Features
KeePass is incredibly customizable and, thanks to plugins, packs many of the features we would want from a password manager. There’s a share password option, auto-typing, multiple MFA methods and the ability to import/export data to various file formats alongside a whole host of upgrades and add-ons to fit your needs.
While KeePass is user-friendly, it belongs to an older era of software development that assumed users possessed some basic computer knowledge. However, this expectation may not hold true in today’s era of software products that aim for effortless usability. The high customizability of the app comes with an attendant learning curve that some users might not want to engage with.
The interface might also be a pain point for some people. The app was initially developed in 2003, and the interface looks it. Not everyone will be accustomed to that sort of UI these days, but I found it refreshing.
In more ways than one, KeePass feels like it was ripped from a different time in the best way. The software is community-driven, meaning that even if the base software lacks some feature you want from a password manager, there’s probably a plugin someone’s developed that does the job. For example, want to enhance the auto-type feature? There’s a plugin for that. Want to add the TwoFish encryption algorithm to KeePass? There’s a plugin for that. Want to import passwords from 1Password to KeePass? There are at least two plugins for that.
This kind of free, open-source, community-maintained software just doesn’t normally get the sort of market penetration it used to. KeePass has managed to hold on to its place in the password manager game since 2003, and I think that’s kind of great. I wish the tech landscape had a lot more apps like KeePass taking up space.
Pricing
KeePass is the only 100% free password manager on our list. Other password managers have free versions, but these have more limited features than the paid plans. Not so with KeePass, which provides all of its features for free. For many products that I’ve covered, I generally caution users to stay away from 100% free software, but KeePass lacks many of the potential risks I would associate with free software, such as a developer harvesting and selling your data like AVG and Avast did with their free antivirus software.
Howard Poston, our advisory board member, also appreciates that KeePass is free: “If there’s a password manager feature that you want, KeePass probably has it. Even better, it’s free.”
Trustworthiness
I’ll begin by discussing the cons of KeePass. As with all software, KeePass is not immune to bugs and security weak points. The KeePass2Android app was discovered to have the same autofill security vulnerability as Dashlane and 1Password, but no data breaches exploiting that vulnerability have been discovered. Additionally, in May 2023, a proof-of-concept for an exploit on KeePass’s desktop app was released, where a hacker could steal a KeePass user’s master password via memory dump. However, this vulnerability relied on the victim’s computer already being compromised.
There’s also the fact that it’s a community-driven piece of software. While I love this about KeePass, it can lead to awkward situations where people might just stop updating it one day, and the app slowly loses compatibility with modern devices. There’s also the stranger aspect, where you might not want to trust a random person’s KeePass plugin because they don’t have to be compliant with any legal bodies to put out that plugin the way a company ostensibly has to be.
These are valid concerns, though I do think that any piece of software that’s been actively maintained since I was in elementary school is probably not in any danger of shutting down anytime soon, barring a sudden legal crackdown on password managers. And while there is a level of trust you have to place in the community members who develop plugins for KeePass, these plugins are generally regulated by the community itself.
All that said, KeePass is, in my eyes, one of the more trustworthy password managers, thanks to being both open-source and locally hosted. Unlike LastPass, for example, there are no external servers to hack. The data is saved on your device. While your device might not have the security infrastructure in place of a LastPass or a 1Password, you will likely be a much smaller target for a hacker than these providers. And any hackers that do come your way will probably be using social engineering schemes like phishing instead of the hacking style you see in Hollywood where the bespectacled computer guy types for a few seconds before declaring, “I’m in.”
Overall, KeePass is one of my most trustworthy password management solutions. While there are vulnerabilities that can be exploited, none of them are so glaring that I wouldn’t use the software myself.
Learn more: Read our full KeePass review.