B) color that this entry will use in the entry lists. Click the corresponding box to open the color picker dialog.

Figure 18. Color picker dialog

### Icons

You can select an icon to be displayed with each entry for easy identification. KeePassXC comes with a set of default icons that you can use or you can use your own custom icons. If you defined a URL with an entry, you can also download the favorite icon for that particular website.

| To delete a custom icon, select the item to be deleted and click the Delete custom icon button.

Figure 19. Entry icon selection

| Each KeePass application has different default icons. If you use a mobile app or KeePass2, be aware that the default icons may not be exactly correspond to the KeePassXC icons.

### Properties

KeePassXC lets you view the basic properties such as date and time of creation, modification, and when last accessed. This is also where you can retrieve an entry’s UUID for use in references.

Figure 20. Entry properties view

### History

KeePassXC maintains a history of changes you make to your entries. Each time you change an entry, KeePassXC automatically creates a backup copy of the current, non-modified entry before saving the new values. You can view the changes you made previously, restore, and delete the history of changes you made.

- Show: Display this history item for review, a read-only copy of the entry will be shown.

- Restore: Reinstate the selected history item as the active entry details.

- Delete: Delete the selected history item.

- Delete All: Delete the entire history for this entry.

Figure 21. Entry history view

| Restoring an old history item will store the current entry settings as a new history item.

## Automatic Database Opening

You can setup one or more databases to open automatically when you unlock a single database. This is done by (1) defining a special group named `AutoOpen` with (2) entries that contain the file path and credentials for each database that should be opened. There is no limit to the number of databases that can be opened.

| Case matters with auto open, the group name must be exactly `AutoOpen`.

Figure 22. AutoOpen Group and Entries

To setup an entry for auto open perform the following steps:

1. Create a new entry and give it any title you wish.

2. If your database has a key file, enter its absolute or relative path in the `username` field.

3. If your database has a password, enter it in the `password` field

4. Enter the absolute or relative path to the database file in the `url` field. You can also use the `{DB_DIR}` placeholder to reference the absolute path of the current database file.

5. To restrict auto open to particular devices, go to the advanced category and enter the following:

   1. Create a new attribute named `IfDevice`.

   2. Enter hostnames in a comma separated list to define computers that will open this database.

   3. Prepend an exclamation mark (`!`) to explicitly exclude a device.

   4. Examples: `LAPTOP, DESKTOP` will auto open on a computer named LAPTOP or DESKTOP. `!LAPTOP` will auto open on all devices not named LAPTOP.

Figure 23. Auto open IfDevice example

| You can setup an entry to open on double click of the URL field by prepending `kdbx://` to the relative or absolute path to the database file. You may also have to add `file://` to access network shares (e.g., `kdbx://file://share/database.kdbx`).

## Database Settings

At any point of time, you can change the settings for your database. To make changes to the general settings, perform the following steps:

1. Navigate to Database → Database settings. The following screen appears:

   Figure 24. Database settings

2. Click the General button in the left-hand menu bar to access the following settings:

   - Database name: This is the default identifier for your database and is shown in the tab bar and title bar (when active). You can change this name as desired.

   - Database description: Provide some meaningful description for your database.

   - Default username: Provide a default username for all new entries that you create in this database.

   - Max history items: This is the maximum number of history items that are stored for each entry. When you set this to 0, no history will be saved. Set this value to a low value to prevent the database from getting too large (we recommend no more than 10).

   - Max. history size: When the history of an entry gets above this size, it is truncated. For example, this happens when entries have large attachments. Set this value small to prevent the database from getting too large (we recommend 6 MiB).

   - Use recycle bin: Select this check-box if you want deleted entries to move to the recycle bin instead of being permanently removed. The recycle bin will be created if it does not already exist after your first deletion. To delete entries permanently, you must empty the recycle bin manually.

   - Enable compression: KeePassXC databases can be compressed before being encrypted. Compression reduces the size of the database and does not have any appreciable affect on speed. It is recommended to always save databases with compression.

3. Click the Security button in the left-hand menu bar to change your database credentials and change encryption settings.

