Get started with KeePassXC

What you get out of this

A company collects more logins than anyone counted on: Instagram, email, the web shop, the image service, maybe a supplier portal. The solution tends to be one password that everyone knows, sent in a chat long ago, and still sitting there along with the whole conversation.

KeePassXC turns that into a vault. All logins sit in a single encrypted file that you open with a master password. The file is yours, it stays where you put it, and the program does not send anything anywhere on its own.

It is free, open source, and available for Windows, Linux and macOS. And unlike most password managers, there is no service to subscribe to, no server that can be hacked and no account that can be closed.

Before you start

• A master password you can remember without writing it down. Four or five random words in a row are both easier to remember and harder to crack than Sommar2026!. Do not use the same one as for another account you already have.
• A place where the vault file will be stored, preferably in the company's shared folder so that it is synced and backed up.
• Half an hour, plus ten minutes per person in the company.
• A decision about who may open the vault. Everyone in the company is usually the right answer, but it should be a decision and not a coincidence.

Install on Windows

Download KeePassXC-VERSION-Win64.msi from keepassxc.org and run it. The file named LegacyWindows is for older Windows versions, take it only if the regular one refuses to install.

There is also a zip file on the same page. You unpack it anywhere and start the program directly from the folder, which works on a computer where you are not allowed to install anything and also from a USB stick.

If the program complains at startup about a missing system file, the computer needs Microsoft's Visual C++ Redistributable, which is linked on the same download page. It is a common package that many programs share.

Install on Linux Mint

KeePassXC is available in Mint's own software repository, so one command in Terminal is enough:

sudo apt install keepassxc

The version there is the one that existed when Mint was released. On Mint 22 it is 2.7.6, while the project itself is on 2.7.12. The difference does not matter for a vault with twenty logins, but if you want the latest version, the developers have their own repository:

sudo add-apt-repository ppa:phoerious/keepassxc
sudo apt update
sudo apt install keepassxc

That repository is the one KeePassXC links to from its own download page, so the packages come from the developers themselves. A third option is Flathub, which Mint has preconfigured:

flatpak install flathub org.keepassxc.KeePassXC

Choose one of the three. If you install two, you get two shortcuts in the menu and will wonder why the changes do not show up in one of them.

Create the vault

1. Start the program and select Create new database.
2. Give it a name that says what it is, for example foretaget-losenord. The name is not secret, the content is.
3. Leave the encryption settings as they are. The defaults were made by people who know this better than we do.
4. Enter the master password. The meter below the box shows how strong it is. Aim for it to hit the ceiling, which it does with four to five words.
5. Choose where the file will be saved. Put it in the company's shared folder, not on the desktop.

The file you get has the extension .kdbx and is encrypted. You can put it in Nextcloud, Drive or OneDrive without the content becoming readable to the service, because the encryption happens in the program before the file is saved.

In the same dialog you can add a key file in addition to the password. That raises security and it lowers the chance that the company itself can get into the vault the day the key file goes missing. For a company, a strong master password is enough. If you still choose a key file: do not put it in the same folder as the vault, because then it is no extra barrier.

Add the first logins

Click New entry and fill in the title, username, password and address. The address matters more than it looks, because it is what makes the browser extension find the right entry later.

Use the generator, the dice icon next to the password field, instead of making up the passwords yourselves. A generated password of twenty characters costs nothing when the program remembers it for you anyway. The exception is accounts you must be able to type in by hand on a phone, where a few words in a row work better.

Set up groups in the left column: Social media, Finance, Suppliers. Twenty entries with no order become fifty entries with no order before the quarter is over.

Write in the notes field who owns the account and what it is used for. Whoever takes over the account later on will be grateful.

The browser extension that makes the vault usable day to day

A vault you have to open, search and copy from gets used for two weeks. The KeePassXC-Browser extension fills in the login directly on the page instead.

It is turned on in two steps. In the program: Tools, Settings, Browser integration, enable it and check your browser. In the browser: install the extension from Firefox or Chrome, click the icon and connect. You confirm the connection in KeePassXC and give it a name.

After that it works like this: you open the vault in the morning, and for the rest of the day the logins are filled in when you visit the pages. If the vault is locked, nothing happens, which is the whole point.

One thing you need to understand: the extension can reach everything in the open vault. Install it only from the official store page, and never approve a connection request you did not start yourself.

Share the vault in the company without breaking it

Put the .kdbx file in the folder you already sync, for example Nextcloud. Everyone in the company opens the same file with the same master password.

The trap: two people who have the vault open at the same time and both save. KeePassXC often detects that the file has changed and reloads it automatically, but that monitoring is unreliable over a network-shared or cloud-synced folder, which is exactly what you have here. Then one person overwrites the other's changes, and the sync service creates a conflict file with a long name that nobody dares to touch. Avoid it with a simple habit: whoever is going to add something says so in the chat, makes the change, closes the vault. The others close and open theirs again.

If you need real multi-user management, with different permissions per person, a server is the way to go instead. See Install Vaultwarden, which solves exactly that.

Back up the vault file to a second place, for example a USB stick in a drawer. An encrypted file you have lost is just as lost as a file you never had, and this file contains the keys to everything you have built.

How you know it worked

• The program starts and you can open the vault with the master password.
• The vault contains at least the company's most important accounts, with addresses filled in.
• The file is in the synced folder, and at least one more person can access it.
• The browser extension fills in a login automatically on a real page.
• The vault locks itself when the computer has been idle for a while.
• There is a backup of the .kdbx file outside the synced folder.

If something goes wrong

The master password does not work. Check the keyboard language and whether Caps Lock is on. There is no reset, and that is on purpose: if we could open your file, anyone could.

The extension cannot find KeePassXC. The program is closed, or the browser integration is not turned on under Tools, Settings, Browser integration. If you run the Flatpak version, which is the project's own recommendation, the browser extension may need an extra approval the first time; that is no reason to switch away from Flatpak.

There is a conflict file in the shared folder. Two people saved at the same time. Open both files in KeePassXC, use Database and Merge database, and delete the conflict file once you have checked the result.

The vault locks itself in the middle of your work. That is the automatic lock setting, and it should be on. If the time is too short, change it under Settings and Security.

The program complains about a missing system file on Windows. Install Visual C++ Redistributable from the link on the download page.

What you do next

Change the password on the account that currently has the worst one, the one that is sitting in a chat somewhere. Put the new one in the vault right away and delete the message in the chat.

Add the two-factor codes to the same entry while you are at it, KeePassXC can save them under TOTP in the right-click menu. And when the notes about who owns which account start to outgrow the field, move them to Joplin.