KeePassXC Download: Install the Offline Password Manager Safely

The official home of the project is keepassxc.org, and every build is listed on its download page. The source code and release notes live in the project's GitHub repository, which the website links to. At the time of writing (2 November 2026) the current stable release is KeePassXC 2.8.0, which the team announced on its blog on 21 October 2026, a month after the 2.8.0 beta.

Because a password manager holds the keys to every other account you own, the download source matters more here than for almost any other program. A tampered build could quietly copy your master password. Type the domain yourself or use the links on this page, and ignore search ads and file-hosting sites that offer "KeePassXC setup" downloads. The download page also offers snapshot builds; the team warns that these contain the newest features but are cutting-edge and have bugs, so most people should stay on the stable release.

The download page lists more options than most apps, so here is how they map to real setups:

• Windows 10 and 11: an MSI installer or a portable ZIP, each in x64 and ARM64 versions. Pick ARM64 only if your PC has an ARM processor, such as a Snapdragon laptop. The page also lists the Microsoft Store, winget and Chocolatey.
• Windows 7, 8 and 8.1: a legacy x64 installer is still listed, but the page notes it is no longer supported after version 2.7.12. Treat it as a stopgap while you move to a supported system.
• macOS: separate DMG files for Apple Silicon and Intel Macs, with the headline build aimed at macOS 12 and later. Homebrew users can install the cask instead, and MacPorts is listed for macOS 11 and older.
• Linux: the Flatpak from Flathub is marked as recommended and updates automatically. An AppImage (x86-64 and AArch64), a Snap, an Ubuntu PPA and packages for Debian, Fedora, Arch, openSUSE, Alpine, Gentoo and RHEL-family systems are also listed.

The Windows builds need the Microsoft Visual C++ Redistributable, which the download page links to on Microsoft's site. If KeePassXC refuses to start with a missing DLL message, our guides to the VCRUNTIME140.dll missing error and the MSVCP140.dll missing error walk through the fix. Not sure whether to install or run portable? Our portable vs installer guide explains the trade-offs; the short version is that the MSI suits a personal PC, while the ZIP suits a USB stick or a work machine where you cannot install software.

Version 2.8.0 is the first stable release of the 2.8 series. According to the project's release post and GitHub release notes, the main changes are:

• The move from Qt 5 to Qt 6, the toolkit that draws the interface.
• Auto-Type on Linux under Wayland, through XDG desktop portals.
• Configurable keyboard shortcuts.
• Remote database synchronization and import using external tools.
• Quick unlock with a password on macOS and via Polkit on Linux.
• Native ARM64 builds for Windows and an AArch64 AppImage for Linux.
• Several security fixes, including a use-after-free when importing crafted KDB files and out-of-bounds write fixes in browser native messaging.

The security fixes are a good reason to update rather than keep an old copy. If you installed through the Microsoft Store, Flathub, Homebrew or a Linux package manager, updates arrive through that channel; if you used the MSI or a DMG, download the new version from the official page and install it over the old one. Your database file is separate from the program, but make a copy of it before any major upgrade.

KeePassXC publishes a PGP signature and a SHA-256 digest for every download, and its verifying signatures page explains three levels of checking:

1. Operating system signature. When you run the Windows MSI, the User Account Control prompt should show DroidMonkey Apps, LLC as the verified publisher. On macOS, the system checks the Apple Developer ID signature when the app launches.
2. PGP signature. Import the project's public key with GnuPG (Gpg4win on Windows), confirm the fingerprint matches the one printed on the official page, then run gpg --verify on the downloaded .sig file and look for "Good signature". If the check fails or the fingerprint differs, do not install.
3. SHA-256 digest. Comparing the hash with the .DIGEST file shows the download is complete and uncorrupted. The project points out that this proves integrity, not authenticity, so it does not replace the signature check.

One detail catches people out: the portable Windows ZIP has no Authenticode signature, so the PGP check is the way to confirm it. If hashes and signatures are new to you, read what a checksum is and our step-by-step guide on how to verify downloaded files.

