![]() |
Composite Master KeyThis document describes how KeePass locks databases. |
KeePass stores your passwords securely in an encrypted file (database). This database is locked with a master password, a key file and/or the current Windows account details. To open a database, all key sources (password, key file, ...) are required. Together, these key sources form the Composite Master Key.
KeePass does not support keys being used alternatively, i.e. it's not possible that you can open your database using a password or a key file. Either use a password, a key file, or both at once (both required), but not interchangeably.
If you use a master password, you only have to remember one password or passphrase (which should be good!) to open your database. KeePass features protection against brute-force and dictionary attacks on the master password, read the security information page for more about this.
If you forget this master password, all your other passwords in the database are lost, too. There isn't any backdoor or a key which can open all databases. There is no way of recovering your passwords.
You don't even have to remember a long, complicated master passphrase. The database can also be locked using a key file. A key file is basically a master password in a file. Key files are typically stronger than master passwords, because the key can be a lot more complicated; however it's also harder to keep them secret.
Location. The point of a key file is that you have something to authenticate with (in contrast to master passwords, where you know something), for example a file on a USB stick. The key file content (i.e. the key data contained within the key file) needs to be kept secret. The point is not to keep the location of the key file secret – selecting a file out of thousands existing on your hard disk basically doesn't increase security at all, because it's very easy for malware/attackers to find out the correct file (for example by observing the last access times of files, the recently used files list of Windows, malware scanner logs, etc.). Trying to keep the key file location secret is security by obscurity, i.e. not really effective.
File Type and Existing Files. KeePass can generate key files for you, however you can also use any other, already existing file (like JPG image, DOC document, etc.).
In order to use an existing file as key file, click the 'Browse' button in the master key creation dialog.KeePassXC. For some key file formats, the port KeePassXC shows a warning that the format is deprecated. There is no deprecated format though. All key file formats are secure (each can store a 256-bit key) and KeePass continues to fully support all of them.
NET USER <User> <NewPassword>
command) are two different things.
After changing your password, you can still open your KeePass database.
When resetting the password to a new one, access usually is not possible
anymore (because the user's DPAPI keys are lost), but there are exceptions
(for example when the user is in a domain, Windows can retrieve the user's DPAPI keys
from a domain controller, or a home user can use a previously created
Password Reset Disk).
Details can be found in the MSDN article
Windows Data Protection and in the support article
How to troubleshoot the Data Protection API (DPAPI).Administrators can specify a minimum length and/or the minimum estimated quality that master passwords must have in order to be accepted. You can tell KeePass to check these two minimum requirements by adding/editing appropriate definitions in the INI/XML configuration file.
The value of theSecurity/MasterPassword/MinimumLength
node specifies
the minimum master password length (in characters). For example, by setting
it to 10
, KeePass will only accept
master passwords that consist of at least 10 characters.Security/MasterPassword/MinimumQuality
node specifies
the minimum estimated quality (in bits) that master passwords must have.
For example, by setting it to 80
, only master passwords
with an estimated quality of at least 80 bits will be accepted.Security/MasterKeyExpiryRec
node can be set to an
XSD date or an XSD duration (see
XSD Date and Time Data Types).
If the master key has not been changed since the specified date or
if the time span between now and the last master key change exceeds
the specified duration, KeePass recommends to change it.
This setting applies to all databases that are opened with this
KeePass instance; a master key expiry can also be configured for
each database individually (in 'File' → 'Database Settings' →
tab 'Advanced').KeyCreationFlags
and/or KeyPromptFlags
(in the UI
node), you can force states (enabled, disabled,
checked, unchecked) of key source controls in the master key creation and
prompt dialogs. These values can be bitwise combinations of one or more of
the following flags:Flag (Hex) | Flag (Dec) | Description |
---|---|---|
0x0 | 0 | Don't force any states (default). |
0x1 | 1 | Enable password. |
0x2 | 2 | Enable key file. |
0x4 | 4 | Enable user account. |
0x8 | 8 | Enable 'hide password' button. |
0x100 | 256 | Disable password. |
0x200 | 512 | Disable key file. |
0x400 | 1024 | Disable user account. |
0x800 | 2048 | Disable 'hide password' button. |
0x10000 | 65536 | Check password. |
0x20000 | 131072 | Check key file. |
0x40000 | 262144 | Check user account. |
0x80000 | 524288 | Check 'hide password' option/button. |
0x1000000 | 16777216 | Uncheck password. |
0x2000000 | 33554432 | Uncheck key file. |
0x4000000 | 67108864 | Uncheck user account. |
0x8000000 | 134217728 | Uncheck 'hide password' option/button. |
KeyCreationFlags
and KeyPromptFlags
must be specified in decimal notation.