KeePass
Hacker ApprovedRanked 5 of 21 password managers by recommenders
Recommended as a free, long-lived password manager that stores everything in one encrypted local file you control and sync however you like, though syncing and browser autofill can be rough.
Recommended as a free, long-lived password manager that stores everything in one encrypted local file you control and sync however you like, though syncing and browser autofill can be rough.
132 people gave an opinion
- recommend it
- 100
- criticize it
- 32
- approval share
- 76%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Owned for 10 years
Median of the 10 owners who said how long they have had it.
Each square is one year.
Why it carries the badge
- 100 people recommend itNeeds 10 or more, met.
- 3.1 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Just an encrypted local file
“KeePass in particular can be synced using server-free methods, keeping everything on-device, strongly encrypted”
Comment from 30 Jun 2026 in “Ask HN: Should HN Get 2FA?” “I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.”
Comment from 23 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain” “I use it and have copies of the encrypted db on every device of mine, plus the client to access the passwords.”
Comment from 13 Dec 2025 in “Poor Johnny still won't encrypt” - Comment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can”
- Comment from 16 Aug 2026 in “Show HN: Laptop is the last place your secrets are still in plaintext”
- Comment from 24 Feb 2026 in “1Password pricing increasing 20% in March”
- Comment from 5 May 2026 in “Microsoft Edge stores all passwords in memory in clear text, even when unused”
Sync via your own storage
“I keep my KeePass database on NextCloud, and the only difference between home and phone is that on a bad network I may need a few seconds”
Comment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can” “I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices.”
Comment from 18 Sep 2026 in “I don't like passkeys” “Immich and Syncthing+Keepass have worked as well as or better than their proprietary equivalents”
Comment from 7 Dec 2025 in “Self-hosting my photos with Immich” - Comment from 25 Jun 2026 in “LastPass notifies users of yet another data breach”
- Comment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can”
Reliable for a decade or more
“It's worked great for me so far, and I expect to stay with this setup for the foreseeable future.”
Comment from 5 Oct 2026 in “Pixel 11 doesn't yet meet the GrapheneOS security standards and may be skipped” “The original version of Keepass 1.0 for Windows was released long before Lastpass or 1Password”
Comment from 22 Jul 2026 in “Passkeys were invented by engineers with zero understanding of consumer brain” “Anyone not already using KeePass (or KeePassXC) has been doing it wrong for at least a decade.”
Comment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can” - Comment from 2 May 2026 in “I Do Not Recommend Bitwarden”
- Comment from 20 Mar 2026 in “Android: Balancing Openness and Choice with Safety”
- Comment from 2 May 2026 in “I Do Not Recommend Bitwarden”
Avoids cloud password manager breaches
“I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.”
Comment from 23 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain” “we are prioritizing “can’t” over “won’t” in terms of provider access to our credentials”
Comment from 25 Jun 2026 in “LastPass notifies users of yet another data breach” “I haven't heard of massive security breaches like many online password manager had.”
Comment from 10 Oct 2026 in “Bitwarden Dual License Model”
What people warn about
Each mark is one comment
Sync and sharing cause corruption
“The whole reason I moved to 1Password was to get away from how easy it was to accidentally lose data with the KeePass clients.”
Comment from 18 May 2026 in “The Quiet Renovation at Bitwarden” “Solving sync and sharing cannot be done on whole database file level, as it implemented now in KeePass”
Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite” “people who have experienced corruption issues on network storage due to the default saving method”
Comment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite” - Comment from 25 Jun 2026 in “LastPass notifies users of yet another data breach”
- Comment from 18 May 2026 in “The Quiet Renovation at Bitwarden”
- Comment from 20 May 2026 in “The Quiet Renovation at Bitwarden”
Whole-file encryption and rewrites
“rewriting the whole file annoys me especially when the storage is not local and the database contains sizable blobs”
Comment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite” “Solving sync and sharing cannot be done on whole database file level, as it implemented now in KeePass”
Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite” “having it all in memory is an issue because of the amount of memory used”
Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite” - Comment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite”
Weak browser autofill and integration
“The Keepass options for browser autofill are pretty rough, and don't work with flatpak installed apps either.”
Comment from 6 Jul 2026 in “Show HN: Bramble – Local-first password manager” “I use keepass (FOSS under GPL, fully offline). It does not detect domains.”
Comment from 18 Jun 2026 in “I found 10k GitHub repositories distributing Trojan malware” “Keepass is a vendor, and one who doesn't even have a Safari extension.”
Comment from 17 Dec 2025 in “Yep, Passkeys Still Have Problems” Closed development, no public review
“its development model is much like SQLite: a pretty closed model, with source published regularly, but no clear way of code contribution”
Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite” “the original KeePass project has no public development or public review process for their code”
Comment from 9 Nov 2025 in “About KeePassXC's Code Quality Control”
Other password managers people recommend
The four most recommended other password managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bitwarden | 278 | 213 | 57% | 12 | 6.5 yrs23 owners | — |
| 1Password | 238 | 179 | 57% | 12 | 15 yrs28 owners | — |
| KeePassXC | 131 | 38 | 78% | 12 | 5 yrs5 owners | Approved |
| Vaultwarden | 112 | 13 | 90% | 11 | 3 yrs9 owners | Approved |
| KeePassThis page | 100 | 32 | 76% | 12 | 10 yrs10 owners | Approved |
What people said
40 of the 156 comments that mention it, newest first. Each links to the original comment.
“I haven't heard of massive security breaches like many online password manager had.”
“It's worked great for me so far, and I expect to stay with this setup for the foreseeable future.”
“I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices.”
“keepass is great, because it doesn't require any service to operate - it's just a file”
“The original version of Keepass 1.0 for Windows was released long before Lastpass or 1Password”
“The Keepass options for browser autofill are pretty rough, and don't work with flatpak installed apps either.”
“KeePass in particular can be synced using server-free methods, keeping everything on-device, strongly encrypted”
“we are prioritizing “can’t” over “won’t” in terms of provider access to our credentials”
“you’re on your fucking own for you know Miner things like syncing or mobile use”
“keepass + a scheduled script to periodically backup to your own servers is also perfectly viable”
“I use keepass (FOSS under GPL, fully offline). It does not detect domains.”
“You don't need to host anything for KeePass - just plop the file next to your notes/etc.”
“I keep my KeePass database on NextCloud, and the only difference between home and phone is that on a bad network I may need a few seconds”
“Anyone not already using KeePass (or KeePassXC) has been doing it wrong for at least a decade.”
“Sharing passwords with shared keepass files didn't work properly for me.”
“the benefit of this over the browser extension is that there is no connection between your browser and your keepass vault.”
“the syncing strategy on iOS is a disaster and corrupted my wife's keepass db”
“The whole reason I moved to 1Password was to get away from how easy it was to accidentally lose data with the KeePass clients.”
“it's locked in an encrypted store and only available exactly when I need it to be”
“KeePass is a great middle-ground, which I've been using for the last decade (at least).”
“ive been rather fond of keepass for the last however many years or decades now”
“how someone creating their own installer and buying a few domains to distribute it is a mark against KeePass itself.”
“I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.”
“I started with Keepass back in the day, and never had to worry about migration.”
“having it all in memory is an issue because of the amount of memory used”
“The URL field in KeePass has lots of convenient features, but unfortunately they're quite "obscure" and not very discoverable.”
“its development model is much like SQLite: a pretty closed model, with source published regularly, but no clear way of code contribution”
“Solving sync and sharing cannot be done on whole database file level, as it implemented now in KeePass”
“Free. Portable. I'm a longtime user and carry my database around on an USB stick.”
“people who have experienced corruption issues on network storage due to the default saving method”
“in the case of KDBX there is the issue that it is encrypted as a whole”
“rewriting the whole file annoys me especially when the storage is not local and the database contains sizable blobs”
“KeePass has such great potential, where so many other managers fall severely short in differing categories.”
“If you use a password manager like Keepass, you should still be able to log into your other accounts if you lost access”
“For me everything goes in Keepass. And the only thing I want in life is the ability to change a password from Keepass in a standardized way.”
“Keepass is a vendor, and one who doesn't even have a Safari extension.”
“I use it and have copies of the encrypted db on every device of mine, plus the client to access the passwords.”
“Immich and Syncthing+Keepass have worked as well as or better than their proprietary equivalents”
“One of my hobbies is recreational paranoia though. So I use something else (KeyPass) for my personal stuff now.”
“the original KeePass project has no public development or public review process for their code”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.