KeePassDX is an open-source (GPLv3) local password and passkey manager for Android, developed by Jeremy Jamet, a French individual developer publishing as Kunzisoft, and distributed via F-Droid (a 'Libre' build compiled by F-Droid), Google Play (a 'Free' build plus a paid Pro unlock) and signed GitHub releases. Caveats: where the database file lives and whether it syncs to a cloud is up to the user's file manager; Google's Android auto-backup copies non-sensitive app settings; autofill and the Magikeyboard hand credentials to other apps via OS mechanisms; the Play 'Free' build adds two non-libre elements (Steam OTP, a Google passkey whitelist) absent from the F-Droid build; the project is effectively single-maintainer, funded by donations, with no legal entity or third-party audit. One public vulnerability, CVE-2018-1000835 (XXE in the kdbx parser, beta versions), was disclosed via the issue tracker and fixed; no breach or regulatory action was found.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
17 ON FILE
COLLECTION
KeePassDX's store description (published in the repository's fastlane metadata and mirrored on F-Droid and Google Play) states the app edits encrypted data in a single file in the open KeePass format, requires no Internet connection, and is open source with no advertising — there is no account, no server-side vault and no operator-held copy of the database.
The project's CONTRIBUTING guidelines state that KeePassDX was designed as a purely local application with no unnecessary permissions and no internet connection, that contributors should avoid features requiring a network connection, and that it should remain a file-editing app using Android's Storage Access Framework rather than manipulating database files directly — a design constraint written into the contribution rules, not only marketing copy.
The Google Play listing's developer-provided Data safety section for KeePassDX (app updated Jun 15, 2026) declares 'No data collected' and 'No data shared with third parties'; Play notes this information is supplied by the developer and may change over time.
The repository README carries the copyright of Jeremy Jamet / Kunzisoft, states the app is a fork of KeePassDroid, describes development as volunteer-based funded by donations that unlock a cosmetic 'Pro' theme set with no security or functional advantage, publishes the SHA-256 signing-certificate digest for GitHub-released APKs, and recommends F-Droid as the install source.
The repository's FUNDING.yml lists Liberapay (user 'Kunzisoft'), a Stripe donation link, a PayPal button and the keepassdx.com donation page as the project's funding channels; no institutional grant, investor or revenue figures are published.
KeePassDX's full source code is published under the GNU General Public License version 3, allowing anyone to inspect, build or fork the shipping application rather than relying on the developer's description of it.
Privacy Guides lists KeePassDX as its Android recommendation in the 'Local Storage' section of its password-managers page, alongside KeePassXC and KeePassium, noting the pro version unlocks cosmetic content and helps fund development.
Kunzisoft's own site (French, copyright 2022) presents itself in the first person as a freelance mobile/web developer offering paid development ('Je travaille sur des projets d'applications web et mobiles'), lists KeePassDX among its open-source works, gives a contact email and says the developer is available remotely or in western France; the page shows no company registration number, legal form or postal address.
The Google Play listing identifies KeePassDX's developer as an individual, Jeremy Jamet, publishing under the Kunzisoft name with a Gmail contact address and a postal address in France; no company, foundation or association is named, and Play lists a separate paid app, 'KeePro Support', from the same developer.
The Backup wiki page states that only non-sensitive app settings (theme, display sizes) are included in Google's automatic Android backup, that KeePass databases, recent-file links and biometric bindings are never backed up by that service, and that the app has no internet permission — the developer notes that monitoring tools which flag Google's backup traffic as KeePassDX 'transferring data' are misattributing Google's own service. It leaves database backup entirely to the user (hard drive, NAS, cloud, Syncthing).
The File Manager and Sync wiki page states that KeePassDX keeps no internal copy of the database to synchronise and stores no data in the app when the database is closed; it acts only as a file editor over Android's Storage Access Framework, so where the .kdbx file lives — local storage, OTG media, or a third-party cloud app — and any network transfer of it is the user's file manager's responsibility, not KeePassDX's. The page also warns that most sync problems come from the cloud app chosen.
The AutoFill wiki page explains that form filling in other apps runs through Android's system-managed Autofill / Credential Provider service, to which KeePassDX hands only the visuals and content to be displayed and filled — a controlled, user-enabled path by which individual credentials leave the app into the OS framework and the requesting app; the wiki flags that browsers such as Chrome need autofill from another service enabled and that the user must confirm trust in the service.
The XXE report was filed openly on the KeePassDX GitHub issue tracker on Oct 24, 2018 (issue #200, pointing at the DocumentBuilderFactory usage in PwDatabaseV4.java) and is closed, showing the project handled the disclosure through its public tracker; the repository has no GitHub security advisories published and no security policy file.
NIST's National Vulnerability Database records one CVE for KeePassDX: CVE-2018-1000835 (published Dec 20, 2018), an XML External Entity flaw in the .kdbx parser affecting versions up to 2.5.0.0beta17, rated CVSS 3.1 10.0 Critical by NVD; it was reported publicly on the project's issue tracker and later versions are not listed as affected — a handled vulnerability disclosure, not a breach of user data.
F-Droid builds and signs the Libre edition from the published source tarball for each version, providing independent build-from-source verification of the distributed binary. No third-party security audit by a named firm, transparency report, funded bug bounty, breach or regulatory action involving KeePassDX was found in this research; the FAQ's statement that code is 'audited at each release' refers to the maintainers' own review, not an external audit.
The project FAQ explains each requested permission by feature (foreground service for in-RAM database actions and the save/sync service; 'query all packages' to open apps from an entry's AndroidApp field; exact alarms for the database-lock timer; biometrics), states there is no advertising even in the free version, and discloses that the Play 'Free' build differs from the F-Droid 'Libre' build by adding two non-libre elements — Steam's non-standard OTP and a Google-defined whitelist of privileged web apps for passkeys — while the Libre build contains no proprietary code and is compiled and signed by F-Droid.
The F-Droid listing for the Libre build (com.kunzisoft.keepass.libre, v4.4.5, added Jun 18, 2026) shows no anti-feature flags and a permission list that contains no INTERNET permission at all — only foreground service (dataSync/specialUse), notifications, query all packages, exact alarms, biometric/fingerprint hardware and vibration; the app is licensed GPL-3.0-or-later and built and signed by F-Droid from the source tarball.