Hacker ApprovedDepartments

KeePass

Hacker Approved

Ranked 5 of 21 password managers by recommenders

Recommended as a free, long-lived password manager that stores everything in one encrypted local file you control and sync however you like, though syncing and browser autofill can be rough.

Recommended as a free, long-lived password manager that stores everything in one encrypted local file you control and sync however you like, though syncing and browser autofill can be rough.

132 people gave an opinion

recommend it
100
criticize it
32
approval share
76%
Each figure is one person. RecommendsCriticizes

Recommended in 12 of 13 months

  1. November 2025: recommended
  2. December 2025: recommended
  3. January 2026: recommended
  4. February 2026: recommended
  5. March 2026: recommended
  6. April 2026: recommended
  7. May 2026: recommended
  8. June 2026: recommended
  9. July 2026: recommended
  10. August 2026: recommended
  11. September 2026: recommended
  12. October 2026: recommended
  13. November 2026: not recommended (month in progress)

Owned for 10 years

Median of the 10 owners who said how long they have had it.

Each square is one year.

Why it carries the badge

  • 100 people recommend itNeeds 10 or more, met.
  • 3.1 recommenders for every criticNeeds 2 to 1 or better, met.
  • Recommended in 12 of 13 monthsNeeds 4 or more, met.

The same three rules apply to every product, and the badge can’t be bought. How the badge works

What people say about it

The reasons people give, with the number of comments that give each one. Open a reason to read what they said.

Why people recommend it

Each mark is one comment

  • Just an encrypted local file

    “KeePass in particular can be synced using server-free methods, keeping everything on-device, strongly encrypted”

    Comment from 30 Jun 2026 in “Ask HN: Should HN Get 2FA?”

    “I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.”

    Comment from 23 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain”

    “I use it and have copies of the encrypted db on every device of mine, plus the client to access the passwords.”

    Comment from 13 Dec 2025 in “Poor Johnny still won't encrypt”
  • Sync via your own storage

    “I keep my KeePass database on NextCloud, and the only difference between home and phone is that on a bad network I may need a few seconds”

    Comment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can”

    “I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices.”

    Comment from 18 Sep 2026 in “I don't like passkeys”

    “Immich and Syncthing+Keepass have worked as well as or better than their proprietary equivalents”

    Comment from 7 Dec 2025 in “Self-hosting my photos with Immich”
  • Reliable for a decade or more

    “It's worked great for me so far, and I expect to stay with this setup for the foreseeable future.”

    Comment from 5 Oct 2026 in “Pixel 11 doesn't yet meet the GrapheneOS security standards and may be skipped”

    “The original version of Keepass 1.0 for Windows was released long before Lastpass or 1Password”

    Comment from 22 Jul 2026 in “Passkeys were invented by engineers with zero understanding of consumer brain”

    “Anyone not already using KeePass (or KeePassXC) has been doing it wrong for at least a decade.”

    Comment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can”
  • Avoids cloud password manager breaches

    “I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.”

    Comment from 23 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain”

    “we are prioritizing “can’t” over “won’t” in terms of provider access to our credentials”

    Comment from 25 Jun 2026 in “LastPass notifies users of yet another data breach”

    “I haven't heard of massive security breaches like many online password manager had.”

    Comment from 10 Oct 2026 in “Bitwarden Dual License Model”

What people warn about

Each mark is one comment

  • Sync and sharing cause corruption

    “The whole reason I moved to 1Password was to get away from how easy it was to accidentally lose data with the KeePass clients.”

    Comment from 18 May 2026 in “The Quiet Renovation at Bitwarden”

    “Solving sync and sharing cannot be done on whole database file level, as it implemented now in KeePass”

    Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”

    “people who have experienced corruption issues on network storage due to the default saving method”

    Comment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite”
  • Whole-file encryption and rewrites

    “rewriting the whole file annoys me especially when the storage is not local and the database contains sizable blobs”

    Comment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite”

    “Solving sync and sharing cannot be done on whole database file level, as it implemented now in KeePass”

    Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”

    “having it all in memory is an issue because of the amount of memory used”

    Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”
  • Weak browser autofill and integration

    “The Keepass options for browser autofill are pretty rough, and don't work with flatpak installed apps either.”

