Mac · iPad · iPhone · KeePass

Your KeePass file, where it lives.

Name: Keepasso
Author: dopecode

A KeePass client for Mac, iPad and iPhone. It opens the .kdbx you already have — in iCloud Drive, in Dropbox, on a USB stick — edits it there, and saves it back in the version it came in, so KeePassXC, Strongbox and KeePassium read it the next morning as if nothing happened. That is Keepasso.

· no account
· no server
· no analytics
· KDBX 3.1 and 4.x
· Face ID and Touch ID
· AutoFill

See it work

· One app for the Mac, the iPad and the iPhone

Keepasso on an iPad in landscape: the groups Email and web, Finance, Home and Work in the sidebar with Finance selected, its four entries in the middle, and the Bank current account entry on the right with its password, PIN and IBAN.

Keepasso on an iPhone in the dark theme: the Git hosting entry with its user name, a masked password, its URL, a recovery field and a recovery-codes attachment.

The file is yours

One file, opened where it is.

A KeePass database is a file other clients read and write, and Keepasso treats it that way. Nothing is copied in, nothing is kept beside it, and nothing is added to it that another client would show you as junk.

Edited in place,
saved as it came.

Where it lives is where it stays. A database in iCloud Drive, Dropbox, MEGA or on a drive is reached through a bookmark and saved straight back — which is the only way one file stays one file on three devices.
In the version it came in. A 3.1 file is saved as 3.1, a 4.x file as 4.x, with every field the format has still in it. New databases are KDBX 4.1 under Argon2id.
A folder of its own, if you want one. iCloud Drive ▸ Keepasso is the app's own; the unlock screen offers to put a database there, and never does it on its own. Somebody else's file is copied, not moved.
Open With ▸ Keepasso in the Finder, and Open in Keepasso from Files or Mail. When another app can only hand over a copy, the unlock screen says a copy is what it is.

Keepasso on a Mac in the light theme: the Work group selected in the sidebar, its five entries in the middle, and the Git hosting entry on the right with a masked password, a recovery field and its recovery-codes attachment.

readswrites

KDBX 3.1yesyes, as 3.1

KDBX 4.0 · 4.1yesyes, as it came; new databases are 4.1

ciphersAES-256, ChaCha20, Twofishthe same

key derivationAES-KDF, Argon2d, Argon2idthe same

key filesXML 1.0 and 2.0, 32 bytes, 64 hex digits, any file—

KDB 1.xrefused, with a sentence saying what it is—

On the Mac

Three columns and the KeePass keys.

Groups, entries and one entry, side by side. Search is ⌘F, a word and Return; the password is then ⇧⌘C away, with nothing pointed at.

Keepasso on a Mac in the dark theme: the group tree with Finance selected by an amber rail, the Bank current account, Credit card, Pension and Tax office entries, and the Bank entry's fields, all passwords as twelve dots.

⌘F

Find — titles, user names, URLs, notes and tags, never a password

⌘B

Copy the user name

⇧⌘C

Copy the password; it leaves the clipboard again on its own

⇧⌘U

Open the URL

⌘N⌥⌘N

New entry, new group

⌘E⌘D

Edit, duplicate

⌘S⌘L

Save, lock

The same keys on an iPad with a keyboard attached.
Drag to reorganise. An entry dropped on a group moves into it, a group into another group; the row lights up only for a drop it will take.
Two databases, two windows. A second .kdbx opened from the Finder gets a window of its own.
It locks when you walk away, after the interval you set — and says so for the last thirty seconds, with a way to stay open. A key or a click in the window counts as being there.
Touch ID opens a database whose key you chose to keep; the password itself is never stored.
Light and dark, or whatever the Mac is set to.

iPhone & iPad

The same vault, in your hand.

One app across the three: three columns on an iPad in landscape, one screen at a time on a phone, and nothing hidden on the smaller one.

Face ID opens it.
AutoFill signs you in.

Face ID and Touch ID keep the key, never the password. What is stored is the key that opens that one file, in this device's keychain, behind the face or finger enrolled now — enrol another and it is gone.
AutoFill at any login form, from Settings ▸ General ▸ AutoFill & Passwords. The sheet lists what matches the site first and everything else under it.
Send an entry through the share sheet — the fields as text and every attachment as a file — and the sheet's header shows the title, never the password.
Locks on the way out. Leaving the app locks the database unless there are unsaved changes, and a copied password leaves the clipboard on its own.

The Keepasso lock screen on an iPhone in the light theme: the mark, Personal.kdbx, the word locked, one password field and an Unlock button.

All entries on an iPhone in the light theme: Bank current account, Build server, Credit card, Domain registrar, Email and more, each with its user name, and the search field at the foot.

In a terminal

kp: the same core, typed.

