KeePass 1.x Database (KDB)
| Format | KeePass 1.x Database (KDB) |
|---|---|
| Short name | KDB |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The password database format of KeePass 1.x and KeePassX. The fixed-size header is readable without the key: encryption flags (AES or Twofish), format version, master seed, IV, the number of groups and entries, a content hash, the transform seed and the number of key transformation rounds, which determines the effort of password attacks. Groups and entries with titles, user names, passwords, URLs and notes are encrypted with a key derived from the master password and/or key file. Signature 1 is shared with the newer KDBX format; only signature 2 distinguishes them.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 03 D9 A2 9A | .... | Signature 1 0x9AA2D903 (shared with KDBX) |
| offset 4 (0x4) | 65 FB 4B B5 | e.K. | Signature 2 0xB54BFB65 (KeePass 1.x) |
Known extensions
.kdb
References
- KeePass1.h — format constants (KeePassXC) https://github.com/keepassxreboot/keepassxc/blob/develop/src/format/KeePass1.h
- KeePass1Reader.cpp — header layout (KeePassXC) https://github.com/keepassxreboot/keepassxc/blob/develop/src/format/KeePass1Reader.cpp
Cite this entry
Crush Format Reference, “KeePass 1.x Database (KDB)”. https://kalink0.github.io/crush-forensics/formats/kdb/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction