otty / dotfiles

All tools/KeePassXC

KeePassXC

keepassxc

A modern, secure, and open-source password manager that stores and manages your most sensitive information.

Detected by keepassxc, keepassxc-cli | macOS, Linux, Windows |keepassxc.org

Sync it keepassxc.toml

Sync rules

What travels, what stays, what never leaves

KeePassXC in your home directory Every rule on this page, by file

DefaultDatabaseFileName

Each machine keeps its own copy of these.

CustomProxyLocation

Each machine keeps its own copy of these.

…

BackupFilePathPattern={DB_FILENAME}.old.kdbx

AutoSaveAfterEveryChange=true

AutoSaveOnExit=true

DefaultDatabaseFileName=/Users/octocat/Documents/passwords.kdbxmachine-local

MinimizeAfterUnlock=false

NumberOfRememberedLastDatabases=5

RememberLastDatabases=true

…

Each machine keeps its own copy of these.

…

SearchInAllDatabases=true

SupportBrowserProxy=true

UseCustomProxy=true

CustomProxyLocation=/opt/homebrew/bin/keepassxc-proxymachine-local

[SSHAgent]

Enabled=true

…

Each machine keeps its own copy of these.

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/keepassxc.tomlThe file this page is generated from

id = "keepassxc"

name = "KeePassXC"

homepage = "https://keepassxc.org"

description = "A modern, secure, and open-source password manager that stores and manages your most sensitive information."

icon = "SimpleIcons:keepassxc"

# keepassxc is the application binary the Linux packages install; keepassxc-cli

# is the command line half, which the Homebrew cask symlinks onto the PATH

# ("$APPDIR/KeePassXC.app/Contents/MacOS/keepassxc-cli" → "$HOMEBREW_PREFIX/bin/

# keepassxc-cli", https://formulae.brew.sh/api/cask/keepassxc.json) and ships a

# man page for.

detect = ["keepassxc", "keepassxc-cli"]

# src/core/Config.cpp, Config::defaultConfigFiles(), is the authority on where

# the settings file goes. It returns a *pair*: a roaming config and a local one.

# Windows: QStandardPaths::AppDataLocation (%APPDATA%/KeePassXC)

# macOS: QStandardPaths::AppDataLocation (~/Library/Application

# Support/KeePassXC)

# else: QStandardPaths::GenericConfigLocation + "/keepassxc", with the

# comment "On case-sensitive Operating Systems, force use of

# lowercase app directories"

# then `configPath += QString("/keepassxc%1.ini")`. main.cpp sets the

# application name that Qt appends: Application::setApplicationName("KeePassXC").

# So the same file has two spellings that differ in case, and no single base

# directory covers both. GenericConfigLocation is $XDG_CONFIG_HOME (Linux) and

# %APPDATA% (Windows) — that is [configHome]; Windows spells the folder

# KeePassXC rather than keepassxc, and the filesystem there is case-insensitive,

# so the resolved path is the same file. macOS is written out on its own.

# $KPXC_CONFIG overrides the location outright; a portable install keeps its

# config next to the binary instead.

paths = [

"[configHome]/keepassxc/keepassxc.ini",

"~/Library/Application Support/KeePassXC/keepassxc.ini",

]

# The *local* half of that pair — window geometry, LastDatabases, LastDir,

# LastKeyFiles, LastActiveDatabase, all declared `Local` in Config.cpp's

# settings table — is a second file in a different directory

# (~/.local/state/keepassxc on Linux, ~/Library/Caches on macOS,

# %LOCALAPPDATA% on Windows). It is not under either path above, so the

# machine-local half stays behind by construction.

exclude = []

# The .ini is settings only. Passwords live in the user's .kdbx database, which

# is their own file in a place they chose and is encrypted with their master

# key; the catalog does not place it.

secret = []

# KeePassXC keeps a QSettings object open and syncs it on quit

# (`connect(qApp, &QCoreApplication::aboutToQuit, this, &Config::sync)`), so a

# rewrite under a running instance is lost. side_effect stays at its default.

# Two Roaming keys name a file on this machine, and they are held back for

# different reasons, so they are two rules. QSettings writes an INI, so the keys

# appear under their [General] and [Browser] sections with the section stripped

# off, which is what these prefixes match. Everything else in the file — theme,

# shortcuts, security timeouts, browser integration toggles — is preference and

# stays.

# DefaultDatabaseFileName is the absolute path of the database opened at

# startup. Which vault this machine opens is the user's own choice and the

# first thing they would want back when rebuilding it, so it is kept for this

# device and never pushed to another.

[[machine_lines]]

file = [

"[configHome]/keepassxc/keepassxc.ini",

"~/Library/Application Support/KeePassXC/keepassxc.ini",

]

match = { prefix = ["DefaultDatabaseFileName"] }

scope = "backup"

# Browser/CustomProxyLocation is the absolute path of the keepassxc-proxy

# binary — a Homebrew prefix on one Mac, /usr/bin on the next box. Where the

# package manager puts that binary is decided by the kind of machine, not by

# this one, so the value holds for every box of the same OS and architecture.

[[machine_lines]]

file = [

"[configHome]/keepassxc/keepassxc.ini",

"~/Library/Application Support/KeePassXC/keepassxc.ini",

]

match = { prefix = ["CustomProxyLocation"] }

scope = "platform"

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/keepassxc. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these is generated from the same rules as this page. None of them splits DefaultDatabaseFileName and DefaultDatabaseFileName for you — that part is Otty’s own sync, or a template you write by hand.