    Comment from 6 Jul 2026 in “Show HN: Bramble – Local-first password manager”

    “I use keepass (FOSS under GPL, fully offline). It does not detect domains.”

    Comment from 18 Jun 2026 in “I found 10k GitHub repositories distributing Trojan malware”

    “Keepass is a vendor, and one who doesn't even have a Safari extension.”

    Comment from 17 Dec 2025 in “Yep, Passkeys Still Have Problems”
  • Closed development, no public review

    “its development model is much like SQLite: a pretty closed model, with source published regularly, but no clear way of code contribution”

    Comment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”

    “the original KeePass project has no public development or public review process for their code”

    Comment from 9 Nov 2025 in “About KeePassXC's Code Quality Control”

Other password managers people recommend

The four most recommended other password managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.

KeePass compared with 4 alternatives
ProductRecommendCriticizeApprovalMonthsOwnedBadge
Bitwarden27821357%126.5 yrs23 owners—
1Password23817957%1215 yrs28 owners—
KeePassXC1313878%125 yrs5 ownersApproved
Vaultwarden1121390%113 yrs9 ownersApproved
KeePassThis page1003276%1210 yrs10 ownersApproved
See all 21 password managers, ranked

What people said

40 of the 156 comments that mention it, newest first. Each links to the original comment.

“I haven't heard of massive security breaches like many online password manager had.”

RecommendsComment from 10 Oct 2026 in “Bitwarden Dual License Model”

“It's worked great for me so far, and I expect to stay with this setup for the foreseeable future.”

RecommendsComment from 5 Oct 2026 in “Pixel 11 doesn't yet meet the GrapheneOS security standards and may be skipped”

“I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices.”

RecommendsComment from 18 Sep 2026 in “I don't like passkeys”

“keepass is great, because it doesn't require any service to operate - it's just a file”

MixedComment from 16 Aug 2026 in “Show HN: Laptop is the last place your secrets are still in plaintext”

“The original version of Keepass 1.0 for Windows was released long before Lastpass or 1Password”

RecommendsComment from 22 Jul 2026 in “Passkeys were invented by engineers with zero understanding of consumer brain”

“The Keepass options for browser autofill are pretty rough, and don't work with flatpak installed apps either.”

CriticizesComment from 6 Jul 2026 in “Show HN: Bramble – Local-first password manager”

“KeePass in particular can be synced using server-free methods, keeping everything on-device, strongly encrypted”

RecommendsComment from 30 Jun 2026 in “Ask HN: Should HN Get 2FA?”

“we are prioritizing “can’t” over “won’t” in terms of provider access to our credentials”

RecommendsComment from 25 Jun 2026 in “LastPass notifies users of yet another data breach”

“you’re on your fucking own for you know Miner things like syncing or mobile use”

CriticizesComment from 25 Jun 2026 in “LastPass notifies users of yet another data breach”

“keepass + a scheduled script to periodically backup to your own servers is also perfectly viable”

RecommendsComment from 25 Jun 2026 in “LastPass notifies users of yet another data breach”

“I use keepass (FOSS under GPL, fully offline). It does not detect domains.”

MixedComment from 18 Jun 2026 in “I found 10k GitHub repositories distributing Trojan malware”

“You don't need to host anything for KeePass - just plop the file next to your notes/etc.”

RecommendsComment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can”

“I keep my KeePass database on NextCloud, and the only difference between home and phone is that on a bad network I may need a few seconds”

RecommendsComment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can”

“Anyone not already using KeePass (or KeePassXC) has been doing it wrong for at least a decade.”

RecommendsComment from 21 May 2026 in “Get your passwords out of Bitwarden while you still can”

“Sharing passwords with shared keepass files didn't work properly for me.”

