Kipass
Password Manager · iPhone · iPad · Mac · Android · Windows · Linux
A native, offline password manager that speaks the open KeePass format. No account, no cloud, no telemetry — nothing reaches the network until you switch it on.
The real difference
Breach checks, password health, 2FA codes, attachments, hardware keys, templates, sync — the things other managers reserve for a paid plan are all here, unlocked, at no cost. No premium tier, no locked features, no upsell. That’s the promise: the full app, free, for good.
Private by design
Every online feature ships off behind two separate switches you control: one for enrichment (breach checks, website icons), and one for reading and writing vaults over the network (cloud, WebDAV, SFTP, remote backup). Turn on only what you need — your vault is a standard encrypted file that only you can open.
Privacy
Kipass has no account and no server of its own. It never phones home, ships no analytics and no ads, and bundles no third‑party SDKs. Your vault is a standard encrypted file that only you can open — the only network traffic is the optional online features you switch on yourself, going straight to the service you chose.
How we protect you
We treat the device around your vault as if it can’t be trusted, and we lean only on cryptography the world has already vetted — never anything we invented ourselves.
Quick unlock with Face ID or Touch ID — or your device code on hardware without a strong sensor — or a per‑database PIN; each just re‑opens the vault with the password you already entered. For encryption factors, add a FIDO2 security key (hmac‑secret) or a YubiKey (HMAC‑SHA1) over NFC or USB-C, a key file, or any combination — the key becomes part of what encrypts the vault.
Guard against a forgotten master password without weakening it: a virtual key (a secret stored on the device that answers the same challenge as a hardware key), a printable recovery key, and — on Apple devices — an iCloud recovery factor. Any of them can re‑open the vault, so losing one route never locks you out. All off until you set them up.
A built‑in workshop (open even with no vault) splits any secret — a password, a phrase, a key — into N shares, of which any K reconstruct it; K−1 reveal nothing. Three interoperable formats — ssss, gfshare and SLIP‑39 mnemonics — so shares open in any standard Shamir tool, not just Kipass. Name each recipient, show each share as a QR, and print them (two per page, with instructions and a cut line).
Regain access if you lose your master password by splitting a recovery key across people you trust (any K of N). Mode A hands out shares that re‑open your live vault; Mode B exports an encrypted .kdbx copy keyed by the split key, so your contacts open only the copy and never learn your master password. The key stays encrypted inside the vault, so you can re‑export a fresh copy anytime without redistributing shares. Revoke or regenerate the whole set at will. Off until you set it up.
A separate duress PIN or password opens a believable fake base — the real one stays invisible.
A second code that, typed instead of your password, wipes this vault from the device — file, versioned backups and offline cache — then shows the same generic error as a genuine wrong password, never a giveaway. A remote copy is never touched.
Optionally erase a vault after too many wrong passwords. The counter is per‑vault, survives a restart, and resets on a real unlock. Off by default.
A per‑vault switch keeps a base’s location off the open screen — changeable only while the vault is unlocked.
Blur the whole screen with one tap, or automatically a few seconds before the vault locks — a soft warning before it does. Tap to reveal; no unlock needed.
Hide the app behind a fully‑working calculator — or a genuine QR‑code generator, your choice: turn it on and Kipass vanishes instantly, its icon changing to match too (on Android the name changes as well). Type your secret number then “=” (or tap PNG/SVG for the QR facade) to come back. Off by default.
Screenshots and recordings of the vault come out blank; the app‑switcher preview is masked.
A tampered device is flagged, and a debugger or instrumentation attempt is recorded.
A local, on‑device log of what happened to your vault — openings, reveals, copies, moves, deletions, duplicate merges, and every import and export with its source or destination and the entries involved. Titles only, never a secret. Kept three months, exportable, yours to clear.
Re‑encrypts in memory on focus loss and after idle; clears copied passwords from the clipboard.
When an app matches an entry only by package name, Kipass asks the site whether it really owns that app before offering the login — a sideloaded lookalike gets nothing.
A single “Allow Internet” toggle gates everything online. Leave it off and Kipass is fully air‑gapped.
The first time Kipass connects to your SFTP or WebDAV server, it remembers who it’s talking to — for SFTP you confirm the key’s fingerprint yourself, for WebDAV the certificate is pinned automatically. If that identity ever changes without warning, the connection is refused rather than silently trusted, so a compromised Wi‑Fi network, a rogue router or a fraudulent certificate authority can’t quietly intercept your sync.
Your cloud tokens and SFTP / WebDAV credentials never leave the device — and you can seal them behind Face ID / Touch ID (Windows Hello on Windows, device authentication on Android), so nothing reads them without you present, not even another process signed in as you. Off by default; switching it on trades unattended background sync — which can’t answer the prompt — for that extra lock.
On a Mac, unlock your vaults with your paired, unlocked Apple Watch nearby — alongside Touch ID, or instead of it on a Mac without one. No session‑password fallback. Off by default; turn it on in Preferences › Apple Watch.
A vault made elsewhere with an extreme Argon2 memory cost can be painfully slow to open — or crash a low‑RAM device. Kipass reads the cost before deriving the key and asks you to confirm a heavyweight one; anything above 256 MB is refused outright.
No YubiKey to hand? Kipass can generate a software equivalent — the same HMAC‑SHA1 challenge‑response — and add it as an unlock factor. Export it as hex to replicate the very same key onto your other devices.
On Android phones with a dedicated security chip — physically separate from the main processor, built to hold up even if the OS itself is compromised — the key protecting your quick‑unlock PIN is generated and kept inside it. Phones without one fall back automatically to the platform’s standard hardware‑backed Keystore.
Create a fresh, random .keyx key file in‑app — a real second factor to keep separate from the vault, so a stolen copy is useless without it. Save it anywhere, print its hex as a paper backup, and regenerate the very same file from that hex if you lose it. Interoperable with any KeePass app.
What we did & keep doing
A one‑time third‑party audit or an open‑source badge is worth having — but each only describes the code on the day it was done, and software never stops moving. So we don’t treat security as a box ticked once. Here’s what we’ve done, and what we keep doing: every change goes through continuous, automated, AI‑assisted security review and fuzz‑testing — the file parser hammered with malformed and malicious vaults, the cryptography and sync protocols re‑examined — refreshed as the app evolves, not once a year. It has already caught and closed real issues before release. When it surfaces a weakness, we fix it before it reaches you. That’s the commitment we intend to keep, version after version.
Found a vulnerability, or a way to make Kipass better? We want to hear it. Responsible disclosure and improvement ideas are always welcome — reporting something helps protect everyone. Write to frank@kinevia.com.
A look inside
Every day
Fill logins system‑wide, sign in with passkeys, read your 2FA codes, and — on iPad — sort your vault into tidy columns.
Suggests logins in apps and Safari, right from the keyboard. The requesting site is matched by exact domain (never a look‑alike); when you search the picker by hand, exact matches come first, then typo‑tolerant near‑misses you choose yourself — never used for automatic fill or in Agentic Mode.
Opt‑in: AutoFill offers only the exact site/app match — never the whole vault — so an AI agent driving the fill can’t browse your other secrets.
Create and use passkeys (WebAuthn) as your system credential provider. Kipass follows the site’s preferred algorithm — ES256, RS256 or EdDSA — and refuses to create a passkey it couldn’t actually use. (On iPhone and iPad, iOS itself narrows every request to ES256 before it reaches a third‑party manager; Android and the browser extension see the site’s full list.)
When you create an account, Kipass can offer a strong, an alphanumeric or a passphrase suggestion that already respects the site’s own rules — length, required characters, no repeats. It is generated on‑device without opening your vault, so there is no Face ID prompt and nothing to leak.
Tell Kipass what a site’s password must contain — minimum and maximum length, required uppercase, lowercase, digit and symbol, allowed symbols, no long runs of the same character. The entry’s generator follows them (or tells you they are impossible). The browser extension and, on iOS 26.2, AutoFill read the rules a site announces and keep them in the entry for next time — rules you set yourself are never overwritten.
Time‑based codes with a live ring — RFC 6238 with SHA‑1/256/512, 6–8 digits and custom periods, plus Steam Guard and counter‑based HOTP. Show any code as a QR to move it to another authenticator.
Import a 2FA code from a picture of its QR — a screenshot or photo — when the code is on the same device and a live camera scan can’t reach it.
On iPhone/iPad, spot a one‑time‑code QR anywhere — a screenshot, a document, someone else’s screen — and use Live Text’s own Share action to hand it straight to Kipass. It’s offered as a new account to add, never saved without your say‑so.
Turn any text or URL into a QR code — no vault required. Start from a ready‑made template (vCard, Wi‑Fi, event, SMS, email…) or type your own. Pick a colour, then share it as PNG or a scalable SVG. Read an existing QR back in too, with the camera (iPhone, Android) — or import a QR from a photo, or scan a photo's text instead (iPhone, Android). The text itself can be copied or shared directly too, no need to go through the image.
On wide screens, see Title · Username · URL and tap a header to sort — or sort by the date a password last changed, which is not the same as when the entry was last edited.
Multiple terms (all must match), quoted phrases, a -/! prefix to exclude one, per‑field operators (user:, url:, tag:, group:, attachment:, uuid:…), is: filters (expired, weak, passkey, large…), */? wildcards or a full /regex/ — the exact same engine that powers Smart Groups, across titles, notes, tags, every URL and custom field, never the password.
With several vaults unlocked, one tap on the layers icon extends the search to all of them, grouped by vault, with the very same syntax. A locked vault is never searched, a decoy is never included, and nothing is merged or copied.
Filter a group by tag, and give each base a colour that tints the app so you always know which vault is open — plus a default username pre‑filled into new entries.
Give Kipass’s icon a new look from a pop‑up grid — dark tints, a Japanese set (キパス in katakana, and the kanji 鍵 錧 秘 守 密 金庫), or a calculator. On Mac and desktop you can even load your own image. Purely cosmetic; the app stays “Kipass”, and it’s separate from the calculator camouflage.
Give an entry its own colour (KeePass’s per‑entry colour) — a slim coloured bar marks it in the list, so the ones that matter stand out.
Point a group as your templates group; every entry in it becomes a one‑tap template for new entries — the KeePass EntryTemplatesGroup, shared with KeePass/KeePassXC.
No setup needed: the + button also offers ready‑made structured types — bank card, identity, SSH key, bank account, Wi‑Fi, software license, ID document, database, server, health insurance, membership — each with its own fields and icon.
Drag down the alphabet on the right edge of a long list to land on a letter instantly, with haptic feedback.
The editor offers the addresses already in your base, most‑used first — no retyping the same e‑mail.
Quick presets — 1 week to 2 years — set an entry’s expiry date without fiddling with a picker.
A dedicated Expirations view gathers whatever is due — split into passwords to change and identity documents to renew (passport, licence, insurance) — so nothing lapses unnoticed. Set a reminder lead time per base (1 week, 1, 2, 6 or 8 months), or gather the same matches into a smart group with is:expiring. A More than N days section lists everything further out with each reminder date, and a sorter orders every section by expiry date or by reminder date.
Decide how long a password stays valid — for the whole vault, a group, a smart group or a single entry (30, 90, 180 or 365 days, or none). Create or change a password and the expiry date is set for you; a date you picked by hand is kept. The shortest matching smart group wins, then the group, then the vault.
Changes are written back to the original file a few seconds after you make them — or only on demand, if you prefer the button.
Watchtower
An offline health report inspects your whole vault and tells you exactly what’s weak — no data ever leaves the device to do it.
Optional breach check opt‑in compares your passwords against Have I Been Pwned using k‑anonymity — the password itself is never sent.
Need to hand the findings to someone? Export the report as a PDF or an Excel file — title, group and site only, never a password, user name, note or code — and lock it with an open password if you like (AES‑256 for the PDF, and Office’s own AES‑256 encryption for the Excel file).
Organize
More than logins: cards, identities, SSH keys, Wi‑Fi and licenses — each with the right fields, references and files.
Keep more than one .kdbx open at the same time — personal and work, yours and a shared one — and switch between them instantly.
Multi‑select entries and groups, then move or copy them into another group — or straight into another open base. Moving across bases brings each entry’s icon and attachments with it.
A header above the group list lets you multi‑select groups, sort them by name or by last‑modified date (the recycle bin always stays last) and add a group or a smart group — the same on iPhone, iPad, Mac, Android, Windows and Linux. Sorting and selecting keep working on a read‑only base.
Pick some entries (and, on iPhone, iPad, Mac and Android, whole groups) and export them as a new encrypted .kdbx — a faithful copy with the same identifiers, history, attachments, icons and tags, so a “family” vault can come back through Merge without duplicating anything. The recycle bin never travels; passkeys go with their entry.
Export your vault as CSV, or share a photo or document, inside an AES‑256 encrypted archive — 7z (recommended: 524,288 rounds of SHA‑256, hundreds of times costlier to guess against than a zip) or zip (WinZip AES, more widely known) — keyed by a six‑word passphrase Kipass generates for you and never stores. Open it with 7‑Zip, Keka or The Unarchiver. The plain CSV is still there, behind its warning.
Pick a group or a tag and Kipass keeps a separate, encrypted .kdbx up to date with it every time you save — replaced atomically in a folder, or on your SFTP, WebDAV, Dropbox or Box backup destination. It has its own passphrase, kept inside your vault, and passkeys stay out by default. Nothing is sent when nothing changed, a file can never overwrite an open vault, and edits made to it can be merged back.
Pick several files — or, on iPhone, iPad and Android, several photos and videos from your gallery — and Kipass makes one entry per file, named after it, with the file attached and a template chosen from its type (photos, videos and PDF as a Document, an SSH key as an SSH entry with its fields filled in). You review the list and can change any title or template before importing, from the entry list or straight from the Media page.
Open a zip or 7z attachment to list its files without extracting anything. Open a .pem, .crt, .der, .p8, .jks or .p12 to read what it is: a certificate’s subject, issuer, validity with the days left and fingerprints; a key’s type, size and whether it is encrypted; a keystore’s aliases (a .p12 asks for its password, never stored) — never the private key itself.
Open a card, an ID or a receipt kept as an image and turn on Text: Kipass reads it on your device — no cloud OCR, nothing leaves — and you copy it line by line, just part of a line, or all at once, through the secure clipboard. The text read is never saved.10
The health report groups identical or near‑identical entries; differing values are highlighted in red. Rename one to split it out, or merge a group into a single entry — losing nothing: the absorbed entries are kept in history, then binned. Choose which field to keep one by one (each value stays editable), and tick several URLs to keep, since one entry can hold many. Every merge is logged in the access journal.
An entry’s detail shows the breadcrumb of groups it lives in, and its unique ID (UUID) — copyable, and the same across other KeePass clients and the access journal, so you can pin down the exact entry among look‑alikes.
Ready‑made layouts for cards, bank accounts, identities, SSH, Wi‑Fi and more — fully localized.
Reuse a value across entries with {REF} placeholders — change it once, everywhere. Copy reference on any username, password or URL puts the {REF:…} link on the clipboard, ready to paste into another entry.
Show a password or code full‑screen in big, colour‑coded characters (digits, letters and symbols stand apart) — easy to read across the room or copy onto another device, with nothing sent over the wire.
Keep documents and keys inside the encrypted vault — add several files to an entry at once, or export them per entry.
Mark any attachment — a passport photo, diploma, medical record or insurance paper — with a category, right from the entry or the Médias tab. Filter the whole vault’s attachments by tag to find every ID scan at a glance. Tracked by the file’s content, not its name, so two files that happen to share a name are never confused.
