KeePass Database (KDBX)
| Format | KeePass Database (KDBX) |
|---|---|
| Short name | KDBX |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The password database of KeePass, KeePassXC and compatible apps. Outside the encrypted payload only the header is readable: format version (offset 8), cipher, compression, master seed and IV; from KDBX 4 on also the key derivation function and its parameters (e.g. AES-KDF or Argon2 with rounds/memory), protected by an HMAC-SHA-256. The KDF parameters determine the effort of password attacks. Entries with titles, user names, passwords, URLs, notes and history are encrypted with a key derived from the master password and/or key file. Signature 1 is shared with the older KeePass 1.x format (.kdb); only signature 2 distinguishes them.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 03 D9 A2 9A | .... | Signature 1 0x9AA2D903 (shared with KeePass 1.x) |
| offset 4 (0x4) | 67 FB 4B B5 | g.K. | Signature 2 0xB54BFB67 (KeePass 2.x / KDBX) |
Known extensions
.kdbx
References
- KDBX File Format Specification (KeePass) https://keepass.info/help/kb/kdbx.html
- KDBX 4.1 (KeePass) https://keepass.info/help/kb/kdbx_4.1.html
Cite this entry
Crush Format Reference, “KeePass Database (KDBX)”. https://kalink0.github.io/crush-forensics/formats/kdbx/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction