If you have gone looking for an offline password manager, you have run into two programs with almost the same name, the same logo lineage and the same file extension - and very little explanation of why both exist. The confusion is understandable, and it clears up quickly once you know one thing: they are not two versions of one product. They are two independent programs that happen to read the same database.
Short answer
KeePassXC is the better default for most people in 2026, because it runs natively on Linux, macOS and Windows and has browser integration, TOTP codes and an SSH agent built in. KeePass is the original, is Windows-first, and earns its place through a large plugin ecosystem that can do things nothing else does. Crucially, both read the same .kdbx file, so this choice is reversible at any time - you are not locked in by picking one today.
Why there are two programs at all
KeePass came first: a Windows password manager written by Dominik Reichl in C# on the .NET framework, released under an open source licence. Because the code was open and the format documented, a separate project called KeePassX appeared to give Linux users a native application rather than a .NET program running under emulation. KeePassX was later succeeded by KeePassXC - the XC stands for Cross-Compatible - maintained by a community team that picked up development when KeePassX went quiet.
So the family tree matters: KeePassXC is not a fork of today's KeePass 2.x. It descends from a separate line that started with the early KeePass and was rewritten in C++ with the Qt toolkit. That is why the two programs look different, behave differently and ship on different schedules, while still speaking the same file format.
What they share: the database
This is the part worth understanding before any feature comparison, because it changes the stakes of the decision.
Both programs store your entries in a single encrypted KDBX file, unlocked by a master password, optionally combined with a key file. There is no server, no account and no sync service in either program - the file sits wherever you put it, and if you want it on several machines you put it in whatever storage you already trust.
The practical consequence: switching is not a migration. You do not export, convert and re-import. You install the other program and open the file you already have. If you try one for a week and dislike it, you have lost nothing but the download. Two habits are still worth keeping - back the file up before opening it in a new program, and if one program has written a newer KDBX version than the other supports, update the older program first.
Where they genuinely differ
Platform and technology
KeePass is a C#/.NET application designed for Windows, where it is entirely at home. It can run on Linux and macOS through Mono, but that route means extra setup and an interface that never quite belongs on those desktops.
KeePassXC is C++ with Qt, with native builds for Windows, macOS and Linux. If you move between operating systems - or if you are not on Windows at all - this difference alone usually settles the question.
Built in versus bolted on
The clearest philosophical split is what belongs inside the program.
KeePassXC builds the capabilities most people want directly into the application: integration with browsers via the official KeePassXC-Browser extension, generation of TOTP two-factor codes, and an SSH agent that can hold your keys. You install one program and those features are there.
KeePass keeps the core smaller and delegates to plugins. Browser integration, in particular, comes from third-party plugins rather than the program itself. This is not a shortcoming so much as a different bargain: you assemble the setup you want, and you maintain the pieces you assembled.
The stance on plugins
That bargain deserves to be stated plainly, because it is the real trade-off.
KeePass has a large plugin ecosystem covering import and export formats, synchronisation schemes, interface changes and integrations of every kind. If you have a specific requirement, there is a reasonable chance someone has already written the plugin.
KeePassXC does not support plugins at all, deliberately. The reasoning is that third-party code executing inside a password manager, with access to the decrypted database in memory, is a large attack surface to accept in exchange for convenience. Reasonable people weigh that differently - but it is a considered position, not an unfinished feature.
If your requirement is met by KeePassXC's built-in features, its approach gives you less to maintain and less to trust. If your requirement is met only by a plugin, KeePass is the program that can do it.
Security posture
Both are open source, so the code of either can be inspected. The honest comparison is about upkeep rather than a winner.
A vulnerability disclosed in 2023 and tracked as CVE-2023-32784 made it possible to recover most of a master password from the memory of a running KeePass 2.x process - a consequence of how the managed .NET runtime handled text in memory. It was fixed in KeePass 2.54.
The useful lesson is not that one program is unsafe. It is that the version you are actually running matters more than which project you chose. An outdated KeePassXC is no better than an outdated KeePass. Whichever you pick, keep it updated, and get it from the project's own site or your distribution's repositories rather than from a mirror.
How to choose
Choose KeePassXC if you use Linux or macOS, or move between operating systems; you want browser integration and TOTP codes without assembling them yourself; or you would rather not run third-party code inside your password manager.
Choose KeePass if you are on Windows and need a capability that only its plugin ecosystem provides, or you already run a plugin-based workflow that works well for you.
Choose neither if you want a vault that syncs across your devices with no effort on your part. Both of these programs are file-based by design and leave sync to you. That is a feature if you want control, and an obstacle if you do not - in which case a hosted or self-hosted manager is the honest recommendation. See our comparison of open source password managers for options that cover that ground, or the guide to self-hosting your own vault if you want sync without handing your data to a provider.
The bottom line
The question "KeePass or KeePassXC" carries less weight than it appears to, and that is good news. They read the same database, so no answer traps you. For most people in 2026 the sensible default is KeePassXC - genuinely cross-platform, with the features you would otherwise have to bolt on already inside. KeePass remains the right answer for Windows users whose needs are met specifically by its plugins.
Pick one, keep it updated, and remember that the strength of either comes down to the same thing: a long, unique master password that exists nowhere else.
Frequently asked questions
Are KeePass and KeePassXC the same program?
No. They are two separate programs that read and write the same database format. KeePass is the original Windows project by Dominik Reichl, written in C# on .NET. KeePassXC is an independent community project written in C++ with Qt, descended from KeePassX, which was itself a Linux port of the early KeePass. They share a file format and a name, not a codebase.
Can I open the same .kdbx file in both?
Yes, and this is the single most useful fact about the pair. Both support the KDBX format, so the same database opens in either program with the same master password or key file. Switching is not a migration - you point the other program at the file you already have. Back it up first as a matter of habit, and if one program has written a newer format version than the other supports, update the older program before opening it.
Which one is better for Linux or macOS?
KeePassXC. It is written in C++ with Qt and ships native builds for Linux, macOS and Windows, so it looks and behaves like a normal application on each. KeePass is a .NET application built for Windows; it can run on Linux and macOS through Mono, but that path involves extra setup and a less native experience.
Does KeePassXC support plugins like KeePass does?
No, and that is a deliberate design decision rather than a missing feature. KeePass has a large third-party plugin ecosystem that extends it in almost every direction. KeePassXC does not load plugins at all, on the grounds that arbitrary third-party code running inside a password manager enlarges the attack surface. Instead it builds the most-wanted capabilities - browser integration, TOTP codes, an SSH agent - directly into the program.
Do I still need a browser extension plugin?
With KeePassXC, no separate plugin is needed on the application side: browser integration is built in and pairs with the official KeePassXC-Browser extension. With KeePass, browser integration is provided by third-party plugins, so you choose one, install it, and keep it updated alongside the program itself.
Is KeePass less secure than KeePassXC?
Neither is unsafe, and both are open source, so the honest answer is about maintenance rather than a verdict. A vulnerability disclosed in 2023 (CVE-2023-32784) allowed much of the master password to be recovered from the memory of a running KeePass 2.x process; it was fixed in KeePass 2.54. What that episode illustrates applies to both programs equally: the version you actually run matters more than the badge on the box. Keep whichever you choose up to date.
Which should I choose in 2026?
If you want an offline password manager that works the same on Linux, macOS and Windows with browser integration and TOTP already included, choose KeePassXC - it is the better default for most people today. Choose KeePass if you are on Windows and want a specific capability that only its plugin ecosystem provides. Because the database format is shared, this decision is reversible at any time.
