Keepass2Android

Keepass2Android is a password manager by Philipp Crocoll for databases in the KeePass format, the open format of the Windows password manager KeePass. It has more than a million downloads on Google Play, and KeePass’s own website lists it among unofficial KeePass ports. The same database file can be opened on a computer with KeePass or KeePassXC.

Where your database lives

The app can open and save databases on the phone, through Android’s file picker, or directly in Dropbox, Google Drive, OneDrive, pCloud, MEGA, a WebDAV server such as Nextcloud, an SFTP, FTP or FTPS server, or a Windows (SMB) share. For remote databases it keeps a copy in its own storage by default, so “This allows to use databases even while the database file is not accessible”, and since version 1.15, with Synchronize in background switched on, it loads and saves that copy first and synchronises with the remote file afterwards. Version 1.15-r6 extends this to adding groups, deleting and moving entries, and opens the database from the copy straight away instead of waiting for the remote file. Background sync can be limited to Wi-Fi, or to chosen Wi-Fi networks, and can also run periodically while a database is unlocked; both are off by default.

Features

• KeePass formats up to KDBX 4.1, and the older KeePass 1 format, with AES, ChaCha20 or Twofish encryption and Argon2 key derivation.
• QuickUnlock, on by default: after you open the database once with the full password, the last three characters of the password, or your fingerprint, open it again. Since version 1.13, unlocking with password characters is blocked if the phone has no screen lock.
• Autofill through Android’s autofill service, and a built-in keyboard for typing passwords, which the wiki recommends because it’s “safe against clipboard loggers”.
• Two-factor codes stored in entries, in several plugin formats; you can scan a QR code to add one.
• Unlocking with a key file, a YubiKey or other challenge-response devices, entry templates, and a backup copy made after each successful load.

What goes online

For your database, the app connects only to the storage you set up: the privacy policy says “The app does not integrate analytics, advertising, or tracking SDKs. Connections to third-party cloud services occur only when you explicitly configure them.” We found no update check and no icon downloads in the code.

The exception is Google’s code. The full version contains closed-source Google libraries: Google Play services for Google Drive sign-in, and Google’s ML Kit code scanner for QR codes, with Google’s logging component. Keepass2Android starts the scanner when you tap the scan button for a two-factor code, and Google says ML Kit collects device information, app versions, performance and error data “for diagnostics and usage analytics”. Whether these libraries send anything if you never use the scanner or Google Drive we couldn’t check, as their code is closed. They are why the app isn’t on F-Droid, and the Offline version leaves them all out.

Our scan flags “OpenTelemetry (OpenCensus, OpenTracing)”. That comes from Google’s HTTP library for Google Drive, which contains the OpenCensus interface but no implementation or exporter, so, as far as we can tell, it records and sends nothing. Our scan reads only the app’s Java code, though; Keepass2Android’s own code is written in .NET, which the scan doesn’t cover.

Back on Google Play

In early October 2026 Google removed the app from Play. The developer explained: “Google banned the app because they say it was violating their guidelines (because it has the “donations” links built in which lead to Paypal payments).” He then “published a release without the donation menu option to make sure it’s back quickly”, and the app is on Play again. A full-screen donation reminder still exists: it appears only after more than five uses, in a few short periods of the year, and the setting Never ever ask for donation turns it off.

About this file

• This is the developer’s own build of version 1.15-r6, published on GitHub on 15 October 2026: the regular version with cloud storage, as one APK for all processors. It is signed with the developer’s key from 2013, which still uses the older SHA-1 signature algorithm.
• 1.15-r6 fixes connection problems with WebDAV servers, with longer timeouts and an error message when the server can’t be reached instead of a progress window that never closes, fixes background sync, and saves Wi-Fi names containing “|” correctly. 1.15-r5, a week earlier, removed the donation menu.
• Open reports: on Android 16 the built-in keyboard can overlap the app’s bottom toolbar (#3301), and one user reported that adding attachments damaged other attachments in the database (#3298), which hasn’t been confirmed yet.
• The 73.1 MB file runs on Android 5.0 and later, on ARM and x86, 32- and 64-bit. Of its 20 permissions, location is used only for Wi-Fi names, and account access only for choosing a Google account for Google Drive.
• The screenshots are from the app’s Google Play listing and show an older version in German.
• Keepass2Android is licensed under the GPL-3.0. The source of this version is at https://github.com/PhilippC/keepass2android/tree/v1.15-r6. It isn’t affiliated with KeePass or its developer, Dominik Reichl.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Recent releases on the project’s GitHub. We host and check only the newest one. Full changelog.