Use Share in any other app and pick Kipass — the file lands as an attachment on an auto‑created “Shared” entry, no copy‑pasting required. Capped at 25 MB per file.
Fetch a site’s real favicon — from the site itself, never a third‑party icon service, and only when you tap the button opt‑in. Updating every icon at once shuffles the requests and spaces them with a random delay, so a network observer can’t infer your site list. Or pick from the built‑in KeePass set and the icons already in your base.
Headings, lists and emphasis render right in the entry — the file stays plain text.
Your most‑used entries surface at the top, plus tags and full‑text search.
Two tabs at the top of the list — what you opened last and what you changed last — swipe either to delete.
Give a group a search query — same syntax as the search bar, e.g. is:passkey, url:http://*, group:Banking/Cards — and its matches gather there live, from across the whole base. The definition travels inside the file, fully compatible with KeePassium and KeePassXC.
Open a PDF, image or text file kept inside an entry right in the app — rendered inline, KeePassium‑style, without exporting it first.
Crop, mirror, straighten (with a rule‑of‑thirds grid), apply a filter or one‑tap auto‑enhance, and black out a sensitive area before it stays in the vault. Any edit strips the photo’s EXIF/GPS data — a banner says so up front when there’s any to strip.
One tap auto‑levels a photographed document — a percentile‑based brightness/contrast stretch per colour channel, the same trick behind most scanner apps’ “document mode.” On iPhone, iPad and Mac it first finds the document’s edges and crops & straightens to them, so a desk or tablecloth around the page is gone, not just rescaled.
Re‑encode an image attachment before it leaves the vault — PNG at 8 or 16 bits per channel with or without transparency (16‑bit on iPhone, iPad, Mac and desktop; Android always writes 8‑bit), JPEG with a quality slider, or JPEG 2000 on iPhone, iPad and Mac. A live, exact file‑size estimate updates as you choose.
On Mac, iPad, Windows and Linux, drag a media from its row — or from the preview — straight onto a web page’s upload area, the Finder, a mail or a document: it arrives under its exact name. In the share window of an image or PDF, the JPG and PDF chips hand over the file converted to that format, with your watermark and protection applied. The decrypted copy exists only for the drop — 20 seconds by default, adjustable in Settings — and each drag is logged like a share.
Every in‑app shortcut — search, new entry, copy password, username or one‑time code, cut, paste, duplicate, preferences — can be rebound in the settings: click the combination, press the new one. Kipass refuses the ones text fields and the system own, and tells you which action already uses a combination. Same on iPhone and iPad with a keyboard, Mac, Windows, Linux and Android.
Sharing an image or PDF offers a diagonal watermark first — “CONFIDENTIAL” by default, or your own text — previewed live, with a banner warning if the file still carries EXIF/GPS data that would go out as‑is. For a PDF specifically: restrict copying/printing/editing (opens normally, no password needed), and/or require a password just to open it.
The ⓘ button on any attachment shows its full details — camera make/model, lens, exposure, capture date, GPS coordinates with a one‑tap “Open in Maps”, and for PDFs/Office documents: title, author, subject, creator. Sharing a pooled file across entries asks for confirmation before removing its GPS/EXIF data, since it affects every entry that uses it.
The Info page warns when the file still holds attachment data no entry references, with its size — one tap to clean up and compact it, a KeePassium‑style integrity check. Either way, every save compacts the file automatically, so orphaned bytes never linger.
One screen for every file in the vault, each with a thumbnail (the image itself, or a PDF’s first page) — its size, which entries use it, and when it was last previewed, shared or exported (straight from the access journal). Search, sort, rename, preview, share or delete. Filter to just the orphaned files, the content duplicates, the files attached to deleted entries (recycle bin, or recycle bin only for those that would be lost if you emptied it), or a category, and every file names the entries that use it — and, for a duplicate, which entries share the same content. Files kept only in an entry’s past versions or the recycle bin are flagged (history) and (recycle bin) so their origin is never a mystery, and identical copies are named rather than passed off as one. The same thumbnails appear on attachments inside an entry, and in the From Kipass picker that re‑attaches a file already in the vault to another entry — with a Show orphan media switch to bring back files no entry uses any more (always shown, greyed out when there are none).
Import a whole set of entry icons at once — pick several images or a .zip pack, and each becomes a standard KeePass custom icon stored in the vault, ready to assign to any entry or group. Identical images are de‑duplicated automatically, and it stays interoperable with every KeePass app.
Copy or cut a file from one entry and paste it into another — inside the same base, it's shared instantly at zero extra storage cost, not duplicated. Paste anywhere else (another app, another base) and it lands as a normal new attachment instead. Prefer browsing? “From Kipass” lists every file already in the vault and shares it with one tap, no clipboard needed.
Point the camera at a paper document and get a cropped, perspective‑corrected, multi‑page scan attached to the entry — on iPhone/iPad and Android, powered by the OS's own scanner.
Your file, your rules
It’s your data in an open format — so Kipass gives you the tools to shape it, move it, audit it and undo mistakes.
Build strong random passwords or readable Diceware passphrases in 15 languages — English, French, German, Spanish, Italian, Catalan, Portuguese (Brazil), Chinese, Ukrainian, Latin, Finnish, Polish, Turkish, Dutch and Japanese, each wordlist individually licence‑checked and credited. The generator doesn’t need a vault open — there’s a button for it right on the “open a database” screen.
A 0–100 dashboard flags weak, reused, duplicate, expired and old passwords, unsecured http:// sites, and accounts that could turn on 2FA. The list of sites that support 2FA ships offline and can be refreshed on demand from 2fa.directory when you allow Internet. Opt in and a Have I Been Pwned check marks breached passwords — without ever sending your password (only the first 5 characters of its SHA‑1 hash leave the device).
Write out a CSV or KeePass 2 XML — or copy just a selection of groups and entries into a brand‑new encrypted base.
Kipass attaches the encrypted .kdbx to a pre‑filled e‑mail you review and send — off‑device redundancy in one tap. With a key file kept separate the message is useless to anyone who intercepts it; without one Kipass warns you the copy rides on your master password alone. Offered at your backup reminder, for small vaults only.
Pick where a copy of the encrypted vault goes and send it in one tap: e‑mail, your own SFTP or WebDAV server, a Dropbox, Box, OneDrive or SharePoint account, or any folder your device can reach — iCloud Drive, Google Drive, a local folder. You connect the cloud account right there through the provider’s own sign‑in — Kipass never sees your cloud password — and can switch accounts or disconnect any time. Each backup lands as its own time‑stamped file, so you keep a history instead of overwriting one. Without a key file, Kipass warns you the copy rides on your master password alone. Nothing leaves the device on its own: your backup reminder simply offers to do it.
On Android, the new version is journalled in private storage, written, then read back and compared — and finished automatically at the next start if the app was killed mid‑write. A vault is no longer left truncated by a flat battery or a force‑close at the wrong second.
See exactly what differs between two vaults — entries added, removed and changed — before you act.
Reconcile two copies of a base entry by entry; nothing is overwritten blindly. The same engine powers every sync.
Each entry keeps its past versions — review them and roll back to any earlier state.
Deleted entries and groups move to a recycle bin, shown in red in the group tree and with its own easy‑to‑reach view — sort it by deletion date, name or type, open an entry to check it, then restore it or delete it for good (always after a confirmation): one at a time, several at once with multi‑select (restore or delete the whole selection), or empty the whole bin. Nothing can be created inside it, and every permanent deletion is written to the access journal. A Recently deleted tab sits right beside Recently opened / modified.
New bases use Argon2id by default — switch the key‑derivation function in one tap — and you can still choose the cipher (AES‑256, ChaCha20 or Twofish) and tune the Argon2 cost per base, with a plain‑language encryption verdict telling you where you stand.
Set a renewal interval and Kipass flags a stale master password — a firm red prompt once a forced interval passes — and caps how many versions each entry keeps.
One tap cleans up the whole base — Title Case on titles, stray whitespace trimmed, empty fields dropped, and (optionally) a missing https:// added to scheme‑less URLs. Acronyms and brand names — EDF, iPhone, PayPal — are left exactly as they are.
Give each base a description, a default username pre‑filled into new entries, and a colour that tints the whole app so you always know which vault is open.
One Info page sums up the open base — file location, size on disk, last‑modified, entry count, attachment storage broken down by type (images, PDF, other), encryption (KDBX version · cipher · KDF) and its parameters, description, default username and colour — with an encryption verdict, a master‑key renewal reminder and a security score. The same view on iPhone, iPad, Mac, Android and desktop.
Generate an Ed25519, ECDSA (P‑256) or RSA (4096) key pair inside the vault and serve it to ssh and git through a built‑in SSH agent — compatible with KeeAgent, the key living only in the encrypted base.
Generate a GnuPG‑compatible OpenPGP key pair inside an entry — Ed25519 + Curve25519 (recommended) or RSA 4096, valid 1 year, 2 years or without expiry. The private key, the public key and a self‑contained revocation certificate are attached as .asc files, and a strong passphrase is generated and kept for you. Built on the device; nothing is sent anywhere.
Unlock one base and it can open the others it links to — the KeePass AutoOpen convention, so it interoperates with KeePassXC, KeePassium and KP2A. Each child opens with the password kept on the parent entry; on a phone you locate the file once and it’s remembered.
Spin up a disposable email address for a new account without leaving the entry — only when you ask, and only once you connect your own SimpleLogin.
Switching over
Import straight from the managers you’re leaving — including encrypted exports and, on recent systems, passkeys — into one open .kdbx file you control.
Plain and password‑encrypted JSON exports (PBKDF2 and Argon2id) — passwords, TOTP, passkeys and password history, folders kept as a real hierarchy.
Both the legacy .1pif and the newer .1pux archive.
The Proton Pass JSON export — logins, notes and cards, each vault becoming its own group.
Either Keeper JSON export — the consumer Vault Export or the Commander/Record‑V3 shape — with typed records (cards, identities, SSH keys, bank accounts…) landing as matching Kipass templates, not just flat text.
The legacy KeePass 1 binary format, decrypted on‑device and folded into your KDBX 4 base.
CSV from Apple Passwords, Google Password Manager, Chrome, LastPass, Dashlane, NordPass — plus Enpass JSON and KeePass 2 XML.
