Password Manager KeePass 2.31 has been released

KeePass 2.31 is a new update to the popular password manager for Windows that introduces a whole new set of features and improvements to the program.

The new version of the application is available for download on the official website. The password manager may remind you on start that a new version is available (if check for updates is selected in options), and you may use the Help > Check for updates option to find out about it manually, but it does not support an option to update it automatically.

This means that you need to download the latest version and install it manually over the old one to update it. The process is swift and won't cause any issues with existing password databases or preferences.

KeePass 2.31

The changelog indicates what is new compared to version 2.30 of the password manager. It is a long list, as usual, and you may want to check it out if you want to know about all changes and features in the new release.

keepass 2.31

This article concentrates on the most important changes, fixes and additions in KeePass 2.31.

  • The Clipboard Cleaner replaces the information with non-sensitive text now before it is cleaned. This is done to ensure that sensitive data is no longer stored in the Clipboard if the pruning of Clipboard data is prevented (for instance by third-party software or while running in a VM).
  • Auto-Type uses a new target window classification method which improves "window in window" targets. Also, improvements with Remote Desktop Connection client and Virtual Box, and when the target window changes during a process.
  • Optional global URL overrides to open URLS with Internet Explorer or Google Chrome in private browsing mode.

keepass private mode

  • Support for importing Mozilla Bookmark tags, and for exporting Mozilla Bookmarks HTML files.
  • All KeePass binaries are dual signed with SHA-1 and SHA-256 as recommended by Microsoft.

This is just a small selection of changes in KeePass 2.31. If you are running the password manager, I suggest you check out the new release right away.

Closing Words

KeePass is my password manager of choice, and I'm often asked why I'm using a desktop password manager and not an online password manager.

One of the main reasons why is that I'm the keeper of my data whereas data is automatically transferred to cloud storage in god knows which countries when an online password manager is being used.

I don't require access to passwords on mobile devices, but there are third-party solutions out there that bring KeePass to Android, iOS and other mobile operating systems.

The password manager offers excellent security and if you want to, better integration with web browsers but that is something that I don't require as well (I prefer to copy data manually each time instead).

Now You: Do you use a password manager? Which is it and why did you choose it?

 

 

Summary
Author Rating
3.5 based on 34 votes
Software Name
KeePass 2.31
Operating System
Windows
Software Category
Security
Landing Page
Please share this article

Facebooktwittergoogle_plusredditlinkedinmail



Responses to Password Manager KeePass 2.31 has been released

  1. ilev January 10, 2016 at 10:27 am #

    There is a portable classic 1.30 version at PortableApps.com

    • Andrew January 10, 2016 at 10:01 pm #

      Portable versions for both v1 and v2 are on the keepass site.

  2. Anonymous January 10, 2016 at 12:48 pm #

    Keepass since 2010 never had a problem dont see the need to change :)

  3. Moloch January 10, 2016 at 1:04 pm #

    started using KeePass around a year ago, love it, along with KeeFox it integrates very well in PaleMoon (or any other firefox-based browser)

    • dan January 12, 2016 at 2:03 am #

      I can't get KeeFox to work with PaleMoon: it won't install as it says it is not compatible with Pale Moon v.25.8.1. I'm using the 64-bit version of Pale Moon: perhaps that's the difference? I have to use PassIFox instead (works well, just not as seamlessly as KeeFox).

  4. roger January 10, 2016 at 1:30 pm #

    ......god job for the law enforcement.....all passwords at one place !
    How secure is this app?

    • IDrinkChipFatAsADietFad January 10, 2016 at 6:37 pm #

      more secure than a notepad (if the law is involved) unless you write your passwords in a secret code. Its as secure as your going to get if you want to use this type of manager

    • Andrew January 10, 2016 at 10:06 pm #

      Keepass uses standard AES or twofish encryption, better than most "encryption" methods that companies use to store your password (since it seems a lot just hash the passwords). Also this is offline which means it's not saved in an online database somewhere.

      imo, this is the best method of handling multiple passwords, as it's held offline (but you can sync the database via dropbox if you want) and you can manager numerous different passwords.

      I don't think there's a better method.

  5. Dana January 10, 2016 at 2:28 pm #

    I use sticky password. Its been great until the last ff update. Its no longer signed 'unless I pay to upgrade it" and will keep me from updating ff. A pass word manger is a must for me. I'm going to look into this one. I luv your site here. Take care.

  6. Xibula January 10, 2016 at 2:36 pm #

    I don't require
    I don't require
    I don't require

    what you are using then is a glorified encrypted spreadsheet

    • Pants January 10, 2016 at 2:52 pm #

      Its more like a normalized database, with a gui (and extra features like pw generation, integration and a ton of options) than a spreadsheet .. but yeah .. it's encrypted, .. so what's your point?

  7. anohana January 10, 2016 at 3:00 pm #

    I still afraid of password managers. I should sync the passwords between home and office, but I don't trust in any cloud service so much to do this (nor store them only online).

    • INoLongerDrinkChipFatAsADietFad January 10, 2016 at 6:41 pm #

      you can save your keepass passwords to a secure file and add it to keepass on your work pc

    • Andrew January 10, 2016 at 10:07 pm #

      or save it to your phone, that way you have it in only one secure location.

    • XenoSilvano January 12, 2016 at 8:23 pm #

      use BitTorrent Sync

  8. ErwanLeroux January 10, 2016 at 3:11 pm #

    The lastest portable version is provided as well as the regular version on the website

  9. Tim January 10, 2016 at 4:46 pm #

    Windows SmartScreen Filter is a PITA with Keepass.

    Yesterday the SmartScreen filter gave a red warning when downloaded. Today the red warning is gone as more people have downloaded it, but Windows 10 still won't let me run it because I have a blank password on my local Windows account (I use Bitlocker password instead of account password).

    So I'll give it a few days for SmartScreen filter to sort itself out.

  10. cyrilange January 10, 2016 at 6:11 pm #

    I use KeePassX and SpiderOak to sync the database between my computers. It's working very well !

  11. Tom Hawack January 10, 2016 at 10:29 pm #

    @Martin (founder of gHacks), you state in the article,
    "[...] data is automatically transferred to cloud storage in god knows which countries when an online password manager is being used."

    I totally agree. But between cloud storage and an independent password manager such as Keepass, how confident may we be with a browser's built-in password manager? Here with Firefox, once a master password set, do you believe the user's data is more at risk then with a tool such as Keepass?

    I run an application comparable to Keepass named "Any Password Pro" which handles encrypted data of course, but I do rely on Firefox's password manager (WITH master password) for everyday logins. Firefox's Sync not used here. Do you believe my encrypted logins within Firefox's password manager are at risk, I mean is the idea of an external intrusion (a Web intrusion) on my passwords, a valid possibility? This is important, and not only for me.

    • Jason January 11, 2016 at 4:55 am #

      I consciously decided long ago not to use browser password management. I approached this issue from the perspective of common sense: the browser is the most exposed part of my computer to the bad guys on the internet, so why would I want to let the browser store any critical data? It's a non-starter for me. (In fact, my browser is set to delete absolutely everything in its cache when I close it.)

      I'm glad I made this decision. Every once in a while, I read a report about some new security flaw in a browser's password access permissions. People have found ways over the years to make just about any browser (Firefox, Chrome, etc.) spit out passwords in plain text. Is it a serious problem right now as I type this? Probably not. Probably everything has been reasonably patched. But I just won't trust that this is so.

      Remember, browsers have become fairly complex pieces of software. They have to handle so many network connections, so many extensions/plugins/addons, so much script from the web.... It's not hard to see how something could get lost in all the noise.

      • Tom Hawack January 11, 2016 at 11:40 am #

        OK, Jason, I clear caches as well, not only at Firefox exit but also within the session, and I moreover delete cookies (that have no exception rule - either keep or block) as soon as a site is closed, with an add-on called "Self-Destructing Cookies".

        This means that I have to login repeatedly if I haven't set the site's login cookie to 'keep'. In this scenario Firefox's built-in manager is far more convenient than if I had to call every time a Password Manager application : it's Firefox's Password Manager and no cookies except the very few I've authorized.

        But I do insist on the fact that using the browser's password manager requires absolutely a Master Password which keeps the passwords encrypted. This will be sufficient for indiscreet local eyes (guests at home if applicable) but maybe not (and that was the sense of my post) should my browser suffer from a penetration attempt on the Web. I do have system-wide protections and I moreover always run Firefox within a "Restricted Access" protocol implemented for a given application by running it via a security front-end called "DropMyRights".

        So I guess it all resumes to a balance between comfort and security/privacy. The right balance remains subjective IMO unless to consider that enforced security relies on a "totalitarian" approach implying zero ease of use, moreover maybe not required for an optimal protection if more than more may be sometimes superfluous.

      • Jason January 11, 2016 at 10:24 pm #

        Yup, I agree with what you're saying: it always comes down to convenience vs. security. (I think we've had this conversation before!)

        As long as people are making informed decisions, then everything's ok. The problem is that many people have no idea what's going on when they click that convenient "remember it for me" button (or "sync it" or "automatically do it" or whatever). Those are the people that get in trouble.

        I use Self-Destructing Cookies too, by the way. That represents a reasonable balance between convenience and security for me.

  12. Yasin Tmar January 11, 2016 at 1:11 am #

    I use LastPass , it doesn't require any download besides the browser addon for faster and better access

  13. Jason January 11, 2016 at 4:39 am #

    Useful tip: Keepass database files normally have the .kdbx or .kdb extension. However, Keepass does not *require* files to have this extension. That's quite unusual for a program in the Windows platform. (Not unusual in Linux, but that's another story).

    So, for a bit of extra security, you might want to just give your database file a generic name that has nothing to do with passwords (e.g. "oranges" or "shoppinglist") and then REMOVE the .kdbx extension. If this file ends up in the hands of a malicious person, they won't know which application opens it. (Double-clicking a Keepass file without the extension does not launch Keepass. Windows just asks which program you want to use to open it.) This advice is particularly useful if you plan to save your database in cloud storage (which I don't recommend, but I know many people want to do.)

    (PS. v.2.31 is an important update of Keepass for me. I was counting off the weeks, and now it's here. Yay!)

    • Pants January 12, 2016 at 7:47 am #

      How to be a sneaky shit 101:
      Mine is called ReleaseNotes.txt and the key is called English.lng and they reside in the root of my KeePass portable folder (I could easily hide those two files in the root of some other portable software dir). Additionally, I have a .kdbx and .key file in the same directory with some bullshit sites and passwords and usernames. You'll also probably want to turn off KeePass remembering key sources, paths, recently opened files etc (Options>Advanced) - I don't do this because I don't back anything to the cloud, and if I did it wouldn't be the program and settings/ini/config - it would just be the .txt(kdbx) and lng(key) files. If they want the recently opened files info, they'd have to hack into my system, and if they do that, then it's already too late. At this stage they can have the files, if they can find them, and they still have to get past my awesome password of 2pants-or-not-2pants

  14. FrankT January 11, 2016 at 3:35 pm #

    I've used KeePass for years on all my devices (Windows laptop, Android phone, Linux desktop).

    To sync the database among the 3 devices I use Syncthing. It's open source, and there is no 3rd party cloud service storing any of my files. Syncthing is peer to peer - only on my own trusted devices touch the data. Everything is encrypted (TLS) while in transit across the internet.

  15. Sam January 11, 2016 at 6:06 pm #

    Martin, did you ever post a list of what programs you use? As you say, "KeePass is my password manager of choice". I'm sure there are other good software programs out there most are not aware of. Future article perhaps? Title: What software Martin uses 2016 edition.

  16. PhoneyVirus January 11, 2016 at 10:20 pm #

    I can NOT tell you how much it was nice to read about Optional global URL overrides to open URLS with Internet Explorer or Google Chrome in private browsing mode.

    This feature should've been added a very long time ago, its not to nice when your paying bills and trying to stay in private mode when opening the urls from keepass. This feature alone has saved me NO less then ten minutes over the course of a year, take it from me, Time Means Everything!

  17. janicetr January 12, 2016 at 7:10 pm #

    I use Bruce Schneier's Password Safe (https://www.pwsafe.org/).

    • clas February 20, 2016 at 4:58 pm #

      yes, janicetr, i also use bruce's Password Safe. i have tried both keypass and password safe and prefer the latter. works nicely in both windows and linux. not all autofill sites work, however. but most do and if not its easy to copy and paste, then minimize the password program which empties the copy program. the cloud is just out for me. why put my most sensitive stuff on someone else's computer. thats just a disaster waiting to happen.

  18. clriis January 13, 2016 at 1:24 am #

    Regarding KeePass. Please read this old but excellent article:

    http://ddaydj.blogspot.dk/2011/07/automatically-open-secure-keepass.html

  19. anaemic January 17, 2016 at 4:51 am #

    Is it possible to install KeePass v2.31 over Keepass v1.29 safely and without losing passwords.

    • Martin Brinkmann January 17, 2016 at 8:11 am #

      They are different programs, but KeePass 2 supports the import of KeePass 1 password databases.

      • anaemic January 17, 2016 at 8:43 am #

        Thanks for your reply.

  20. anaemic January 17, 2016 at 9:18 am #

    KeePass 2.31 is more secure than KeePass v1.29 with the Auto-Type feature. Keepass2 has 'Two-Channel Auto-Type Obfuscation.'

Leave a Reply