   Figure 25. Database security

4. Here you can change your database password or add/remove additional credentials to protect your database. KeePassXC supports adding a randomly generated, static key file and hardware keys such as YubiKey and OnlyKey. To add a key file, click Add Key File and either browse for an existing file or generate a new one (A). To add a hardware key, click Add YubiKey Challenge-Response, plug in your hardware key, then click refresh (B).

   Figure 26. Database credentials

5. Encryption settings allows you to change the average time it takes to encrypt and decrypt the database. The longer time that is chosen, the harder it will be to brute force attack your database. We recommend a setting of one second.

   Figure 27. Database encryption

   | Encryption time is dependent on your computer’s hardware. If sharing a database with a mobile device, be mindful that it will likely take two to four times longer to access and save your database than on your home computer.

6. Advanced encryption settings can be accessed by clicking the Advanced Settings checkbox in the lower left-hand corner. These settings are only meant for people who know what they mean. We do not recommend touching these settings.

   Figure 28. Database encryption advanced settings

   The following key derivation functions are supported:

   - AES-KDF (KDBX 4 and KDBX 3.1): This key derivation function is based on iterating AES. Users can change the number of iterations. The more iterations, the harder are dictionary and guessing attacks, but also database loading/saving takes more time (linearly). KDBX 3.1 only supports AES-KDF; any other key derivation function, like for instance Argon2, requires KDBX 4.

   - Argon2 (KDBX 4 - recommended): KDBX 4, the Argon2 key derivation function can be used for transforming the composite master key (as protection against dictionary attacks). The main advantage of Argon2 over AES-KDF is that it provides a better resistance against GPU/ASIC attacks (due to being a memory-hard function). The number of iterations scales linearly with the required time. By increasing the memory parameter, GPU/ASIC attacks become harder (and the required time increases). The parallelism parameter can be used to specify how many threads should be used.

## Storing a Database File

The database file that you create might contain highly sensitive data and must be stored in a very secure way. You must make sure that the database is always protected with a strong and long password. The database file that is protected with a strong and long password is secure and encrypted while stored on your computer or cloud storage service.

Make sure that the database file is stored in a folder that is secure. Make sure that you or someone else does not accidentally delete the database file. Deletion of the database file will result in the total loss of your information and a lot of inconvenience to manually retrieve your logins for various web applications. You must not share your database file with anyone unless absolutely necessary.

## Backing up a Database File

It is a good practice to create copies of your database file and store the copies of your database on a different computer, smart phone, or cloud storage space such a Google Drive or Microsoft OneDrive. Backups can be created automatically by selecting the Backup database file before saving option in the application settings. Additionally, you can create a backup on-demand using the Database → Save Database Backup…​ menu feature.

Figure 29. Saving a database backup

Creating backups for your database give you a peace of mind should you lose one copy of your database. You can quickly retrieve the copy of your database and start using it.

## Importing External Databases

KeePassXC allows your to import external databases from the following options:

- Comma-Separated Values (CSV) file

- 1Password OPVault

- KeePass 1 Database

### Importing CSV File

If you have been saving your URLs, usernames, passwords, and so on in a CSV file, you can migrate all that information from the CSV file to KeePassXC and start using KeePassXC to maintain your data.

To open the CSV file, perform the following steps:

1. Open KeePassXC.

2. Click Import from CSV button on the welcome screen or use the menu Database > Import > CSV File.

3. Navigate to the location of the your CSV file on your computer and open the file. The new database wizard will appear. Follow the steps of creating a new database in Chapter 1.

4. After saving your new database file, the CSV import wizard will appear:

   Figure 30. CSV Import Wizard

Your CSV file gets imported to KeePassXC and the data is converted to the KeePassXC format for further usage and maintenance. The new database file is saved on to your computer with the default `.kdbx` extension.

### Importing 1Password OPVault

Save your 1Password Vault locally to create an OPVault directory. Please see 1Password instructions on how to do this. Once an OPVault is created, perform the following steps:

1. Open KeePassXC.

2. Use the menu Database > Import > 1Password Vault. Select the OPVault to import.

3. Enter the password for your OPVault to unlock and import.

### Importing KeePass 1 Database

KeePass 1 database is an older format of the database created using legacy version of KeePass. KeePassXC lets your import this older format of the database and you can seamlessly start using this database in your new KeePassXC application.

