Keepass How To Install Plugins

Update 17. 1. 2022: come across the bottom of the article

Update 9. half dozen. 2022: The links to PassIFox are expressionless now. Please utilize KeePassHttp-Connector only. I'm striking out the links to it in this article. Thanks, Jeremie, for pointing it out to me.

After a long time of using both KeePass and (synced) Firefox password manager to store my passwords, I wanted to observe out whether I can use KeePass for both. I ended up liking this setup, so hither's how you tin can replicate information technology.

The unabridged process has these master steps:

Consign passwords from Firefox,
Import them into KeePass,
Install a couple of necessary plugins,
Connect Firefox to KeePass.

If you'd rather explore on your ain, see the lesser of this mail for a shortened version of the process, with links.

0. Consider turning off Firefox'due south Password Sync feature.

I'd been using Firefox'southward Sync feature for Passwords for a long time. After connecting FFox to KeePass, I've encountered some weird behaviour. It probably can be fixed - the PassIFox'south page says information technology should piece of work - merely I've realized that since I'1000 now using KeePass as a master database, in that location is no reason to upload them to Firefox's servers, as well. And so I've just disabled it. You can practise information technology in Sync settings.

Turn off password sync

1. Consign passwords from Firefox

I've used this addon. Simply install it (doesn't require a browser restart), go to Firefox's Settings, click Security, where y'all should at present run into a button saying Import/Consign Passwords. Click it, and so simply click Export Passwords (no obfuscation needed) to the default XML format. You should go a file called something like countersign-export-2017-02-23.xml. Save information technology somewhere.

ii. Import passwords to KeePass

Install Firefox to KeePass Password Importer.

I've installed the extension according to instructions (copy-paste into the Plugins folder, which required admin privileges), just haven't been able to get information technology to import from Firefox directly - it either concluded with an error, or crashed KeePass completely.
That'south why, in the step above, you've exported your passwords into an XML.

You have to close KeePass and launch it over again in order to load the plugin. So go to File | Import, select Firefox XML (at the bottom of the list), scan to your exported XML file and confirm.

Another screen will pop upward.

After clicking Outset, you should become a popular-upwardly maxim how many entries were imported.

3. Uninstall plugins yous no longer need

If everything seems okay, I propose you lot exit KeePass once again and delete the PW Exporter plugin, since yous won't be needing it once again.

Likewise uninstall the Password Exporter addition from Firefox.

four. Install KeePass HTTP

If y'all are on Windows and use Chocolatey, you tin can install it with:

          choco install keepass-keepasshttp -y

If not, manual install instructions are at its home page. (But mayhap check Chocolatey out. ;)

This stride of the process was the reason I was wary of this setup at outset - I didn't desire all my sensitive information exposed over some dizzy, unprotected interface. But after some reading and experimentation, it seems that it really does encrypt everything with AES.

5. Install the PassIFox add together-on (or KeePassHttp-Connector)

PassIFox connects Firefox to KeePass using the KeePassHttp interface, and completely replaces the born Firefox countersign store with KeePass. (It also does some other things, which are not relevant for now, but are definitely worth checking out.)

Update: equally mentioned at the start of the article, please utilise KeePassHttp-Connector instead.

After yous install the plugin, you lot are prompted to restart Firefox. When you do and so, you should be prompted to connect to KeePass.

Make sure your KeePass is running and unlocked, and click Connect in Firefox. KeePass should brandish a prompt with Firefox's new encryption key and ask y'all to requite it a name. Once yous confirm it, you're done. You can verify everything works by going into Firefox'due south Options -> Security and clicking Saved Logins.... a listing of your logins, now loaded from KeePass, should appear.

6. Wrapping up

I've as well removed Firefox'south principal password. Since FFox doesn't store whatever passwords any more, and simply can admission them if KeePass is unlocked, I don't encounter the signal of keeping it. (Please permit me know if I'd simply opened some glaring security hole. 😇)

There now should be an entry chosen KeePassHttp Settings in your KeePass database'south root element, storing your browser's encryption fundamental. Any new passwords saved from the browser are stored in a folder called KeePassHttp Passwords. If whatever of these two entries can be renamed, I oasis't found out how, yet.

That's nearly it. So the tl;dr version of the entire process is:

Export passwords from Firefox with the Password Exporter, and delete the add together-on after.
Download the Password importer plugin for KeePass, import the passwords exported in stride 1., and delete the plugin
Install KeePassHttp with choco install keepass-keepasshttp
Install PassIFox
Connect PassIFox to KeePass when prompted

and you're washed.

Update 17. 1. 2022: more security considerations
As Nikolaus Demmel pointed out to me (cheers!), just disabling your chief password without deleting the passwords beginning might get out them on your disk in unencrypted form. This article mentions the files that shop them: key3.db and logins.json - you could merely delete them. Or you could disable PassIFox, restart Firefox, open its Password director - and if there'due south annihilation at that place, delete it. (Then enable PassIFox and restart again.)

Too note that if yous're using Firefox Breakthrough, the original PassIFox is probably incompatible and you might desire to utilise a different 1. I now use KeePassHttp-Connector, which integrates with Firefox in a different manner and doesn't completely supplant the congenital-in password director, and then disabling the plugin is not necessary.