CriticizesComment from 20 May 2026 in “The Quiet Renovation at Bitwarden”

“the benefit of this over the browser extension is that there is no connection between your browser and your keepass vault.”

RecommendsComment from 19 May 2026 in “The Quiet Renovation at Bitwarden”

“the syncing strategy on iOS is a disaster and corrupted my wife's keepass db”

CriticizesComment from 18 May 2026 in “The Quiet Renovation at Bitwarden”

“The whole reason I moved to 1Password was to get away from how easy it was to accidentally lose data with the KeePass clients.”

CriticizesComment from 18 May 2026 in “The Quiet Renovation at Bitwarden”

“it's locked in an encrypted store and only available exactly when I need it to be”

RecommendsComment from 5 May 2026 in “Microsoft Edge stores all passwords in memory in clear text, even when unused”

“KeePass is a great middle-ground, which I've been using for the last decade (at least).”

RecommendsComment from 2 May 2026 in “I Do Not Recommend Bitwarden”

“ive been rather fond of keepass for the last however many years or decades now”

RecommendsComment from 2 May 2026 in “I Do Not Recommend Bitwarden”

“how someone creating their own installer and buying a few domains to distribute it is a mark against KeePass itself.”

RecommendsComment from 23 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain”

“I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.”

RecommendsComment from 23 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain”

“I started with Keepass back in the day, and never had to worry about migration.”

RecommendsComment from 20 Mar 2026 in “Android: Balancing Openness and Choice with Safety”

“having it all in memory is an issue because of the amount of memory used”

CriticizesComment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”

“The URL field in KeePass has lots of convenient features, but unfortunately they're quite "obscure" and not very discoverable.”

MixedComment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”

“its development model is much like SQLite: a pretty closed model, with source published regularly, but no clear way of code contribution”

CriticizesComment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”

“Solving sync and sharing cannot be done on whole database file level, as it implemented now in KeePass”

CriticizesComment from 25 Feb 2026 in “Why the KeePass format should be based on SQLite”

“Free. Portable. I'm a longtime user and carry my database around on an USB stick.”

RecommendsComment from 24 Feb 2026 in “1Password pricing increasing 20% in March”

“people who have experienced corruption issues on network storage due to the default saving method”

CriticizesComment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite”

“in the case of KDBX there is the issue that it is encrypted as a whole”

CriticizesComment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite”

“rewriting the whole file annoys me especially when the storage is not local and the database contains sizable blobs”

CriticizesComment from 24 Feb 2026 in “Why the KeePass format should be based on SQLite”

“KeePass has such great potential, where so many other managers fall severely short in differing categories.”

MixedComment from 21 Feb 2026 in “Password managers less secure than promised”

“If you use a password manager like Keepass, you should still be able to log into your other accounts if you lost access”

RecommendsComment from 25 Dec 2025 in “Google is 'gradually rolling out' option to change your gmail.com address”

“For me everything goes in Keepass. And the only thing I want in life is the ability to change a password from Keepass in a standardized way.”

RecommendsComment from 17 Dec 2025 in “Yep, Passkeys Still Have Problems”

“Keepass is a vendor, and one who doesn't even have a Safari extension.”

CriticizesComment from 17 Dec 2025 in “Yep, Passkeys Still Have Problems”

“I use it and have copies of the encrypted db on every device of mine, plus the client to access the passwords.”

RecommendsComment from 13 Dec 2025 in “Poor Johnny still won't encrypt”

“Immich and Syncthing+Keepass have worked as well as or better than their proprietary equivalents”

RecommendsComment from 7 Dec 2025 in “Self-hosting my photos with Immich”

“One of my hobbies is recreational paranoia though. So I use something else (KeyPass) for my personal stuff now.”

RecommendsComment from 1 Dec 2025 in “Stop Hacklore – An Open Letter”

“the original KeePass project has no public development or public review process for their code”

CriticizesComment from 9 Nov 2025 in “About KeePassXC's Code Quality Control”

Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.