Same database format, different applications. KeePass is the original, Windows-first and extended largely through plugins. KeePassXC is a modern cross-platform rewrite with native Windows, macOS and Linux builds, a published 2023 audit, and native passkey support since 2.7.7. Neither has an official mobile app.
Facts reviewed 2026-08-01. Every row below is sourced, and anything a vendor does not publish is marked as such rather than estimated.
The question that decides it
Do you need native macOS or Linux support, or do you rely on specific KeePass plugins?
you are on Windows and depend on the plugin ecosystem.
you want native cross-platform builds, a recent audit, and passkey support.
| KeePass | KeePassXC | |
|---|---|---|
| Storage model | Local encrypted database file | Local encrypted database file |
| Key derivationKey derivation sets how expensive each attacker guess is. A vendor that does not publish its parameters cannot be independently compared on this. | Per-database and user-configurable: AES-KDF, Argon2d or Argon2id. No universal value exists. | Argon2-based derivation, configured per database rather than account-wide. |
| Source code | Free and open source | Open source under GPL |
| Independent audits | Underwent an EU-sponsored source-code review and later EU-FOSSA bug bounties. | An independent review of version 2.7.4 completed in January 2023 found no major cryptographic or database problems. |
| Free tier | Entirely free | Entirely free |
| Main free-tier limit | No account, subscription, device limit or item cap | No account, subscription, device limit or item cap |
| Account recovery | None whatsoever. Lose the master password or key file and the database cannot be opened — your only recourse is a backup you made yourself. | None. A lost master password, key file or hardware key means the database is unopenable without a backup. |
| Passkeys | Native passkey support could not be verified in core KeePass. | Native passkey storage via KeePassXC-Browser, added in version 2.7.7 (March 2024). |
| Platforms | Officially Windows; runs on Linux and macOS via Mono. Mobile clients are separate third-party ports. | Windows, macOS and Linux only. There is no official Android or iOS app. |
| Documented incidents“None found” means no authoritative report surfaced during research. It is not a claim that no incident has ever occurred. | Historic format weaknesses, including unauthenticated database headers, were fixed in KeePass 1.24/2.20. This was a file-integrity issue, not a vault breach. | None found in published sources |
An encrypted database file on your own hardware. There is no vendor service at all — syncing is whatever you arrange yourself through a network share, WebDAV, or a cloud-mounted folder.
A local, offline KDBX database file with a modern cross-platform interface. As with KeePass, there is no vault server — you choose where the file lives.
KeePass and KeePassXC differ in how well they protect a stored copy of your passwords. MoolKey answers a different question: it recalculates each password from your private phrase and the site name whenever you need it, so no copy exists to protect. A breach would expose masked account names and integers, not credentials.
That is a real trade, not a free win. There is no autofill, no import of your existing passwords, and no recovery if you forget your phrase — none, by design. your private phrase never reaches the service, so nobody can reset it or reproduce a password derived from it.
Every factual claim above traces to vendor documentation or published reporting. Where a vendor does not publish a figure, this page says so instead of repeating a number from a comparison table we cannot verify.
Start with the password you keep reusing or the bank card that still shares a PIN. MoolKey is free, and you do not need to move everything at once.
