Is KeePassXC-Browser safe?

Clean risk

KeePassXC-Browser reads form credentials and passkeys on all websites and routes them to the local KeePassXC desktop app.

The extension injects content scripts on every page to detect login forms and capture submitted usernames and passwords, offering to save them to the user's local KeePassXC database. It also overrides the browser's WebAuthn/Passkeys API so passkey operations are handled by KeePassXC. All credential data is transmitted exclusively to the local KeePassXC application via native messaging or a localhost WebSocket; no data is sent to remote servers.

KeePassXC Teamv1.10.4.1Firefox Add-ons
3Risk
Who publishes it

KeePassXC Team - no other listings under this identity, 5 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
KeePassXC Team
Website
keepassxc.org/

Shared hosts - 5 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

another.example.co.uk
Also called by 2 other listings, including KeePassXC-Browser
forkawesome.github.io
Also called by 2 other listings, including KeePassXC-Browser
another.example
Also called by 3 other listings, including KeePassXC-Browser, COMPR
keepassxc.org
Also called by 4 other listings, including KeePassXC-Browser, KeePass Tusk, KeePass Tusk - Password Access and Autofill
lukas-schulze.de
Also called by 5 other listings, including chromeIPass, KeePassHttp-Connector

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.10.4.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on api.github.com

    https://api.github.com/

  • Act on the current tab, but only after you click the extension

    activeTab

  • Write to your clipboard

    clipboardWrite

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

  • Show you desktop notifications

    notifications

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Watch every request your browser makes

    webRequest

  • Watch, block and rewrite every request your browser makes

    webRequestBlocking

Updated 2 November 2026amo-917354