KeePass Compatibility

PanicVault stores your passwords in the open KeePass .kdbx file format rather than a proprietary database, so your data is never locked into one app. This page explains the format, which other applications can open your vaults, the ciphers and key derivation functions PanicVault supports, and exactly what it preserves when it saves a file.

What is the KeePass Format?

KeePass is an open-source password manager that uses the .kdbx file format. This format is an open standard, meaning your passwords are never locked into a proprietary system. Many applications on different platforms can read and write .kdbx files.

PanicVault uses the KDBX 4 format, which is the current version of the standard.

Interoperability

Your PanicVault databases can be opened in:

• KeePass (Windows) – the original KeePass application
• KeePassXC (Windows, Mac, Linux) – a popular cross-platform client
• KeePassDX (Android)
• Strongbox (iOS, Mac)
• Any other application that supports the KDBX 4 format

Similarly, PanicVault can open .kdbx files created by any of these applications. To bring an existing file in, see Getting Started. You can even keep the same file open in PanicVault and KeePassXC at once – in a folder on your Mac or in iCloud Drive: PanicVault merges what KeePassXC saves instead of overwriting it (see Vaults Synced by Another App and Vaults Kept Elsewhere in iCloud Drive).

Opening an Older KeePass Database

If PanicVault tells you that a file is an older KeePass database — a KDBX 3.1 database, a KDBX 2.x database, or a KeePass 1.x .kdb file — nothing is wrong with it. PanicVault reads and writes KDBX 4 only, and the file is in an earlier format. Open it once in KeePassXC or KeePass, save it as KDBX 4, and PanicVault opens it from then on. Your master password does not change, and neither do your entries, attachments, key file or YubiKey setup.

In KeePassXC (Windows, Mac, Linux):

1. Open the database in KeePassXC and unlock it
2. Choose Database → Database Settings
3. Click Security in the list on the left, then select the Encryption Settings tab
4. Set Database format to KDBX 4 (recommended)
5. Select the Advanced tab below it and check that Key Derivation Function now shows Argon2d (KDBX 4 – recommended)
6. Click OK, then choose Database → Save Database

KeePassXC picks the file format from the key derivation function, so step 5 is what upgrades the format: if you click OK while the Basic tab is showing, KeePassXC keeps the old key derivation settings and the saved file is still not KDBX 4.

In KeePass 2 (Windows, version 2.35 or later):

1. Open the database in KeePass and unlock it
2. Choose File → Database Settings
3. Select the Security tab
4. Set the key derivation function to Argon2d
5. Click OK, then choose File → Save

KeePass writes KDBX 4 whenever the database uses Argon2 or ChaCha20, so switching the key derivation function to Argon2d is what upgrades the format.

A KeePass 1.x .kdb file cannot be converted in place — it is a different format, not an older version of the same one. Import it first, then upgrade the result:

• KeePass 2: File → Import, choose KeePass KDB (1.x), pick the .kdb file, then save the new database and follow the KeePass 2 steps above
• KeePassXC: Database → Import, choose KeePass 1 Database (.kdb), pick the .kdb file, enter its password and import into a New Database. KeePassXC then walks you through setting up the new database, including its password, and creates it as KDBX 4 — save it and there is nothing left to upgrade

Then add the converted .kdbx file to PanicVault the usual way — see Getting Started.

Supported Encryption

PanicVault supports the following encryption algorithms for the outer database encryption:

• AES-256-CBC – the default and most widely supported cipher
• ChaCha20 – a modern stream cipher, used by some KeePass clients

New vaults created in PanicVault use AES-256 by default.

PanicVault does not support Twofish, which KeePassXC also offers, and says so when you open a Twofish vault: to use it here, open it in KeePassXC, choose Database → Database Settings → Security → Encryption Settings → Advanced, set Encryption Algorithm to AES 256-bit or ChaCha20 256-bit and save – your master password and entries stay the same.

Supported Key Derivation

Key derivation functions transform your master password into the encryption key. PanicVault supports:

• Argon2id – the default for new vaults. A memory-hard function that resists brute-force attacks even with specialized hardware, and combines data-dependent and data-independent memory access for additional side-channel resistance. New databases use 64 MB of memory and 10 iterations by default.
• Argon2d – the other Argon2 variant, used by many KeePass and KeePassXC databases
• AES-KDF – the older key derivation function, which KeePass 2 still uses and KeePassXC offers as AES-KDF (KDBX 4)

When PanicVault saves a vault, it keeps the vault’s key derivation function and encryption: an AES-KDF vault stays AES-KDF, with the same number of rounds, and a ChaCha20 vault stays ChaCha20. The saved file opens in KeePass and KeePassXC with the same password as before.

PanicVault puts no ceiling of its own on these settings. It accepts any iteration count and any memory size the device can provide, so a database that KeePassXC benchmarked to one second on a fast desktop, or one created with your Mac’s full thread count as its parallelism, opens here exactly as it was written. A vault that asks for more memory than this device can give is refused in those terms — “This vault’s key derivation needs 2 GB of memory; this device can give it 1.3 GB.” — rather than being called corrupted, and the same vault opens on a machine with more memory. See Unlocking Your Vault for what a slow key derivation looks like while it runs.

Hardware Keys and Challenge-Response

PanicVault supports KeePassXC-style YubiKey HMAC-SHA1 challenge-response, in both directions:

• A .kdbx file created in PanicVault with a YubiKey opens in KeePassXC with the same key and slot
• A KeePassXC database that uses challenge-response opens in PanicVault
• The same scheme is used by Strongbox and KeePassium, so those apps interoperate too

PanicVault reads a YubiKey over NFC on iPhone, and over USB on Mac. It cannot read one on iPad, over USB-C on an iPhone or iPad, or over Lightning (including the YubiKey 5Ci). See Hardware Keys (YubiKey) for the full picture.

Two limits are worth knowing:

• The KeeChallenge plugin format is not supported. KeeChallenge is a KeePass 2 plugin that keeps an encrypted copy of the HMAC secret in an .xml file next to the database. That is a different mechanism from KeePassXC’s, it needs a second file to be kept in sync, and it stores the secret at rest. If your database uses KeeChallenge, open it in KeePass 2, use its recovery mode to read out the secret, and reconfigure the database with KeePassXC-style challenge-response instead.
• KDBX 3.x is not supported, with or without a hardware key. PanicVault reads and writes KDBX 4 only — Opening an Older KeePass Database has the steps for converting one, and your YubiKey settings survive the conversion.

One behavioral difference, which does not affect compatibility: KeePassXC generates a new key derivation seed on every save and therefore asks for a YubiKey touch every time it saves. PanicVault reuses the seed for the unlocked session, so it asks for one touch when you unlock and none when you save. The files themselves are identical in format and open in either app.

What PanicVault Preserves

When you open and save a .kdbx file in PanicVault, it preserves:

• All entries, groups, and their full hierarchy
• Entry history (previous versions)
• Custom fields (protected and unprotected)
• Attachments (binary files)
• Custom icons
• TOTP configurations (all supported formats)
• Passkey data (KeePassXC KPEX_PASSKEY_* fields)
• Auto-Type configurations
• Memory protection settings
• Recycle Bin state
• Database metadata (name, description, default username, colors)
• Entry and group metadata (creation time, modification time, expiry, tags, colors, last access time and usage count — and PanicVault keeps the usage counters up to date as you use an entry, the same way KeePassXC does)

For details on the individual formats, see Two-Factor Authentication (TOTP) and Passkeys (WebAuthn).