I’m often asked for advice as to how someone can improve their own personal level of security and the second topic I bring up (installing antivirus software is the first) surrounds the use of passwords.
As stressed elsewhere here at Comparitech, there is no substitute for a long, complex, hard to guess password made up of numbers, letters and symbols. There is also no alternative to the use of unique passwords for each and every site you visit – reusing the same one for every account under your control is a prelude to disaster should any one of those accounts be breached because, as you may have seen in the news, the compromised login credentials often then find their way onto certain sites from which the criminals can then harvest and use them.
But how do you remember a different password for every account you have?
Especially when the number of passwords we have to recall seems to grow by the week (the average person has 118 online accounts now and will likely have over 200 within the next ten years).
Well, the answer is to use a password manager.
By employing such a piece of software, along with a browser extension, you can let go of the dozens of passwords you need to remember and focus instead on just one master password for the particular program you are using.
Sound good?
If so, read on and I will show you how to install one very popular – and free – password manager, as well as explain exactly what benefits you can derive from it.
KeePass overview
Not quite as slick as a commercial password manager such as 1Password, which itself has been in the news this week, KeePass gathers much deserved praise over the way in which it generates and stores encryption keys locally, and the fact that it does not store your passwords on a centralised database that could be susceptible to hacking.
As an open source program, it is, as already mentioned, free. But in its most basic form, it is only compatible with the Windows platform. And for the vast majority of you, that won’t be a problem.
If, however, you are using Linux or OS X there is an alternative in the form of KeePassX and iOS users are catered for with iKeePass. Android users need not feel left out either as Keepass2Android has been designed to take care of their needs. Each of these alternatives to the main Windows version fall out of the scope of this article though so be sure to let us know via the comments if you want more info on any of them and we’ll see what we can do to help.
Security and Privacy
The fact that KeePass is open source means its code is up for scrutiny by anyone who cares to look at it. Given the number of gifted coders using such software, that means there is a good chance that any vulnerabilities will not only be spotted, but spotted quickly.
Encryption presents itself as a double-edged sword with this password manager – its end-to-end nature means the only person who will ever know your master password is you. The advantage of this is that no-one will ever be able to access your password database unless you choose to divulge that password. Not only that, but your encrypted database will be inaccessible to any attacker who gains access to it, making it a good option should you wish to store it on a platform that may otherwise be insecure (a cloud storage platform, for instance). On the flip side, if you ever forget your own master password you’re in trouble – there is no recovery option.
The wide array of plugins that can be added to KeePass allow for a wide range of additional security features to be added including, for example, software keyboards which are an excellent defence for anyone concerned about the possibility of a keylogger being installed on their system.
Conclusion
Drawing a conclusion on the usefulness and effectiveness of KeePass is a tricky proposition because of its open source nature.
As previously mentioned, that has its advantages in terms of security, something that is further enhanced by the inclusion of end-to-end encryption and a lack of a centralised database. These are excellent plus points.
What’s good
- Its open source nature lends itself well to security
- It offers end-to-end encryption
- The default encryption method uses a strong AES-265 cipher with SHA-256 hash authentication
- A wide range of plugins are available which can add browser integration and many other features
- A comprehensive FAQs and community support is strong
- Did I mention its free?
On the other hand, it is nowhere near as polished as a commercial password manager and that could be a serious point of consideration for the less technically inclined among you. If you follow our companion how to guide you should be OK, but that doesn’t detract from the fact that the user interface is one of the less welcoming I’ve seen, or the fact that browser integration is not as smooth as with some of the alternatives.
What’s not so hot
- The user interface could be better – non-technical users may feel intimidated by it
- The aforementioned browser integration cannot be achieved as seamlessly as with other password managers. Likewise, adding in other plugins isn’t as straightforward as it perhaps could be
Overall, however, KeePass does a sterling job of keeping your passwords secure and there are few, if any, password managers that can beat it on that front.
You can try it for free and make your own mind up, safe in the knowledge that you will have lost nothing but your time if you discover its not for you. And if you do decide to pass on KeePass, please do go with an alternative such as LastPass, 1Password, Dashlane or even a password manager built into your browser – either are a far better option than using no password manager at all.
All KeePass reviews
All Star KeePass reviews
All KeePass positive reviews
All KeePass critical reviews
All related KeePass reviews
See all reviewsIt’s good, i’d suggest it to people, but there is one single thing i have serious problem accepting as a user. It does not have a predefined email field in an Entry! From what i’ve read in older posts, for some reason having to do with compatibility and design issues, the developers refused to add an email field.
Nowadays, the vast percentage of entries in a password manager contain an email field, it’s a must. Denying its existence is a no-no, for me at least. You have the option of adding a custom field if you wish but it is far from convenient since you must manually add it in every entry you enter and there is probably no way for an import process to utilize this field.
I’ve been using KeePass for many years and have never had any issues with the software. I use a Key File which I don’t store on any device which adds an additional layer of protection.
Working on Ubuntu, MS Windows and Android I was desperately seeking for a password manager that can save me the work of redundantly managing my (quite dynamic) password databases. Tried out several password managers and eventually decided to use Keepass. Now I maintain only one database on my local NAS server and each platform tailored version of Keepass uses this one database. I kept the database far from WAN for security reasons, which is not a problem because Keepass works with a local copy of the database. Once back in my own private network it only needs to synchronize if any mutations has been performed. Great comfort!
KeepassXC is a much better product. Fork of Keepass but there are actual developers doing actual improvements. UI is a 1000x better and it works so awesome. Of course source code is open source. KeepassXC has made Keepass actually usable.
Be aware, this application can cause you to loose all your passwords. I changed my password to something new, then got locked out because it would not respond to either the old password of the new one! Lot of lot time! Bad bug. And yes, I’m VERY SURE what the new password was.
A SW engineer who has difficulties using it?! I have used Keepass now for years and find it very easy to use. No bells and whistles as some of the others but it works like a charm, and that’s all I need.
I think KeePass is very easy to use, very logical and love the clutter free interface. I have tried others but always come back to KeePass. I use it on Windows but mostly on Android and IOS. It syncs with no problem at all.
I use Keepass and have done so for some considerable time. I find it dead easy to use and also very intuitive, perhaps it is my warped twisted brain but I cannot see what problems the reviewer is referring to. Only issue I have is in porting it across to another device, I succeeded eventually but struggled for a while to get the program on the second device to import the database.
I use it but hate it. One of the most unintuitive pieces of software I’ve ever used (and I’ve been sw engineer for 25 years). Still it’s free and it does work if you’re patient enough to jump thru all the hoops needed to get it running. It just makes me wonder what the designers were thinking when they designed the interface. Nothing is where it should logically be.