I want to start using keepass to set and get my passwords. To always get access to them I thought about using keepass-portable on an USB-stick. So I would have an USB-stick with a the program keepass-portable, my password-database and my keyfile on it. When I am on any computer, I have to put the stick in to get to one of my password. When using my android-phone, I would use the keepass-app and need the keyfile stored on the phone-sd-card. My problem is, that everything you need is on that USB-stick/phone. So if I loose it or my android-phone, the one who finds one of this would have my database AND my keyfile. Shouldn't keyfile and database be seperated? But how do I use such an USB-stick or my then when in front of a foreign computer?

2 Answers 2


Yes, you should keep your keyfile separate from the database.

But the keyfile does not change often (if at all), so you don't need to keep moving it around with you in a vulnerable manner - just load it ONCE on each device, and that device will remain authenticatable.
You can do this manually - consider it a "device registration" process, and do it any manual way you want, just don't leave copies of the keyfile floating around anywhere EXCEPT the registered devices.
You can keep carrying the database file around with you on a USB stick (or float it in the cloud), and keep it up to date.

I am assuming, of course, that you are talking about a small set of pre-defined devices - your computer, your laptop, your phone - and not just any arbitrary computer you happen across.

If you do need to read your keepass database on arbitrary computers you do not control - then don't. If you really really need to - don't.
Once you unlock the database file on an untrusted computer, all your secrets are leaked out. So don't do that.

  • Thank you, solved nearly all my problems. Just one thing left: If I store my database in a cloud, like dropbox or gdrive, I will have to memorize my googlepassword without keepass, right? Because if I loose connection to my google account or just get logged out, keepass can't reach the db-file. That would mean the googlepassword can't be saved in the keepass-db. On the other hand I can't keep my db on the phone updated without the cloud...
    – selmaohneh
    Commented Dec 11, 2014 at 12:10
  • Correct. You would need a very strong password for your cloud service, and remember that - and you would also need to remember another, different, very strong password for your keepass database. I recommend Diceware passphrases - easy to remember, and can be ridiculously strong (I have no problem keeping half a dozen 5-word passphrases in memory, and I'm practically senile. Though any more than that would be a problem...)
    – AviD
    Commented Dec 11, 2014 at 12:28

The only way in your scenario, is to use master password and you can store your database where you want. For more information you can refer: http://keepass.info/help/base/keys.html

  • I wanted to use both, masterpassword AND keyfile. But since my keyfile would be on every device it is useless and I can just go with masterpassword only, right?
    – selmaohneh
    Commented Dec 11, 2014 at 11:08
  • yes you are right, or you can use both keyfile and master password.
    – skinnercid
    Commented Dec 11, 2014 at 12:32
  • 1
    I am not sure you have right. even if the key is on the same system (or always plugged) this is still an additional security level. The hacker must have the key + hack your password if he want have a chance to open it. So it's good to have both imho. Do you know that the keyfile can be what ever you want ? For example the key file could be an image. more info on keepass.info/help/base/keys.html
    – xaa
    Commented Nov 13, 2015 at 18:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .