Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

It certainly would be more convenient to store my KeePass database on either S3, Dropbox, or better yet SpiderOak. My fear is having my cloud storage account compromised then having the credentials recovered by either brute force or some other attack vector. How safe is this? What risks do I need to know about?

share|improve this question

6 Answers 6

up vote 6 down vote accepted

It is hard to quantify exactly, but if you have the DB on a mobile device then I wouldn't say this is particularly any less secure. KeePass encrypts the DB because the file remaining secure isn't expected to be a guarantee. It's certainly preferable that the DB file not get in the wild, but if your security depends on the encrypted file remaining confidential, then you have bigger problems than whether to use cloud storage or not.

A sufficiently strong master password should prevent brute forcing at least long enough for a breach to be detected and for you to change the passwords within it. In this way, it may even be slightly preferable to having a local copy on a mobile device as someone may compromise the file if you take your eyes off your device even momentarily and it would be much harder to identify that breach occurred.

Personally, I'd probably end up using my OwnCloud (which is self hosted), but I have the advantage of having my own personal web server and I realize that's not an option everyone can take advantage of. (The only reason I haven't is that I don't have a particular need to coordinate a key database in that manner.) Something public cloud based service should work as a fine second alternative though.

share|improve this answer

I use the KeyPass-Dropbox combination. The password database is cryptographically protected using a key derived from a strong master password. Even if somebody acquires your encrypted password database through your cloud account, a strong enough master password renders brute-force attacks infeasible.

Simply put: Use a strong master password and stop worrying about this.

share|improve this answer

The cloud is inherently untrustworthy, and files kept on it should be considered vulnerable, so you need strong encryption to protect you. KeePass offers that. However, you then need to be able to trust every client you enter your password into. If you read them on an iPhone, do you trust the platform? Do you shield your password from the cameras on the subway when you enter it, every time? How about your laptop?

You also need to consider the value of what you're protecting. Is this safeguarding your retirement funds? Your fantasy bowling league scores? Political dissention that is illegal in your country? For some cases it's simply not worth the risk of making a mistake.

So yes, as long as you trust KeePass, and trust your devices, and trust your ability to keep your master key secured, don't worry about keeping the database in Dropbox.

share|improve this answer

Even if your KP database were to be compromised from Dropbox, using both a strong password, and additionally a keyfile not stored in Dropbox should give you security beyond any known means of electronic attack (as long as your devices aren't already compromised).

The keyfile should be stored in a separate secure location, such as a USB drive which you can secure physically. This provides 3 layers of protection:

  1. Dropbox account (assume low security)
  2. Your strong password (strong)
  3. Your keyfile (as secure as you make it)
share|improve this answer

You can increase the resiliency of your KeePass database to brute force by increasing the number of PBKDF2 iterations when deriving the database encryption key from your password. You can do this in KeePass under File > Database settings > Security. Personally, I use around 5,000,000 rounds (1 s delay). Remember that mobile devices are slower.

share|improve this answer
This is actually the best answer. In fact, what @Matrix suggests is crucial to secure a KeePass database. By default it is set to 6000 encryption rounds, which is insufficient to thwart a bruteforce attack. I don't understand why I'm the only one to upvote this answer. –  dr01 Jul 14 at 9:02

If a group is able to compromise a cloud service enough to discover that you have a kdb to be cracked, they may have more motivation to plant a key logger/root kit on your personal devices. Of course, if such a group can see you downloading the software from sourceforge or an app store, they obtain similar information. In fact, this post is a much easier tip-off, so concern for this attack vector may be for individuals more paranoid than ourselves.

share|improve this answer
I'm not sure that this is an answer. –  schroeder Sep 20 '14 at 17:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.