On recent systems, pull passwords and passkeys straight from Apple Passwords or Google Password Manager over the FIDO Credential Exchange — no file, encrypted end‑to‑end by the OS. The transfer carries no site icons; one tap fetches them all afterwards.
On iOS and macOS 26, hand your passwords, 2FA codes, passkeys and custom fields to Apple Passwords or another manager over Credential Exchange — no file lands on disk. Kipass warns you first that the receiving app reads them in clear, and logs the transfer in your access journal. On Android, switch on Let other apps import from Kipass and Google Password Manager (or another manager) can pull from Kipass the same way — off by default, and only after you unlock Kipass and approve each transfer.
A file is not a verified source. When an import carries passkeys — Bitwarden, Keeper, KeePass 2 XML, Credential Exchange — Kipass tells you how many and lets you keep them or import passwords only. Nothing is saved until you answer, on all four platforms.
Read a Password Safe .psafe3 database, decrypted on‑device, entries and folders intact.
SafeInCloud/Secrets XML and mSecure CSV — both recognised straight from the file’s own bytes, no format to pick.
The Import menu on the open screen offers every format you get inside a base — CSV, Bitwarden, .1pux, Enpass, Proton Pass, Keeper, KeePass 2 XML, .kdb, .psafe3, SafeInCloud, mSecure, plus auto‑detect and TOTP. Build a fresh base straight from an encrypted export by typing its password in the create screen’s Import password field.
Sync
Your vault is a plain .kdbx file, so it lives wherever you want — on the device, in your cloud, or on your own server. Every online path is off until you turn it on, and each save merges instead of overwriting.
Two devices on the same network sync directly, end‑to‑end encrypted, verified by a 6‑digit code. Nothing leaves the LAN, no account involved.
Sign in once and open a base straight from Dropbox, Box, OneDrive or SharePoint, with a conflict‑safe merge on every save. Access tokens are kept on‑device only — no server of ours in the middle.
On iPhone, iPad and Mac, open a vault from iCloud Drive natively, or from Google Drive, OneDrive and any other provider through the system Files app — no extra account, nothing routed through us. On desktop, point at the provider’s synced folder.
Point Kipass at your own Nextcloud or ownCloud over HTTPS. Every save reads the server copy back and merges it in — and if the server can’t be reached, your changes stay on the device rather than overwrite a version Kipass never saw. Each save is uploaded under a temporary name, size‑checked, then swapped in with a single MOVE — an interrupted upload never leaves a truncated base on your server.
Open and sync a base over your own SSH server — the same conflict‑safe merge as WebDAV, nothing stored anywhere you don’t control. Sign in with a password or a private key (Ed25519, ECDSA or RSA). Saves go through a temporary file too: verified by size, then renamed over the original in one step, so a dropped connection can’t leave a half‑written vault.
Beyond the phone
The same vault, in the same open format, runs on Android — and two phones sync directly over Wi‑Fi, iPhone to Android included.
The very same app runs on Apple silicon Macs — your vault on the desktop, nothing extra to install.
On the Mac, load an SSH key stored in your vault into the running ssh‑agent for ssh and git — the key never touches disk and is pulled back out when the vault locks.
Fill your logins right in Safari. The extension shows the accounts matching the current site and fills the page on your pick — username, password, and its TOTP code too if the entry has one — gated by Touch ID and Agentic Mode, sharing nothing beyond that one login.
Your 2FA codes with a live countdown, your entries with search, and a detail view — on your wrist. It reads from the paired iPhone; passwords stay on the phone unless you allow them, and the watch’s copy clears the moment the vault locks.
The same on an Android watch: your 2FA codes with a live countdown, your entries with search, and a detail view — on your wrist. Passwords and TOTP secrets leave the phone only if you turn each on; the recycle bin never syncs, and the watch’s copy clears on a timer and the moment the vault locks.
Jump to a chosen entry or 2FA code straight from a widget.
The whole app — including entry templates — localized end to end. Serbian comes in both Cyrillic and Latin script.
Opt‑in enhanced VoiceOver labels announce each entry as one item and name every action, for blind and low‑vision users.
The very same vault runs as a native desktop app on Windows (.msi) and Linux (.deb) — the open .kdbx format, no account, no cloud.
On Mac and the desktop, Kipass can type your username and password straight into the active window, KeePassXC‑style. A mobile OS won’t allow this, so it stays desktop only. Sequences imported from KeePassXC work as‑is, including its {TIMEOTP} one‑time‑code placeholder. On a Linux Wayland session Kipass deliberately does not type — the system can’t tell it which window will receive the keys — and says so instead of guessing; X11, Windows and macOS are unaffected.
On Windows and Linux — X11 and Wayland alike (via the desktop portal) — one hotkey pops up a search over your unlocked vaults from any app: find an entry, copy its username, password or TOTP. Pick your own key combination in Preferences (the default is Ctrl+Shift+Space). With no vault open, the palette shows your recent bases and every way to open one; Escape or the × closes it. Kipass registers a single specific shortcut, never a key logger. Off by default. On Windows and Linux X11 the palette also offers Type: it shows the window that had focus, suggests the entries that match its title and, once you click, types the username and password into that window — only if it still has focus, and never on its own.
A search field pinned at the top of Preferences filters every option as you type — on iPhone, iPad, Mac, Windows, Linux and Android. Look up “camouflage”, “backup” or “shortcut” instead of scrolling.