Keepasso's KeePass half is a Rust library, and kp is a command line in front of it — every verb against a real file, and kp ui, the three panes in the same colours, the same twelve dots, and a password on the clipboard with one key.

kp ui in a terminal: a header with the file's cipher and key derivation, the group tree with Finance selected, its four entries with Bank current account selected, and the entry's fields with the password and PIN as twelve dots.

kp show <file> <entry>One entry; protected fields are dots until --reveal

kp search <file> <term>Every entry the term is in

kp copy <file> <entry>The password to the clipboard, gone again on its own

kp add · edit · mv · rmChange the file where it stands

kp attach <file> <entry>List, add, save or remove attachments

kp generate [length]A password from the same generator as the app

kp is not part of the App Store app.

Privacy, itemised

Claims you can check.

The specific version, phrased so that you could go and verify it. The formal version is dopecode's privacy policy.

your database

Read and written where it lives, and nowhere else. No account, no sync service, no cache of the tree. Your database never leaves your devices except by the storage you chose for it.

what it sends

Nothing, on its own. No analytics, no crash reporter, no server to talk to. The only things that leave are what you send yourself, through the share sheet.

Face ID, Touch ID

What is kept is the key that opens one file, never your password — in this device's keychain, behind the face or finger enrolled today. A new face or finger ends it.

AutoFill

The extension cannot open your file, so it gets a copy of the same encrypted bytes, in a container only Keepasso shares, replaced on every save — with no key beside it. It is off until you turn it on, and turning it off deletes the copy.

on screen

A password is twelve dots until you ask, whatever its length. The field that opens the vault has no eye at all, and a copied password leaves the clipboard after the interval you set.

the cryptography

None of it is ours. AES, ChaCha20, Twofish, Salsa20, SHA-2, HMAC and Argon2 are the RustCrypto implementations, and a database that does not open back exactly as it was saved fails the tests before anything ships.

The honest part

What it does not do.

Better read here than found out afterwards.

Not in the app

No sync service, and no merge. One file, wherever you keep it. Two devices saving the same file at the same moment is whatever that storage does.
No import from other password managers. KeePassXC imports; Keepasso then opens the file.
No one-time codes. A TOTP secret can be kept in a protected field; Keepasso does not turn it into codes.
No passkeys and no hardware keys such as a YubiKey.
No changing a database's password. It opens and saves with the one the file has; KeePassXC changes it.
No new key files. It opens a database with any key file; it does not make one.
No KeePass 1 (.kdb) files.

Where the platform gets in the way

AutoFill runs in a process of its own that cannot reach your file, so it answers from the copy the app last left it — refreshed every time you unlock or save. A database changed on another device is answered from that copy until you open Keepasso here, and the AutoFill sheet shows the copy's date whenever it is not today's.

A password you forget cannot be recovered — by us, by Apple, or by any other KeePass client. The file has no back door, which is the point of it.

Help

The questions people ask.

How do I open the database I already have?

Press Open… and pick the .kdbx wherever it is — iCloud Drive, a Files provider such as Dropbox or MEGA, a folder or a drive. It is opened in place and remembered under Recent, so next time it is one tap.

Where should my database live to be on all my devices?

In iCloud Drive ▸ Keepasso. The unlock screen offers to put an open database there; it is then the same file on every device signed into your Apple Account. Any other shared folder works too — open the same file from each device.

How do I turn on AutoFill?

Unlock the database, then in Keepasso's Settings ▸ AutoFill switch on Use this database for AutoFill. Then tick Keepasso in the system's list: on an iPhone or iPad, Settings ▸ General ▸ AutoFill & Passwords; on a Mac, System Settings ▸ Passwords ▸ Password Options. Keepasso's own Settings say whether the system has it switched on.

How do I unlock with Face ID or Touch ID?

On the unlock screen, switch on Unlock with Face ID next time (or Touch ID) and unlock with the password once. From then on the screen asks for your face or finger as it appears. If the database's password is changed on another device, the kept key stops working and Keepasso says so; unlock with the new password and switch it on again.

A file in Recent says missing.

It has moved, been renamed, or the storage it was in is signed out. Press the ✕ beside it — the file itself is not touched — and open it again from where it is now.

I forgot the database's password.

Then nobody can open it: not Keepasso, not us, not any other KeePass client. There is no reset and no copy of the password anywhere — that is what makes the file safe to keep in somebody else's cloud. A device where Face ID or Touch ID still opens it can still show you the entries; copy out what matters while it does.

Is anything uploaded?

No. Keepasso has no server. The database goes where you keep it — which is iCloud Drive's or Dropbox's business if that is where you put it — and nowhere else.

Still stuck? Write to hello@dopecode.com with your Keepasso version (Settings ▸ About) and what it said. Never send your database or its password — we will never ask for either.

Your KeePass file, where it lives.

Real screens. An invented vault.