KeePass

KeePass is a free and open source password manager that allows you to store credentials in an encrypted database, without relying on the cloud.

Installing and Configuring KeePass

Download and Installation

KeePass is available for Windows, but there are also versions for macOS and Linux. To install it:

1. KeePass (para Windows)
2. KeePassX (para Linux y macOS)
3. KeePassXC (multiplataforma: Windows, macOS, Linux)
4. KeePass Portable (para Windows)
5. KeePassDroid (para Android)
6. MiniKeePass (para iOS)

Creating and Organizing Passwords

  • Open KeePass and select “New Database”.
  • Choose a strong master password (long and complex, but one you can remember).
  • Organize credentials into groups (example: “Social Networks”, “Banks”, “Work”).
  • Use the password generator to create strong passwords for each account.
  • Save and backup your database.

Encryption Algorithms in KeePass

KeePass uses several high-level encryption algorithms to ensure that your data is protected. Below I explain in detail the main algorithms used:

1. AES-256 (Advanced Encryption Standard)

  • AES is the most widely used symmetric encryption standard in the world, and is widely recognized for its security. The “256” in AES-256 refers to the length of the encryption key (256 bits), making it one of the strongest options available. AES-256 is considered “impenetrable” with current technology. In fact, it is used by governments and security organizations to protect sensitive information.
  • Usage in KeePass : AES-256 is the default encryption algorithm in KeePass.

2. Twofish

  • Twofish is a symmetric encryption algorithm, an alternative to AES. It was one of the finalists in the selection process to become the US government’s encryption standard (although AES ultimately won). Twofish uses keys of up to 256 bits and is known for being very fast and efficient, as well as highly secure.
  • Usage in KeePass : Twofish is an alternative encryption option in KeePass. If you prefer not to use AES-256, you can choose Twofish to protect your database.

3. PBKDF2 (Password-Based Key Derivation Function 2)

  • PBKDF2 is a key derivation algorithm used to make passwords harder to crack in brute force attacks. This algorithm takes the master password and “derives” it through a repeated and expensive process, which significantly slows down attack attempts. Increasing the number of iterations in PBKDF2 increases the time required to perform a brute force attack, making it more difficult and expensive. It is very effective against dictionary and password challenge attacks.
  • Usage in KeePass : PBKDF2 is used to protect the database master key. When generating a key to encrypt the database, KeePass uses PBKDF2 to ensure that the key derivation process is slow enough to deter attacks.

4. Argon2

  • Argon2 is a modern, highly secure key derivation algorithm that was created to replace PBKDF2 and bcrypt. It was specifically designed to be resistant to attacks using specialized hardware, such as those using GPUs (graphics processing units) and ASICs (application-specific integrated circuits), which are common in massive brute force attacks. Argon2 is considered one of the most secure key derivation algorithms available. It is more flexible than PBKDF2, allowing memory usage, timing, and parallelism to be tuned to suit different security scenarios.
  • Usage in KeePass : Although KeePass does not use it by default, you can choose Argon2 as your key derivation algorithm if you prefer. It is recommended for users looking for even more robust protection against advanced attacks.

5. RSA (Rivest-Shamir-Adleman)

  • RSA is an asymmetric (public-key) encryption algorithm that uses two keys: a public key (for encryption) and a private key (for decryption). Although it is primarily known for its use in digital signatures and secure key exchange, it is also used to protect data integrity and privacy. RSA is considered very secure when used with long keys (e.g. 2048 bits or more). However, its use has declined in favor of other algorithms such as ECC (Elliptic Curve Cryptography), which offer similar levels of security with smaller, more efficient keys.
  • Usage in KeePass : KeePass does not use RSA directly for database encryption, but it is useful for other security operations, such as in some plugins or two-factor authentication (2FA).

6. Bcrypt

  • Bcrypt is a key derivation algorithm similar to PBKDF2, but specifically designed to be slow, making it resistant to brute-force attacks. It uses a “cost” approach that allows computation time to increase, making decryption attempts increasingly slower. Bcrypt is resistant to dictionary and brute-force attacks, especially when high cost values ​​are set. It is a very popular choice for storing passwords on web servers due to its security.
  • Usage in KeePass : Although not used by KeePass by default, Bcrypt is an option that can be enabled in some KeePass configurations to derive the master key.

Overview of Algorithms in KeePass

  • AES-256 : Main encryption, very secure and used for the database.
  • Twofish : Alternative to AES, also very secure and efficient.
  • PBKDF2 : Used to protect the master key, very effective against brute force attacks.
  • Argon2 : Modern alternative to PBKDF2, more secure against attacks with specialized hardware.
  • RSA : Asymmetric encryption for authentication and signature operations.
  • Bcrypt : Optional for key derivation, effective in high security situations.

With these algorithms, KeePass offers high-level protection, ensuring that your passwords are effectively encrypted and protected. The combination of strong symmetric encryption (AES-256, Twofish) and key derivation algorithms such as PBKDF2 and Argon2 provides a solid defense against unauthorized access attempts.

Other interesting functions

1. Encryption of Additional Files and Folders

KeePass is primarily used to store passwords, but you can also store files within your database, allowing you to encrypt sensitive documents such as text files, spreadsheets, or any other type of file.

