Composite Master Key This document details how KeePass locks its databases.

• Master Passwords
• Key Files
• Windows User Account
• For Administrators: Specifying Minimum Length/Quality of Master Passwords

KeePass stores your passwords securely in an encrypted file (database). This database is locked with a master password, a key file and/or the current Windows account details. To open a database, all key sources (password, key file, ...) are required. Together, these key sources form the Composite Master Key.

KeePass does not support keys being used alternatively, i.e. it's not possible that you can open your database using a password or a key file. Either use a password, a key file, or both at once (both required), but not interchangeably.

  Master Passwords

If you use a master password, you only have to remember one password or passphrase (which should be good!) to open your database. KeePass features protection against brute-force and dictionary attacks on the master password, read the security information page for more about this.

If you forget this master password, all your other passwords in the database are lost, too. There isn't any backdoor or a key which can open all databases. There is no way of recovering your passwords.

  Key Files

You don't even have to remember a long, complicated master passphrase. The database can alternatively be locked using a key file. A key file is basically a master password in a file. Key files are typically stronger than master passwords, because the key can be a lot more complicated; however it's also harder to keep them secret.

If you lose the key file and have no backup copy of it, your passwords in the database are lost, too. It's just the same as forgetting the master password. There is no backdoor.

The point of a key file is that you got something to authenticate with (in contrast to master passwords, where you know something), for example a file on a USB stick. The key file content (i.e. the key data contained within the key file) needs to be kept secret. The point is not to keep the location of the key file secret — selecting a file out of thousands existing on your hard disk basically doesn't increase security at all (it's very easy for malware/attackers to find out the correct file, for example by observing the last access times of files). Trying to keep the key file location secret is security by obscurity, i.e. not really effective.

KeePass can generate key files for you, however you can also use any other, already existing file (like JPG image, DOC document, etc.).

  Windows User Account

  For Administrators: Specifying Minimum Length/Quality of Master Passwords

Administrators can specify a minimum length and/or the minimum estimated quality that master passwords must have in order to be accepted. You can tell KeePass to check these two minimum requirements by adding/editing appropriate definitions in the INI/XML configuration file.