To import a KeePass 1 database file in KeePassXC, perform the following steps:

1. Open KeePassXC.

2. Click Import from KeePass 1 button on the welcome screen or use the menu Database > Import > KeePass 1 Database.

3. Navigate to the location of the your legacy KeePass 1 database file (`.kdb`) on your computer and open the file. You are prompted for the password and the Key file for your `.kdb` file.

4. Enter the password for your old `.kdb` file and click OK. You are prompted for provide a name for the new database format that KeePassXC recognizes.

5. Provide a name for the new database format, select a folder on your computer to save the file, and click Save.

6. The data from the `.kdb` file gets imported and converted to the new format, which is compatible with KeePassXC. You can now start using the new database file (`.kdbx`) in KeePassXC.

## Exporting Databases

KeePassXC supports multiple ways to export your database for transfer to another program or to print out and archive. To export your database into the KDB XML format, you must use the KeePassXC Command Line Interface program: `keepassxc-cli export <database.kdbx>`.

| Exporting your database will result in all of your passwords and sensitive information being stored unencrypted. We do not recommend saving your exported database for long periods of time as that can cause compromise.

Figure 31. Database export menu

## Password Generator

This password generator helps you to generate random strong passwords and passphrases that you can use for your applications and websites you visit.

### Generating Passwords

To generate random passwords, specify the characters to be used in your choice of password (for example, upper-case letters, digits, special characters, and so on) and KeePassXC will randomly pick characters out of the set.

To generate the random password using Password Generator, perform the following steps:

1. Open KeePassXC.

2. Navigate to Tools > Password Generator. The following screen appears:

   Figure 32. Password Generator

3. Select the length of the desired password by dragging the Length slider.

4. Select the character-sets that you want to include in your password.

5. Use the regenerate button (Ctrl + R) to make a new password using the chosen options.

6. Use the clipboard button (Ctrl + C) to copy the generated password to the clipboard.

7. Click the Advanced button to specify additional conditions for your desired password.

   Figure 33. Advanced Password Generator Options

### Generating Passphrases

A passphrase is a sequence of words or other text used to control access to your applications and data. A passphrase is similar to a password in usage, but is generally longer for added security. To generate the random passphrase using Password Generator, perform the following steps:

1. From the password generator, click the Passphrase tab. The following screen appears:

   Figure 34. Passphrase Generator

2. Select the number of words you want to be included in your passphrase by dragging the Word Count slider.

3. In the Word Separator field, enter a character, word, number, or space that you want to use a separator between the words in your passphrase.

4. Click the Regenerate button (Ctrl + R) to generate a new random passphrase.

5. Click the Clipboard button (Ctrl + C) to copy the passphrase to the clipboard.

## Setup Browser Integration

The KeePassXC-Browser extension is installed within your web browser so that you can automatically pull usernames and passwords from KeePassXC and populate them directly into website fields. It is a very useful and secure extension that enhances your productivity while using KeePassXC. With this extension, you do not need to manually copy the data from your KeePassXC database and paste it into the website fields.

The KeePassXC-Browser extension is available on the following web browsers:

- Google Chrome, Vivaldi, and Brave

- Mozilla Firefox and Tor-Browser

- Microsoft Edge

- Chromium

### Install the Browser Extension

You can download the KeePassXC-Browser extension from your web browser. To download the KeePassXC-Browser extension, perform the following steps:

1. Click the link corresponding to your browser:

   - Chrome, Chromium, Vivaldi, and Brave

   - Mozilla Firefox and Tor-Browser

   - Microsoft Edge

2. Click the button to install/add the extension to the browser. Accept any confirmation dialogs.

### Configure KeePassXC-Browser

To start using KeePassXC-Browser, you must configure it so that it can communicate with the KeePassXC application on your desktop.

To configure KeePassXC-Browser, perform the following steps:

1. Open the KeePassXC application on your desktop and navigate to Tools > Settings.

2. Click the Browser Integration option on the left-hand side (1). The following screen appears:

   Figure 35. Browser Settings

3. Click the Enable browser integration checkbox (2). Then select the browsers for which you have downloaded the KeePassXC-Browser extension (3) and click OK.

4. Ensure your database is unlocked, then open (or restart) your browser.

5. Click the KeePassXC-Browser extension icon (A) in your browser (see figure below). A pop-up window appears.

   Figure 36. Connect Extension to KeePassXC

6. Click the Connect button (B) in the pop-up window to complete integrating the KeePassXC-Browser extension with your KeePassXC desktop application.

7. You are now prompted to enter a unique name to identify the connection between this browser and your database. Enter a unique name in the field (e.g., firefox-laptop) and click the Save and allow access button.

   Figure 37. Extension Association Dialog

| If you reuse a connection name in a database, the previous browser connection will be overwritten and prevent access.

### Using the Browser Extension

The KeePassXC-Browser extension lets you automatically populate the entries from your KeePassXC database into the fields on websites you visit. To do so, perform the following steps:

1. Open your KeePassXC desktop application and unlock your database.

2. Open your web browser. The KeePassXC-Browser extension icon in your browser window will change based on its connection state. The figure below shows the different states.

   (A) KeePassXC is not running or is disconnected
   (B) Connected to KeePassXC, but database is locked
   (C) Connected to KeePassXC and ready to use

   Figure 38. Extension Icon States

3. If the KeePassXC desktop application is not connected with the KeePassXC-Browser extension, click the extension icon in your web browser and click Reload from the pop-up window as shown in the following screen.

   Figure 39. Reload Extension Connection

4. Open the URL for which you want to use with your database. If you have previously created an entry in your database then the KeePassXC-Browser Confirm Access dialog may appear:

   Figure 40. Confirm Access Dialog

5. Ensure the credentials you want use are checked, then click (A) Remember (optional), then click Allow Selected (B).

6. In your website, the KeePassXC icon will appear in the username field of the login form (A). Click the icon to populate the field with your stored credentials. If you have more than one credential for this website, a dropdown will appear to choose the one to use.

   Figure 41. Fill Credentials

### Advanced Usage

You can configure unique browser integration behavior for each entry. This allows you to add multiple URLs to an entry, hide an entry from the browser integration, and more. To access these settings, open an entry for editing then click on Browser Integration option in the left-hand menu (1).

After opening the settings you can add any number of additional URLs by clicking the Add button (2) and typing the URL in the list to the left (3).

Figure 42. Entry browser settings

Database-wide operations are available in the database settings. To access these use the Database → Database settings…​ menu option. Click on Browser Integration on the left-hand menu. From here you can disconnect all browsers, convert legacy KeePass-HTTP settings, reset all entry-level settings, and refresh the database root group ID (useful when making copies of your database file).

Figure 43. Database browser settings

Finally, advanced application-wide settings are available in the Browser Integration tab of the application settings.

| We do not recommend changing any of these settings as they may break the browser integration plugin.

Figure 44. Advanced browser settings

## Auto-Type

The Auto-Type feature acts like a virtual keyboard to populate data from your entries directly into the corresponding websites or applications that you use. You can use the Auto-Type feature on a global level or entry level. Each entry can be configured to be associated with a particular window title and multiple Auto-Type sequences can be pre-defined and selected upon use.

| Auto-Type is a completely separate feature from Browser Integration. You do not need to have the KeePassXC browser extension installed in your browser to use Auto-Type.

| Auto-Type will be disabled when run with a Wayland compositor on Linux. To use Auto-Type in this environment, you must set `QT_QPA_PLATFORM=xcb` or start KeePassXC with the `-platform xcb` command-line flag.

### Configure Global Auto-Type

You can define a global Auto-Type hotkey that starts the Auto-Type process. To configure the hotkey, perform the following steps:

1. Navigate to Tools → Settings → Auto-Type tab (1). Click into the Global Auto-Type shortcut box and press the desired key combination that will trigger the Auto-Type process (2).

   Figure 45. Auto-Type settings

   You can configure additional Auto-Type settings in this window such as start delay, inter-key typing delay, and matching options. If Auto-Type is not working well for you, try adjusting the default delays.

### Configure Auto-Type Sequences

Each entry in your database can have multiple Auto-Type sequences associated with various window titles. Simulated key presses can be sent to any other currently open window of your choice (web browser windows, login dialogs boxes, and so on). When the Global Auto-Type hotkey is pressed, KeePassXC will search your database for entries matching the current selected window title.

| The default Auto-Type sequence is `{USERNAME}{TAB}{PASSWORD}{ENTER}`. This means that it first types the username of the selected entry, then presses the `Tab` key, then types the password of the entry and finally presses the `Enter` key.

To configure Auto-Type sequences for your entries, perform the following steps:

1. Navigate to the entries list and open the desired entry for editing. Click the Auto-Type item from the left-hand menu bar (1). Press the `+` button (2) to add a new sequence entry. Select the desired window using the drop-down menu, or simply type a window title in the box (3). You can use wildcard `*` to match any value (e.g., when a window title contains a filename or website name).

   Figure 46. Auto-Type entry sequences

2. (Optional) Define a custom auto-type sequence for each window title match by selecting the Use specific sequence for this association checkbox. Sequence action codes and field placeholders are detailed in the following table. A complete list of supported actions and placeholders can be found at KeePass Auto-Type Action Codes and KeePass Placeholders. Action codes and placeholders are not case sensitive.

   Action Code | Description
   --- | ---
   {TAB}, {ENTER}, {SPACE}, {INSERT}, {DELETE}, {HOME}, {END}, {PGUP}, {PGDN}, {BACKSPACE}, {CAPSLOCK}, {ESC} | Press the corresponding keyboard key
   {UP}, {DOWN}, {LEFT}, {RIGHT} | Press the corresponding arrow key
   {F1}, {F2}, …​, {F16} | Press F1, F2, etc.
   {LEFTBRACE}, {RIGHTBRACE} | Press `{` or `}`, respectively
   {DELAY=X} | Set key press delay to X milliseconds
   {DELAY X} | Delay typing start by X milliseconds
   {CLEARFIELD} | Clear the input field before typing
   {TOTP} | Insert calculated TOTP value (if configured)
   {<ACTION> X} | Repeat <ACTION> X times (e.g., {SPACE 5} inserts five spaces)

   Placeholder | Description
   --- | ---
   {TITLE} | Entry Title
   {USERNAME} | Username
   {PASSWORD} | Password
   {URL} | URL
   {NOTES} | Notes
   {TOTP} | Current TOTP value (if configured)
   {DT_SIMPLE} | Current date-time
   {DB_DIR} | Absolute directory path for database file
   {S:<ATTRIBUTE_NAME>} | Value for the given attribute name
   {REF:<FIELD>@<SEARCH_IN>:<SEARCH_TEXT>} | Search for a field in another entry using the reference syntax.

### Performing Global Auto-Type

The global Auto-Type keyboard shortcut is used when you have focus on the window you want to type into. To make use of this feature, you must have previously configured an Auto-Type hotkey.

Pressing the global Auto-Type hotkey cause KeePassXC to search the database for entries that match the window title. Multiple matches may be returned and will cause the sequence selection dialog to appear. Click on a sequence line will immediately execute the Auto-Type action. A search box is also available in case numerous matches are returned.

Figure 47. Auto-Type sequence selection

| The Sequence column will only appear when there are different sequences defined by one or more entries displayed in the selection dialog.

### Performing Entry-Level Auto-Type

You can quickly activate the default Auto-Type sequence for a particular entry using Entry-Level Auto-Type. For this operation, the KeePassXC window will be minimized and the Auto-Type sequence occurs in the previously selected window. You can perform Entry-Level Auto-Type from the toolbar icon (A), entry context menu (B), or by pressing `Ctrl+Shift+V`.

| Be careful when using Entry-Level Auto-Type as you can inadvertently type into the wrong window. For example, a chat window or email.

Figure 48. Entry-Level Auto-Type

## Database Sharing with KeeShare

KeeShare allows you to share a subset of your credentials with others and vice versa.

### Enable Sharing

To use sharing, you need to enable it for the application.

1. Go to Tools → Settings. Select the KeeShare category on the left sidebar (1).

2. Check Allow import if you want to import shared credentials. Check Allow export if you want to share credentials. (2)

3. (Optional) Click Generate (3) to create your own certificate or Import to select an existing one. The certificate allows you to sign shared databases. This ensures the integrity of the share and prevent import of untrusted information.

