KeePassium is a commercial open-source, KeePass-compatible password manager for iOS and macOS made by KeePassium Labs, a Luxembourg-registered SARL (RCS B275042) directed by its founder Andrei Popleteev; the source is published on GitHub under GPLv3 with a commercial-licensing option, and the company states it earns money by selling premium plans rather than data. The app privacy policy states KeePassium does not send any personal data to KeePassium Labs; there is no KeePassium account or server, the encrypted database lives in a file the user keeps locally or in a storage provider of their choosing (iCloud Drive, Dropbox, OneDrive, Google Drive, WebDAV, etc.), and the App Store label reads 'Data Not Collected'. Caveats are structural: the user's chosen cloud provider holds the encrypted database; optional direct-connection sync stores provider API tokens on device; the freemium build talks to Apple's App Store for in-app purchases; opt-in network features are governed by third-party policies; a business-license mode periodically contacts a KeePassium license server; and the marketing website runs Plausible analytics and email pixel tags. Cure53 audited the app in October 2024 (full source, three findings, all fixed, report published) and TAC Security issued a CASA Tier 2 report in July 2024; no breach or regulatory action involving KeePassium was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
The App Store listing (seller: KeePassium Labs; version 2.5) carries Apple's 'Data Not Collected' privacy label, with Apple's standard note that the developer's answers have not been verified by Apple; the listing describes the app as offline by default and open source.
KeePassium's app privacy policy (updated 2025-11-18) states the app does not send any personal data to KeePassium Labs; the only network paths it lists are opt-in — Apple-handled in-app purchases in the freemium build, Apple's opt-in aggregated diagnostics, user-enabled network features, and a periodic license-status sync when a separately purchased business license is used.
The repository LICENSE.txt states the software is distributed under the GNU General Public License version 3, with commercial licensing available on request from the author — the 'commercial open source' model the project describes.
The Impressum identifies the operator as KeePassium Labs, a société à responsabilité limitée at 19 Rue de l'Industrie, L-8069 Bertrange, Luxembourg, registered as RCS Luxembourg B275042 with business authorisation 10149337/0 and VAT LU34630405, directed by Dr. Andrei Popleteev.
The README states KeePassium is created and maintained by Andrei Popleteev, founder of KeePassium Labs; describes it as a commercial open-source app funded by an optional premium subscription; and notes that, due to the GPL/App Store conflict, the project cannot accept outside code contributions and asks that forks not be submitted to the App Store — a single-maintainer concentration of control.
The pricing page publishes the business model in full: a free tier, Premium at €19.99 per year (rent-to-own), Pro lifetime at €79.99, and Business & Intune at €36 per user per year, all sold as App Store universal iOS+macOS licenses.
KeePassium's sync article explains that by default the app reaches cloud storage indirectly through the iOS document picker, so it sees only the selected file and never the user's cloud credentials — meaning the encrypted database is held by whichever storage provider the user chooses (iCloud Drive, Dropbox, OneDrive, Google Drive, WebDAV, etc.); direct connections to certain providers were added in September 2022 as a second-choice fallback.
For the optional direct 'Connect to Server' mode (Dropbox, Google Drive, OneDrive, WebDAV), the app policy states KeePassium uses no third-party SDKs, that all data exchange stays between the device and the user-selected cloud service under that service's policy, that API tokens are stored only in the device keychain, and that KeePassium will not collect or share the data; support email is hosted on Google Workspace and messages are kept to resume support.
KeePassium's security-audits page states Cure53 audited the app in October 2024 with full source code over 10 days, that the most sensitive finding was allowing weak master passwords without warning, that all issues were fixed in the next update, and links the full report; it also reports a July 2024 CASA Tier 2 assessment by TAC Security (score 9.7/10), required for Google Drive API access.
The operator's November 2024 blog post discloses the audit's three findings — no strength checks on unlock passcode/passphrase (High), favicon fetch exposing the account list to traffic analysis (Low), self-DoS via unreasonable key-derivation settings (Low) — states all were fixed with warnings, and candidly notes that a one-version audit cannot prove the shipped binary matches the reviewed code.
KeePassium's 'Why trust' knowledge-base page states the app never phones home, that optional network-dependent features are blocked by default until the user permits them, and that users can verify this with iOS App Privacy Report; it also states the company makes money by selling premium plans, not data.
The separate website privacy policy discloses that keepassium.com uses the Plausible.io analytics service and (per a 2021 update) no cookies, collects standard web-server logs including IP addresses, and that marketing emails may contain a pixel tag revealing opens and IP address — first-party-style telemetry confined to the website and email, not the app.
Privacy Guides lists KeePassium (iOS & macOS) in the Local Storage section of its password-manager recommendations, describing it as a commercial open-source KeePass-compatible manager by KeePassium Labs and noting the October 2024 Cure53 audit.