Blog Safely storing your passwords with Keepass
Jeremy Tunnell at
Password storage is definitely a problem that some are struggling to figure out and others should put more effort into trying to figure out.
The sad truth is that most people keep their passwords on sticky notes, or on a notepad in their desk drawer...or worse they just use the same password for everything.
And really, I understand. Most people have better things to do than worry about password storage. And that's true all the way up until you get hacked for the first time.
So this quick article is an attempt for me to put some instructions down that I hope will make it fairly easy to set up a very safe password storage method.
NOTE: This guide only really works for Windows, and maybe Linux with some effort. If you are on a Mac, you will have to use another option like Lastpass or 1password.
Step 1: Download Keepass
Go and download the most recent release from the 2.XX branch of Keepass.
Step 2: Create a database
Create a database in Keepass by opening the program and choosing "File->New". It is okay to choose the default settings. If you want your database to be accessible from mobile, then you need to put it in a folder in your Dropbox called "Crypted". If you don't care, you can put it anywhere.
When you create a new database what happens is the program puts a single file somewhere on your computer, where you tell it to. This is the file that contains all of your passwords, in an encrypted format. If you only want to keep passwords on your computer and don't want access from a mobile device, then you are basically done. See notes below about backups.
Step 3: (optional) Open and/or install Dropbox
You can set your database such that it can be accessed from your phone. To do that, various versions of Keepass offer different options. I'm going to explain how to do it on Dropbox because that's the method I use.
It's actually pretty simple. You just set up dropbox according to the instructions, and then you save your password database into a folder inside your dropbox called "Crypted". It's probably a good idea to turn on two factor authentication on your dropbox account also.
Step 4: (optional) Install the Iphone app
Because Keepass is open source, there are several apps to choose from. Of course, you are taking a risk with every third-party app, because you don't know how safe the developers are. You just have to make your own decision on this, but I can say that I have been using KyPass for years without trouble, so I'm pretty sure it's safe. Follow the setup instructions for dropbox here.
Very important note
Please be aware that Keepass is not a commercial project. This is not a "service". You are responsible for your own backups.
I have experienced a program crash that resulted in corruption of the database one time. It happens. If you keep backups, you're fine.
Luckily, backups are fairly easy. If you use Dropbox, you should have a seven-day rollback period on files, so you can just roll back to a non-corrupted version. To guard against situations in which you don't notice for seven days, it is important to back up your password file by making a copy and storing it somewhere else. You do not need to go out of your way to make sure the file is in an extremely secured place, because it is encrypted, but I wouldn't post it on my website.