Figure 49. KeeShare Application Settings

### Sharing Credentials

If you checked Allow export in the Sharing settings you can now share a group of passwords. Sharing is always is defined on a particular group. If you enable sharing on a group, every entry under this group, and its children, are shared. If you enable sharing on the root node, every password inside your database gets shared!

| KeeShare does not synchronize group structure after the initial share is created. At this time, KeeShare operates at the entry level; shared entries moved outside of a shared group are still synchronized.

1. Open the edit sheet on a group you want to share.

2. Select the KeeShare category on the left toolbar.

3. Choose a sharing type:

   1. Inactive - Disable sharing this group

   2. Import - Read-only import of entries, merge changes

   3. Export - Write-only export of entries, no merge

   4. Synchronize - Read/Write entries from the share, merge changes

4. Choose a path to store the shared credentials to.

5. The password to use for this share container.

The export file will not be generated automatically. Instead, each time the database is saved, the file gets written. The file should be written to a location that is accessible by others. An easy setup is a network share or storing the file in cloud storage.

Figure 50. KeeShare Group Settings

### Using Shared Credentials

KeeShare watches the container for changes and merges them into your database when necessary (Import and Synchronize modes). Entries merge in time order; older data is moved to the history of the entry.

A shared group shows a cloud icon badge over the group icon (A) and a banner is displayed showing the sharing mode and file location (B). If the share is disabled or unavailable, the cloud icon will show as red with a white X.

Figure 51. KeeShare shared group

### Technical Details and Limitations of Sharing

Sharing relies on the combination of file exports and imports as well as the synchronization mechanism provided by KeePassXC. Since the merge algorithm uses the history of entries to prevent data loss, this history must be enabled and have a sufficient size. Furthermore, the merge algorithm is location independent, therefore it does not matter if entries are moved outside of an import group. These entries will be updated none the less. Moving entries outside of export groups will prevent a further export of the entry, but it will not ensure that the already shared data will be removed from any client.

KeeShare uses a custom certification mechanism to ensure that the source of the data is the expected one. This ensures that the data was exported by the signer but it is not possible to detect if someone replaced the data with an older version from a valid signer. To prevent this, the container could be placed at a location which is only writeable for valid signers.

## SSH Agent

SSH (Secure Shell) is a widely used remote secure shell protocol and is considered an industry standard for secure remote access to UNIX-like systems including Linux, BSDs, MacOS and more recently even Windows received native support. SSH supports multiple types of authentication and the most widely used ones are either interactive keyboard input with a password or a public-key cryptography pair of keys.

KeePassXC SSH Agent integration is built to manage SSH keys in a secure manner by either storing them completely within your KeePassXC database or by having only the decryption key of a key file that is stored elsewhere. SSH Agent integration does not provide an agent itself but works as a client for any agent implementation that is OpenSSH compatible.

### OpenSSH agent on Linux

If you are using a modern desktop Linux distribution it is very likely the OpenSSH agent is already configured and running when you have logged in to a graphical desktop session. This should be true for distributions like Debian, Ubuntu (including Kubuntu, Xubuntu and Lubuntu), Linux Mint, Fedora, ElementaryOS and Manjaro.

First, open a terminal and check the output of `ssh-add -l`:

    $ ssh-add -l
    The agent has no identities.

If you either got a list of fingerprints or the message above the agent is already running and no further setup is required. If instead you got a message saying "Could not open a connection to your authentication agent." that means the agent is either misconfigured or not running at all.

Since every distribution and desktop environment is configured differently there is no general guide how to properly set it up yourself. The general rule of thumb, however, is that `ssh-agent` needs to be started as part of the startup programs for a session in a way its environment variables are exposed to all processes started by the desktop environment. One of the easiest ways to achieve this is to enable GNOME Keyring which should in turn start the agent as part of its services.

There are many guides on the internet how to hack your login shell to start an agent but it is very prone to errors and is not a supported configuration. If you prefer the login shell startup hack you need to set it up with a static socket path and use the SSH_AUTH_SOCK override option in SSH Agent settings to match that.

| GNU Privacy Guard (gpg) with its SSH agent implementation is not compatible with KeePassXC as it does not support removing keys that have been added to it making it impossible to use any external tool to manage key lifetime.

| GNOME Keyring prior to release 3.27.92 had its own custom implementation of an agent which does not support modern key types and was known to be buggy. It does not support any constraints you may want to configure for an added key. If you are running a modern distribution the custom agent has been removed and replaced with the stock OpenSSH agent which is feature complete.

### OpenSSH agent on MacOS

Apple has made OpenSSH an integrated part of MacOS with automatic agent startup when it is first used. No further configuration is needed.

### Pageant agent on Windows

The SSH Agent integration on Windows supports both PuTTY Pageant and OpenSSH for Windows 10. Since Pageant is currently still the most widely used implementation and is easily installable on any version of Windows we focus on that. It is also the default on KeePassXC.

Download Pageant from the official PuTTY home page at https://www.chiark.greenend.org.uk/~sgtatham/putty/

To use Pageant with KeePassXC, simply start it and it will minimize into the system tray and is ready to use. PuTTY and compatible tools will use Pageant automatically.

### Setting up SSH Agent integration

By default the SSH Agent integration plugin is disabled. To enable integration, follow the steps below to access the settings:

1. Select Tools > Settings from the menu

2. Select SSH Agent category on the left sidebar

Figure 52. SSH Agent Application Settings Page

On the settings page you can enable the integration by checking Enable SSH Agent integration. When the integration is enabled coming back to the settings page also shows if connection to the agent is working.

On Windows you have the option to select between Pageant and OpenSSH for Windows and on other platforms the settings page shows the current value of SSH_AUTH_SOCK environment variable which is used to connect to the running agent and an option to manually override the automatically detected path.

If the value of SSH_AUTH_SOCK is empty it means the agent is not properly configured and KeePassXC will be unable to connect to it unless you provide a static override path to the socket.

### Generating a key to use with KeePassXC

KeePassXC only supports keys in the OpenSSH format. On Windows, PuTTYgen saves keys in its own format by default and you will need to convert them to OpenSSH format before being used. In this guide we are going to generate a standard RSA key in the default size.

#### Generating a key on Linux or MacOS with ssh-keygen

Open a terminal window and type the following command to generate a key:

    $ ssh-keygen -o -f keepassxc -C johndoe@example
    Generating public/private rsa key pair.
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in keepassxc
    Your public key has been saved in keepassxc.pub
    The key fingerprint is:
    SHA256:pN+o5AqUmijYBDUrFV/caMus9oIR61+MiWLa8fcsVYI johndoe@example
    The key's randomart image is:
    +---[RSA 3072]----+
    |  =. ..o         |
    | o + .+ .        |
    |o . .+ o.        |
    | o..  Eo. .      |
    |  +o .. So       |
    |o*o.o+ ..o       |
    |Bo=+o.+.o .      |
    |+oo+.++o         |
    |. ..++ooo        |
    +----[SHA256]-----+

Now we can see two files were generated:

    $ ls -l keepassxc*
    -rw------- 1 user group 2.6K Apr  5 07:36 keepassxc
    -rw-r--r-- 1 user group  569 Apr  5 07:36 keepassxc.pub

With KeePassXC you only need the first file listed.

#### Generating a key on Windows with PuTTYgen

Please read the manual on how to use PuTTYgen for details on generate a key: https://the.earth.li/~sgtatham/putty/0.74/htmldoc/Chapter8.html#pubkey-puttygen. Once generated, you must save the key in OpenSSH format, follow the image below.

Figure 53. Generating a key with PuTTYgen

### Configuring an entry to use SSH Agent

The last step is to setup an entry to contain the SSH Agent settings and key file you generated.

1. Create a new entry, or open an existing entry in edit mode.

2. Set the password you used for the key file in the password field.

3. Go to the advanced category and attach the key file you generated previously.

4. Go to the SSH Agent category (1) and select the attachment from the list (2).

5. Alternatively, you can load an external file dynamically using the file selection.

6. Choose the options for this key.

7. Press OK to accept the entry. Depending on the options you chose, KeePassXC will load the key and present it for use.

Figure 54. SSH Agent Entry Settings Page

If you chose to not auto-load the key on database unlock, you can manually make the key available by using the context menu from the entry list.

Figure 55. SSH Agent Load Key from Context Menu