KeePassXC is a free, open-source, cross-platform desktop password manager that stores credentials in a locally held, encrypted KDBX database file rather than on any operator-run server; there is no account, no cloud service and no subscription. It is developed by the volunteer "KeePassXC Team" (five named maintainers on GitHub, with a German individual listed as the legally responsible contact in the site Impressum), funded by donations, and released under GPL-2 or GPL-3. Its privacy page states that no stored personal data is ever sent to the team or a third party and that the application contacts the internet only on explicit user request; the optional network features (favicon download, Have I Been Pwned range check, browser-extension update check) are documented as opt-in or switchable off. Notable caveats are that database security depends on the user's own sync/backup choices, that there is no legal entity behind the project, and that a 2023 CVE was publicly disputed by the team. Two affirmative verification artifacts were found: an independent code review by Zaur Molotnikov completed 19 January 2023 (v2.7.4) and a French ANSSI first-level security certification (CSPN 2025/16, evaluated by Synacktiv) issued 17 November 2025 for v2.7.9.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-11-17]
The French National Cybersecurity Agency's certificate ANSSI-CSPN-2025/16, signed 17 November 2025, certifies KeePassXC version 2.7.9 (product category: secure storage; developer: KeePassXC Team) under its first-level security certification scheme; the evaluation was commissioned by ANSSI itself, performed by the evaluation centre Synacktiv, is valid three years, and is recognised by Germany's BSI under the BSZ/CSPN mutual-recognition agreement.
The project README describes KeePassXC as storing usernames, passwords, URLs, attachments and notes in an offline, encrypted file that the user may keep in any location of their choosing, including a private or public cloud folder -- the operator itself never holds a copy of the database.
KeePassXC's privacy page states that the desktop application and its browser extension run locally on the user's computer and that at no time is any stored personal data sent to the KeePassXC team or to any third party; there is no account and no operator-side storage.
KeePassXC's team page states the project is run by five maintainers identified by their GitHub handles (droidmonkey, phoerious, hifi, louib, varjolintu), and its Legal Info / Impressum names Janek Bevendorff at a street address in Weimar, Germany as the legally responsible contact; there is no company, foundation or registered association named anywhere on the site.
KeePassXC's donate page discloses that the project is funded by voluntary donations to cover hosting, tooling, CI, code-signing certificates and macOS developer fees, routed through PayPal, Patreon, GitHub Sponsors for three individual developers, LiberaPay, Open Collective, cryptocurrency addresses and a SEPA bank account held in an individual maintainer's name -- there is no legal entity, published budget or institutional funder.
The README in the public GitHub repository (keepassxreboot/keepassxc) states that KeePassXC code is licensed under GPL-2 or GPL-3, so the complete running source is open to inspection, audit and forking rather than resting on the operator's description alone.
KeePassXC's privacy page states that the only data it collects at all is anonymised website-visit statistics, which are used for statistical purposes only and not shared with any third parties, and that the application itself never sends stored personal data to the team or a third party -- there are no vendors, partners or subprocessors touching user credential data.
KeePassXC deliberately ships no built-in cloud synchronisation; its FAQ tells users who want multi-device sync to place the encrypted database in a Dropbox, Google Drive, OneDrive, ownCloud or Nextcloud folder and to keep any key file separate -- meaning whether and where the (encrypted) database leaves the device is entirely the user's own choice and exposure, not the operator's.
KeePassXC maintains a Security Audits and Certifications page listing two independent reviews: an ANSSI Security Visa (ANSSI-CSPN-2025/16) dated November 17, 2025 and valid until November 17, 2028 for KeePassXC 2.7.9 on Windows 10, and an Application Security Review by Zaur Molotnikov dated January 19, 2023 against 2.7.4 source; the page notes reviews are bound to specific versions and do not constitute an endorsement.
On 15 April 2023 the KeePassXC team published an independent audit by security consultant Zaur Molotnikov, completed 19 January 2023 against KeePassXC 2.7.4 and conducted free of charge; the excerpted findings state the reviewer could discover no major problems in database reading/writing and cryptography, while flagging that memory deallocation could be improved so secrets do not remain after the database is locked. No breach or regulatory action involving KeePassXC was found in this research.
The French National Cybersecurity Agency's certificate ANSSI-CSPN-2025/16, signed 17 November 2025, certifies KeePassXC version 2.7.9 (product category: secure storage; developer: KeePassXC Team) under its first-level security certification scheme; the evaluation was commissioned by ANSSI itself, performed by the evaluation centre Synacktiv, is valid three years, and is recognised by Germany's BSI under the BSZ/CSPN mutual-recognition agreement.
The privacy page discloses the two remaining network touchpoints: the KeePassXC-Browser extension has an automatic update check that contacts GitHub only to look up the latest version, which is optional and can be turned off in settings; and the project website itself uses a self-hosted Matomo instance with IP addresses truncated (first 2 bytes IPv4 / 6 bytes IPv6), a 90-day log retention, and an opt-out link -- no third-party analytics vendor.
Privacy Guides lists KeePassXC in its Local Storage category of recommended password managers; the page's minimum criteria require that all non-essential telemetry be optional and its best-case criteria that telemetry be opt-in or not collected at all and that the software be open source.
KeePassXC's Have I Been Pwned report, when the user runs it, queries the HIBP range API (api.pwnedpasswords.com/range/) using only the first five hexadecimal characters of each password's SHA-1 hash (the k-anonymity model) and matches the remainder locally; the source comments also state the request User-Agent is deliberately reduced to "KeePassXC" without version or platform to minimise what is exposed -- so full passwords or hashes never leave the machine.
KeePassXC's FAQ states the application needs network access only for the optional, opt-in download of website favicons for entries, that it will never access any network resource without the user's explicit prior consent, and that users can compile the program without any networking code at all (CMake -DWITH_XC_NETWORKING=OFF).