KeePassXC stores everything in a single .kdbx file. The project's getting-started guide describes it as an offline, encrypted file that can be kept in any location, and the contents stay encrypted inside the file at all times. A sensible first setup looks like this:

1. Open KeePassXC and choose to create a new database.
2. Give it a name and, unless you know why you want to change them, keep the default encryption settings.
3. Set a long master password or passphrase that you have never used anywhere else. Optionally add a key file or a hardware key such as a YubiKey for a second factor.
4. Save the .kdbx file somewhere you will back up.
5. Add a few entries, use the built-in password generator for new accounts, and gradually replace reused passwords.

There is no "forgot password" button. Nobody, including the developers, can open your database without the master password and any key file you added. Write the master password down and store it somewhere physically safe until you know it by heart, and keep at least one copy of the database on another drive. Our backup software guide covers tools that can do this automatically.

KeePassXC can fill logins in your browser through the official KeePassXC-Browser extension, available for Firefox and Chromium-based browsers such as Chrome and Edge. You enable browser integration in KeePassXC's settings, tick the browsers you use, install the extension from the browser's own add-on store, and then connect it to your open database. The extension can only read entries while the database is unlocked.

Auto-Type is the other way to fill credentials: KeePassXC types the username and password into the active window for you, which also works in desktop apps. The FAQ says Auto-Type works on all three supported platforms; until 2.8, Linux support was limited to X11 sessions, and the 2.8 release adds Wayland support through desktop portals. KeePassXC also generates time-based one-time passwords (TOTP) for sites that use two-factor codes, although keeping your 2FA codes in the same vault as your passwords is a trade-off between convenience and security that you should make deliberately.

KeePassXC has no built-in cloud service. The FAQ's advice is to put the database file in a folder that a sync service such as Dropbox or Nextcloud already manages, and let that service copy it between computers. The file is encrypted before it leaves your device, so the sync provider only ever stores ciphertext.

There is also no KeePassXC mobile app. The team states that it does not have its own mobile app and explains that a port would require a full rewrite. Its documentation instead names KDBX-compatible apps by other developers: KeePassDX and KeePass2Android on Android, and Strongbox and KeePassium on iOS. These are separate projects with their own developers and terms, so install them only from Google Play or the App Store and read their own documentation. Any "KeePassXC APK" offered on a download site is not from the KeePassXC team.

The names are confusing, so here is the family tree according to the KeePassXC FAQ. KeePass is the original program, written in C# and dependent on .NET; its own site lists KeePass 2.61.1 for Windows 7 to 11, with Mono needed on Linux and macOS. KeePassX was a cross-platform rewrite that is no longer developed. KeePassXC began as a community fork of KeePassX, is written in C++ and runs natively on Linux, macOS and Windows. All three read the KDBX format, so you can move a database between KeePass and KeePassXC, though plugin-based features from KeePass do not carry over.

Bitwarden is a different model: an open-source, cloud-synced service. Its pricing page says the free plan includes unlimited passwords on unlimited devices, passkey management and sharing with one other user. That makes it more convenient across phones and browsers, at the cost of trusting a hosted service. KeePassXC suits people who want full control of a local file and are happy to manage sync and backups themselves. Neither choice is wrong; the worst choice is reusing passwords. Our password manager guide compares more options.

KeePassXC is licensed under the GPL v3, its source code is public, and the documentation page links an independent security review report completed in January 2023. When the database is open, the getting-started guide notes that the data is decrypted in memory and the app restricts other programs from reading it unless they have administrator rights. No software can promise zero bugs, which is why the 2.8.0 security fixes matter, but an open project with published reviews and signed releases is a solid foundation.

In practice, your safety depends on three habits: download only from keepassxc.org or the stores it lists, keep the app updated, and protect your master password and backups. Run a malware check on the PC itself too, since no password manager can protect you from a keylogger already on the system; our guide to scanning downloads for malware shows how.