Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep my PC regularly updated, and I have a good internet security program in addition to Malwarebytes.

Obviously, storing the key and password database together isn't recommended, what is the recommended way of storing the database key?

Would keeping the password database on my computer, and the key on a USB drive be secure? When I want to use the database I just plug in my USB, and point KeePass to the location of the key and enter my password.

2 Answers 2


Personally, I would recommend storing the file key on something that has protections in and of itself, such as an Apricorn FIPS 140-2 Level 3 validated flash drive, many of which allow you to set the brute-force protection, i.e. how many bad PINs entered until the drive erases itself.

The FIPS 140-2 Level 3 validation also indicates there are some protections against physically disassembling it to get at the critical security parameters.

Shove that in a nice safe, and you're as good as you can get, except for any file copies your own OS hosting KeePass/Veracrypt takes, of course, but that'll always be the case. Ideally have a KeePass machine be 100% offline, like a Raspberry Pi2 with the ethernet jack full of epoxy and no files moving out at all (again, Apricorn devices wiped via their physical keypad after they're unplugged work).


There are three methods used for authentication: something you know, something you have, and something you are. The first is generally a password. A key file is an instance of the second, something you have. The more of these methods you use together, the more secure your database.

Your issue would be an attacker stealing the key file. Having it on a separate USB is a good plan, but an attacker could still steal it. I always use a password as well a key file.

You might also want to invest in a hardware token, such as Yubikey, if you were really paranoid. That would make it very difficult for an attacker to extract that portion of the key, even if they stole the key itself.

  • Suppose I have a USB with the keyfile + a password, and when not in use I place the USB in a safe. This is for home use, and the people I live with are trustworthy and computer knowledge is limited. My concern is theft(break-ins), so would a safe good enough?
    – user168799
    Jan 18, 2018 at 16:02
  • Unless someone was making a very targeted effort, yes. Someone would have to steal you hard drive and the safe, find your encrypted files, figure out you used key file, and find them on the usb. Not impossible, but unlikely. Jan 24, 2018 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy