Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Currently I'm using KeePass as my sensitive data manager. I use just a main password to encrypt the database, but it is not very secure: 9 characters, lower letters and numbers mix with no meaning. Something like bwkvu5m8i

I want to increase the security of the database, without sacrificing usability much. The only additional option in KeyPass is to use a key file, which I can store on an external USB flash drive and plug it into the PC whenever I want to unlock the database. Knowing myself I will probably keep it plugged in 24/7, thus not being much different than storing the key file on the internal hard drive.

So are there any other options that doesn't make using KeePass very cumbersome?

My main concerns are keyloggers or trojans - I am an advanced user and would definitely not open any unknown files, regardless of their origin, but still I'm have the fear of being compromised. Is that even possible?

share|improve this question
Maybe you should be looking for apps that use smartcards. –  ott-- Sep 22 '13 at 23:21
Do not fixate yourself upon complex passwords. Simple password can be equally secure. See here: explainxkcd.com/wiki/index.php/936:_Password_Strength –  Josua Schmid Apr 17 at 9:25

5 Answers 5

up vote 4 down vote accepted

There are ways to increase the difficulty of retrieving the KeePass master password, such as setting it to allow entry on the secure desktop only.

To prevent someone from getting your KeePass database file and performing brute force on it, you can also increase the AES iteration count that KeePass does during the master password derivation process, so as to increase the effort require to brute force the master key.

There is also an option to set two channel obfuscation during auto type when KeePass does the typing of the username and password for you. It should prevent crude key loggers from retrieving the specific password you use for that site.

To prevent malicious access to the KeePass database in the first place, keep your computer secure. You know the drill: install AV software, keep your computer OS and software updated, have a firewall and review logs regularly etc.

Finally, increase the entropy and length of the master password used. Instead of 9 characters, how about 13+? Instead of just lower letters only, what about including uppercase and even a special character or two too? The more unpredictable and longer your password is, the longer it will take for your attacker to brute force the database master key.

share|improve this answer
I am very proactive at keeping my machine secure, but you never know. I've always wondered if a Windows machine that is fully updated and secured by AV + Anti malware can get infected, without human error? I remember long time ago back in the Windows 98 days there were viruses like Blaster and Sasser that were able to infect a machine automatically, without the user actually doing anything. So If I don't open any unknown files can I get infected? –  user2247336 Sep 23 '13 at 11:43
Its hard to say really. Even if you go only to legit sites they could be infected with malware surreptitiously inserted by crackers. Even your friends could send you files that are legit with a legit context, but have been infected with malware because their computer is infected by it. And then there are zero-days etc. So keeping your machine secure can reduce, but not completely eliminate, your chances of infection. –  Nasrus Oct 8 '13 at 13:59

There's no way to sugar-coat this one. A malware/keylogger installed on your computer means that your passwords are exposed. That's it, there's no way around it.

A malware/keylogger will log your master password, intercept the clipboard, somehow access the decrypted database in memory, etc.

share|improve this answer

You could try to set up some kind of OTP Solution additionally to the password you store in keepass or as a substitute.

A rather affordable one could be yubikey (http://www.yubico.com/products/yubikey-hardware/yubikey/).

You can do stuff like exchanging a linux PAM with a yubico one and use a yubikey to logon to a linux box and so forth...

This is not advertising, rather an affordable otp example. Maybe not a solution for every keepass usecase but if you store system credentials in keepass you could add a layer of security to them....

Edit: Also as mentioned use a lot more than 9 digits. Use something long and complex which is still good to type, like a long sentence with some extra special characters in it. Dont do simple stuff like swapping an e with a 3. There are bruteforce plugins for that kind of stuff. Just add random sings at the end/beginning and or middle...

Edit2: just found this: http://keepass.info/help/kb/yubikey.html see the otp part at the end. I cannot promise you that this is a proper and secure otp implementation and that the plugin is without flaws. However the theory sounds good and its a good starting point to do some research on it or look for some alternatives like this.

Edit3: a free alternative to yubikey would be google authenticator app for ios or android which should work fine with keepass OtpKeyProv plugin accroding to a link i just found but am not allowed to post since i am missing 10 reputations ;) Just google for it.... (again i cannot promise that the OtpKeyProv implementation is flawless....)

share|improve this answer
Very good suggestions. Thank you. I have some questions though: when using a Yubikey does the Keepass database know about it? Or simply put if somebody steal my database and know my master password, will they be able to open it without the Yubikey? If not then I assume some additional encryption information is added to the database? –  user2247336 Sep 24 '13 at 0:19
2nd Question: Do you know if I can protect myself from losing my Yubikey? For example when using Google Authenticator I have an Authentication key or a QR code backed up, so if I lose my phone I can setup the authenticator again and gain access to my accounts. Can I print something on a piece of paper, so if I lose my Yubikey I can re-gain access? Do I need to buy another Yubikey or can use something else to gain access until my new Yubikey arrives? Thank you for your time :) –  user2247336 Sep 24 '13 at 0:19
I think there is still a recovery mode where you can access the database with a recovery/master password. However you could set a ridicules long one (as you use an otp to access keepass) which you store somewhere in printed form in a safe or another safe place. Depending on how paranoid you are this might or might not be an option ;) –  Sebastian B. Sep 24 '13 at 17:56
Regarding Backup: YubiKey seems to be just a cheap openauth hardware implementation. The Yubico website says its possible to order identical keys for backup purposes so you can keep one safe. Also it might be possible to set up an identical google Authenticator token as Backup/alternate Token. You can probably direct those questions to the OtpKeyProv developer or the SourceForge forum. –  Sebastian B. Sep 24 '13 at 17:59

Nasrus has given pretty good suggestions.

Additionally; I don't know if you are already doing that way, but you can use KeePass on a Linux machine which would be safer.

Ubuntu or Debian would be fine, but if you are very concerned, you can try Tails which aims at preserving your privacy and anonymity by focusing on the security.

share|improve this answer
I use Windows 7 Professional, which I believe is adequately secured, but still I have my concerns. I had plans to install Ubuntu for dual boot, but never get around to doing it. –  user2247336 Sep 23 '13 at 11:37
I haven't tried myself yet but Tails can be run in a USB stick, without altering your existing operating system. In addition, I use dual booting with Ubuntu & Windows in one of my machines and I totally recommend it. –  Kerim Oguzcan Yenidunya Sep 23 '13 at 11:54
What do you use Ubuntu for? –  user2247336 Sep 23 '13 at 12:01
Software development, personal, all kinds of stuff ;) –  Kerim Oguzcan Yenidunya Sep 23 '13 at 12:06

Which is your main threat?

  1. For most it might me trojan / keylogger software looking for easy money. Some keyloggers detect when you open Keepass and then steal password and database.

    • Secure your computer. Offline device/phone could be option.
    • Avoid writing information you will remember. You can write email1 or companyemail2 instead of your actual email.
    • Write password always with help of mouse and in wrong order. This will block simple keylogger.
    • A keyfile might block simple keyloggers.
    • Keepass and database inside offline virtual machine would block average keylogger from stealing database.
  2. Someone wants to go through effort to brute force your database or database is in public.

    • Choose long random password and use keyfile.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.