This can be especially important for those who handle confidential files, such as contracts, financial documents, or sensitive personal data, and want to keep everything within one secure system.

You can attach files to KeePass entries, and these will be encrypted along with the passwords. This way, access to the files will only be possible if you have access to the encrypted KeePass database.

2. Using KeePass on Mobile Devices

KeePass has mobile apps (such as KeePassDroid for Android and MiniKeePass for iOS) that allow access to the KeePass database from mobile devices. Although the official version of KeePass is not available for these operating systems, these apps allow you to use the database file on smartphones.

The experience isn’t as seamless as on the desktop, so having access to your passwords on the go can be essential, especially if you use complex passwords and need access to them from different devices.

Be sure to encrypt your database file with a strong master key before syncing between devices, and consider using encrypted sync tools (such as Syncthing or Tresorit) to keep your database secure on mobile devices.

3. Integration with Multi-Factor Authentication (MFA)

Although KeePass does not directly implement multi-factor authentication (MFA), you can use plugins like KeePassOTP or combine KeePass with 2FA apps to add an extra layer of security to your database access.

MFA is one of the most effective ways to protect your accounts. By adding an additional authentication token on top of your master password, you ensure that even if someone gains access to your database, they will still need the second factor to access the information.

Use KeePass with a plugin or external 2FA system to ensure even stronger authentication.

A clarification:

Multi-factor authentication (MFA) and two-factor authentication (2FA) are related, but not exactly the same.

2FA (Two Factor Authentication): It is a specific form of MFA , where exactly two factors are required to authenticate you. These factors are usually:

  • Something you know – like a password or PIN.
  • Something you have – such as a code sent to your phone (SMS or authenticator app) or a physical security card.

The goal of 2FA is to add an extra layer of security to the login process, ensuring that even if someone obtains your password, they won’t be able to access your account without the second factor.

MFA (Multi-Factor Authentication) :It is a broader concept that includes two or more factors for authentication. MFA can involve three factors, for example:

  • Something you know (password or PIN),
  • Something you have (a phone or physical device),
  • Something you are (biometrics, such as fingerprints, facial recognition, etc.). MFA is not limited to just two factors, but can include more, making it an even more robust and flexible approach to securing accounts.

Summarizing:

  • 2FA is a specific type of MFA that involves exactly two factors .
  • MFA is a broader concept and may involve two or more factors .

Both methods seek to improve security through multi-layered verification, but MFA is more flexible and can include more security factors than 2FA.

4. Data Backup and Recovery

Make sure to regularly backup your KeePass database to secure, encrypted storage. Storing backups on physical devices (such as an encrypted USB stick) or cloud storage services (such as Nextcloud, instead of Dropbox or Google Drive) is a good practice to protect your data.

If you lose your database or master password, having a backup is vital to ensure you don’t lose access to your credentials. Additionally, having multiple backups ensures you can restore your database in the event of a disaster.

Make sure backups are encrypted and stored in a secure location, preferably offline, to minimize the risk of unauthorized access.

5. Physical Security and Use of External Devices

If you use KeePass in a shared work environment or on a device that can be used by others, consider storing your database on a physical device such as an encrypted USB drive (for example, with BitLocker or VeraCrypt) that only you can access. You could also use a hardware password manager such as a YubiKey or Smart Card.

If someone can physically access your device, they could potentially obtain your passwords. Using a physical device with biometric authentication or PIN increases security.

In addition to encrypting your database, make sure the device you store your passwords on is also protected with strong passwords and encryption technologies.

6. Uso de KeePass con Tails OS

Tails OS is an operating system designed for privacy and anonymity. It comes with KeePass built-in, allowing you to use KeePass more securely while browsing anonymously.

By using Tails OS together with KeePass, you not only keep your passwords encrypted, but you also browse the internet safely and without leaving a trace. Tails uses the Tor network to anonymize your traffic, making it an ideal choice for those seeking maximum privacy.

If you want to further secure your privacy, consider using KeePass in conjunction with Tails OS to manage passwords and browse anonymously and securely.

7. Disadvantages and Limitations of KeePass

It’s important to be aware of the limitations in order to manage expectations. KeePass is ideal for those who prioritize security over convenience, but it might not be suitable for those looking for a simple, automated solution for all their password management needs.

If you prefer a more integrated solution, you might consider options like Bitwarden or Vaultwarden , which offer automatic cloud syncing and additional security features, albeit at the cost of a higher level of reliance on third parties.

KeePass Plugins and Integrations

KeePass can be extended with multiple plugins. Some of the highlights are:

Security Tips for Using KeePass

  • Use a strong master password : A combination of uppercase, lowercase, numbers and symbols.
  • Enable two-factor authentication (2FA) if you use KeePass in combination with other systems.
  • Save a backup of the database to a secure USB or encrypted storage.
  • Avoid sharing the database on cloud services without first encrypting it.
  • Update KeePass and its plugins regularly to maintain security.

Conclusion: Is KeePass Worth Using?

If you prioritize security, privacy, and complete control over your passwords, KeePass is one of the best options available. Although it requires more configuration than cloud-based password managers, it offers unparalleled protection and the peace of mind that your data is never in the hands of third parties.

For more information, visit the official KeePass website: https://keepass.info or better: https://keepassxc.org/docs/