A hosted password manager keeps your vault on someone else’s server and asks you to trust their uptime, their breach disclosure and their billing. An offline vault flips that: the database is one file on your own disk, and nothing leaves the machine unless you copy it there. KeePass 2 and KeePassXC have worked this way for two decades, cost nothing, and read the same .kdbx file on Windows, macOS, Linux, Android and iOS.
What an offline vault really is, and what it costs you
The whole product is one file: 200 logins land between 20 and 60 KB, encrypted with AES-256 in the KDBX 4 format. There is no account, no sync server and no support desk that can unlock it. That is the trade: nobody can breach a server that does not exist, and nobody can rescue you from a forgotten master passphrase either. You are the sync layer and the backup layer too.
Create the database on Windows in about ten minutes
Download from the official project page at keepass.info/download.html — the installer is around 3 MB, and there is a portable ZIP if you want the vault on a USB stick with no install at all. On a Mac or Linux machine, KeePassXC 2.7.x is friendlier and writes a compatible file.
In KeePass 2, choose File › New. The wizard asks for a database name, confirms AES-256 and KDBX 4, then takes your master passphrase. Use six randomly chosen words instead of a clever substitution of a familiar one — copper lantern violet thimble fjord tandem is roughly 77 bits of entropy and much easier to type on a phone than P@ssw0rd!2026. Recent builds offer to print an emergency sheet; take it, and keep the paper away from the backup drive.
The optional key file is worth understanding. With one enabled, an attacker needs both the .kdbx and the key file, which defeats a stolen laptop plus a guessable passphrase — but losing the key file locks you out permanently, even with the right passphrase. Keep one copy on a separate stick and one on paper. Save the database to C:UsersyournameVaultmain.kdbx rather than Downloads or the Desktop, where cleanup tools and helpful relatives delete things.
Set the security limits before you fill it
Defaults matter more than features here. Open Tools › Options › Security and check two numbers: clipboard auto-clear, 12 seconds by default, and workspace lock after inactivity, 300 seconds. On a laptop that travels, drop the lock timer to 120; the annoyance is trivial next to a vault sitting open on a train tray table.
Under Database › Database Settings › Security is the key derivation function. KeePass 2 ships with AES-KDF at 600,000 rounds; KeePassXC 2.7 uses Argon2d at 64 MiB and 10 rounds. Both take about a second to unlock on a five-year-old Core i3, and that second is charged to whoever guesses passwords against the stolen file.
Set the generator at Tools › Generate Password to 20 characters with upper case, lower case, digits and symbols, and tick “exclude similar characters” so l, 1 and I never appear. Two bank portals still cap you at 8 or 12 characters; use 12 with symbols there.
Auto-Type (Ctrl+Alt+A) is excellent in desktop apps and risky on pages with hidden form fields, where keystrokes land in a box you cannot see. For banking, copy with Ctrl+C instead.
Backups are the part people skip and regret
Because the vault is one small file, it backs up like a document. Close the database cleanly, then copy the .kdbx to a second place. Three copies is the right target: the laptop, a USB stick kept elsewhere in the house (a 32 GB stick costs about BDT 700–900), and one copy off-site. A cloud copy is fine since the file is already encrypted; the risk is a weak passphrase.
KeePass’s “backup before saving” option gives you a single .kdbx.bak, overwritten on every save — that covers one bad write, not a corruption you save over twice. Make dated copies instead (main-2026-10-30.kdbx) and keep four weeks.
Then test one: open the newest backup on a second device. A backup you have never opened is a wish. KeePassXC also handles two machines editing the same file — Database › Merge from database reconciles both sets of entries instead of making you pick one and lose the other.
Keeping it current without turning it into a chore
The habit that makes an offline vault survive is boring: every time you create an account, add the entry before you close the tab. Right-click the group, Add Entry, paste the URL, hit the dice for a generated password, save. Where a site offers passkeys, keep the passkey in the phone’s keychain and the password in the vault as the fallback — passkeys on your phone walks through that pairing.
Once a month, sort the entry list by password quality and fix anything reused — about ten minutes for a hundred entries. Delete logins for accounts you no longer use, then open the latest backup to confirm it still decrypts.
Migrating from a browser? The import is the fiddly part, and these password manager habits cover it. Google’s Password Checkup shows which accounts are still on a breached or reused password before you move them across.
An offline vault stops being right for shared family access, or a household where nobody maintains backups. For one person willing to copy a file to a stick twice a month, KeePass gives the same encryption without a middleman.