With a physical keyboard — iPad, Mac, an Android tablet or Chromebook, Windows and Linux — drive Kipass without the mouse: search (⌘/Ctrl+F), new entry (⌘/Ctrl+N), copy the password, username or TOTP (⌘/Ctrl+⇧C · ⇧U · T), cut, paste to move, or duplicate an entry (⌘/Ctrl+⇧X · ⇧V · D), and open Preferences (⌘/Ctrl+,). Escape closes. Cut, copy and paste inside a text field stay normal editing.
A browser extension opens one or more local or WebDAV .kdbx vaults at once — switch between them with tabs — and fills your logins on the page, TOTP code included when the entry has one (RFC 6238/4226, Steam Guard too). It also notices a new or changed password on submit and offers to save it, asking which open vault if you have more than one. Everything stays inside the browser, nothing is sent out. Same extension, unmodified, on any Chromium‑based browser — Brave, Vivaldi, Chromium itself.
A separate command‑line tool for scripting your vault — list, search, add, edit, merge, audit weak or reused passwords, show a TOTP code, or inject a credential into a command's environment without ever printing it. No account, no server: the master password is always typed interactively, never accepted as an argument. Built from source alongside the app.
Compare
The same open vault, wherever you are. Here is exactly what runs where.
| Feature | iPhone · iPad | Mac | Windows | Linux | Android | Apple Watch | Wear OS |
|---|---|---|---|---|---|---|---|
| Vault & format | |||||||
Open & edit KeePass .kdbx | ● | ● | ● | ● | ● | ○ | ○ |
| Argon2id · AES‑256 · ChaCha20 · Twofish | ● | ● | ● | ● | ● | – | – |
| TOTP / 2FA codes | ● | ● | ● | ● | ● | ● | ● |
| Password generator | ● | ● | ● | ● | ● | – | – |
| Generation rules per entry | ● | ● | ● | ● | ● | – | – |
| Security dashboard (Watchtower) | ● | ● | ● | ● | ● | – | – |
| Exportable security report — PDF · Excel, encrypted | ● | ● | ● | ● | ● | – | – |
| Password lifetime — vault · group · entry | ● | ● | ● | ● | ● | – | – |
| Import — 13 formats | ● | ● | ● | ● | ● | – | – |
Export — CSV · encrypted .kdbx | ● | ● | ● | ● | ● | – | – |
| 3‑way field‑level merge | ● | ● | ● | ● | ● | – | – |
| Smart Groups | ● | ● | ● | ● | ● | – | – |
| Groups in bulk — select · sort · add | ● | ● | ● | ● | ● | – | – |
| Expirations page — upcoming & later, sorted by expiry or reminder | ● | ● | ● | ● | ● | – | – |
| Search all open vaults | ● | ● | ● | ● | ● | – | – |
| Attachment preview & share | ● | ● | ● | ● | ● | – | – |
| Media manager | ● | ● | ● | ● | ● | – | – |
| Drag a file out to another app | ○ | ● | ● | ● | – | – | – |
| Send a media inside an encrypted archive — 7z · zip | ● | ● | ● | ● | ● | – | – |
| Automatic export of a group or tag to a separate vault — folder · SFTP · WebDAV · cloud | ● | ● | ● | ● | ● | – | – |
| Import several files at once — one entry each, template chosen by file type | ● | ● | ● | ● | ● | – | – |
| List the files of a zip or 7z attachment — nothing extracted | ● | ● | ● | ● | ● | – | – |
| Key & certificate details — PEM · DER · PKCS#8 · PKCS#12 · JKS | ● | ● | ● | ● | ● | – | – |
| Copy text out of an image — on‑device OCR 10 | ● | ● | ● | ○ | ● | – | – |
| Customizable keyboard shortcuts | ● | ● | ● | ● | ● | – | – |
| Import a custom icon set | ● | ● | ● | ● | ● | – | – |
| Copy/cut/paste an attachment between entries | ● | ● | ● | ● | ● | – | – |
| Share Sheet receiver — any file type 25 MB max | ● | ● | – | – | ● | – | – |
| Document scanner 7 | ● | – | – | – | ● | – | – |
| Clean up a scan — auto‑levels 9 | ● | ● | ○ | ○ | ○ | – | – |
| Convert & resize image — PNG 16‑bit · JPEG 2000 9 | ● | ● | ○ | ○ | ○ | – | – |
| Versioned backups | ● | ● | ● | ● | ● | – | – |
| E‑mail a backup key file | ● | ● | ○ | ● | ● | – | – |
| Access journal (audit) | ● | ● | ● | ● | ● | – | – |
| Unlock | |||||||
| Biometric unlock 1 | ● | ● | ● | – | ● | – | – |
| Remember password — OS‑sealed 2 | ● | ● | ● | ● | ● | – | – |
| PIN quick‑unlock | ● | ● | ● | – | ● | – | – |
| Virtual key — device‑stored factor | ● | ● | ● | ● | ● | – | – |
| Recovery factors — recovery key iCloud recovery on Apple | ● | ● | ● | ● | ● | – | – |
| Key file | ● | ● | ● | ● | ● | – | – |
| Generate a key file | ● | ● | ● | ● | ● | – | – |
| Hardware key — YubiKey · FIDO2 over USB / Lightning 3 | ○ | ● | ● | ● | ● | – | – |
| Hardware key — YubiKey · FIDO2 over NFC | ● | – | – | – | ● | – | – |
| Duress & privacy | |||||||
| Duress — decoy · erase code · self‑destruct | ● | ● | ● | ● | ● | – | – |
| Privacy blur (hide now / before lock) | ● | ● | ● | ● | ● | – | – |
| Calculator or QR‑code camouflage icon + name on Android | ● | ● | ● | ● | ● | – | – |
| Hide the file path | ● | ● | ● | ● | ● | – | – |
| Screen‑capture protection | ● | ● | ● | ● | ● | – | – |
| Filling & automation | |||||||
| App / site autofill (OS) | ● | ○ | – | – | ● | – | – |
| Save new logins on submit 6 | ● | – | ● | ● | ● | – | – |
| Auto‑Type into the active window | – | ● | ● | ● | – | – | – |
| Quick Access — global shortcut | – | – | ● | ● | – | – | – |
| Type into the focused window from Quick Access | – | – | ● | ○ | – | – | – |
| Browser extension — Chrome · Firefox · Edge · Brave · Vivaldi 5 | – | ○ | ● | ● | – | – | – |
| Sync, keys & sharing 4 | |||||||
| Wi‑Fi / LAN direct sync | ● | ● | ● | ● | ● | – | – |
| SFTP sync | ● | ● | ● | ● | ● | – | – |
| WebDAV sync | ● | ● | ● | ● | ● | – | – |
| Pinned server identity (SFTP & WebDAV) | ● | ● | ● | ● | ● | – | – |
| Biometric lock for sync secrets opt‑in | ● | ● | ● | – | ● | – | – |
| Linked databases AutoOpen | ● | ● | ● | ● | ● | – | – |
| Cloud connectors — Dropbox · Box · OneDrive · SharePoint | ● | ● | ● | ● | ● | – | – |
| Open from a cloud drive — iCloud · Google Drive · OneDrive 8 | ● | ● | ● | ● | ● | – | – |
| SSH agent (KeeAgent) | – | ● | ● | ● | – | – | – |
| SSH key generation | ● | ● | ● | ● | ● | – | – |
| PGP key generation | ● | ● | ● | ● | ● | – | – |
| Email alias (SimpleLogin) | ● | ● | ● | ● | ● | – | – |
| Reach | |||||||
| Widgets (home screen · Notification Center) | ● | ● | – | – | ● | – | – |
| Apple Watch companion | – | – | – | – | – | ● | – |
| Wear OS companion Android watch | – | – | – | – | – | – | ● |
| 55 languages | ● | ● | ● | ● | ● | ● | ● |
| Offline · no account · no telemetry | ● | ● | ● | ● | ● | ● | ● |
1 Face ID / Touch ID on Apple, Windows Hello on Windows, biometrics on Android. On Linux the login keyring is the gate (no separate biometric prompt).
2 Sealed by DPAPI on Windows, the Keychain on Apple, and the freedesktop Secret Service (GNOME Keyring / KWallet) on Linux.
3 Wired over USB‑A / USB‑C on desktops and Android, or USB‑C / Lightning on iPhone and iPad. Over NFC you just tap the key — phones do this; most PCs and Macs have no NFC reader.
4 Every network feature is strictly opt‑in and off by default — nothing reaches the network until you turn it on.
5 On phones and tablets, browsers don't take password‑manager extensions — the OS autofill fills logins in every browser (and app) instead; see "App / site autofill" above. This is how every mobile password manager works. The extension itself is unmodified across targets and loads the same way in any Chromium‑based browser (Brave, Vivaldi, Chromium itself); Windows and Linux walk you through installing it from Preferences, Mac doesn't yet — Mac ships its own native Safari extension instead (○ above).
6 Submitting a new or changed login offers to save it to Kipass — via the OS autofill save prompt on iPhone/iPad (iOS 26.2+) and Android, or the browser extension's own prompt on Windows and Linux (which also asks which open database, if more than one is unlocked at once). Always asks first; never saved silently. Mac has no equivalent path yet — Apple limits the OS prompt to iOS/visionOS, and the Safari extension doesn't detect submissions.
7 Edge detection, perspective correction and multi‑page capture, powered by the OS's own document‑scanning component (VisionKit on iOS, ML Kit on Android). The QR generator's photo import separately offers two explicit modes — decode a QR code, or run on‑device text recognition (Vision on iOS, ML Kit on Android) — fully on‑device, nothing leaves the phone.
8 iCloud Drive is native on iPhone, iPad and Mac. Google Drive and OneDrive open through the system Files app on those devices; on Windows and Linux, point Kipass at the provider's own synced folder.
9 Everywhere: the auto‑levels stretch, 8‑bit PNG/JPEG export, and a quality slider. iPhone, iPad and Mac add document edge‑detection & crop before cleanup, 16‑bit PNG, and JPEG 2000; Windows and Linux add 16‑bit PNG but not the other two; Android has the base set only.
10 Text recognition runs entirely on the device, with no online service: Vision on iPhone, iPad and Mac, ML Kit (bundled, telemetry removed) on Android, the Windows OCR engine on Windows (needs an OCR language pack), and Tesseract on Linux (install it first, for example sudo apt install tesseract-ocr).
