Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a KeePass database and it offers the ability to use a key file, which it says is more secure because it can use a longer and more complex password but is easier to break because you only need the key file to open the database. I'll only be using the key file on 2 computers (one desktop and one laptop), wo which is the best option?

Note that it's definitely more appealing to use the key file for me because i have a hard time remembering anything close to a random password.

share|improve this question
up vote 14 down vote accepted

Regarding the ability to use 'key files' with KeePass.

In order to generate the 256-bit key for the block ciphers, the Secure Hash Algorithm SHA-256 is used. This algorithm compresses the user key provided by the user (consisting of password and/or key file) to a fixed-size key of 256 bits. This transformation is one-way, i.e. it is computationally infeasible to invert the hash function or find a second message that compresses to the same hash.

The recently discovered attack against SHA-1 doesn't affect the security of SHA-256. SHA-256 is still considered as being very secure.

(there is another recent update, but I think such news are not relevant here).
To the point at hand,

Key Derivation:
If only a password is used (i.e. no key file), the password plus a 128-bit random salt are hashed using SHA-256 to form the final key (but note there is some preprocessing: Protection against Dictionary Attacks). The random salt prevents attacks that are based on pre-computed hashes.

When using both password and key file, the final key is derived as follows: SHA-256(SHA-256(password), key file contents), i.e. the hash of the master password is concatenated with the key file bytes and the resulting byte string is hashed with SHA-256 again. If the key file doesn't contain exactly 32 bytes (256 bits), they are hashed with SHA-256, too, to form a 256-bit key. The formula above then changes to: SHA-256(SHA-256(password), SHA-256(key file contents)).

If you think your password is going to be a bit weaker (and better for your memory),
the key file is a good second factor.
So, use both (together).

share|improve this answer
I'm thinking that this is the best option at this point... Thanks! – RCIX Aug 15 '09 at 5:41
I'd take a look at Steve Gibson's commentary on the matter: – jasonh Aug 15 '09 at 8:12
Yes, I did. I understand having a second factor, but it's useless here. The keyfile would be kept virtually with the password database itself if you're a mobile user. If you lose control of the database, you've probably lost control of the key file too. As Steve Gibson notes, a key file isn't giving you much additional security, if any. – jasonh Aug 16 '09 at 3:14
A second factor is useful in the example of the PayPal football. In this case you have a physical device and a password. If your password becomes compromised, there is no reason to believe that your football is missing at the same time by default. In comparison, when the goods are a password database and the securing mechanism is simply another file that resides alongside the database itself, what good is it? None. – jasonh Aug 16 '09 at 3:16
+1 for the use key file and master password. So even if they get the db and key file you just have to remember 1 long password. They cannot hack brains yet so get some torture resistance training instead. – ppumkin Jan 16 '13 at 10:03

The whole point is to keep your passwords secure, so this is a no-brainer: password. If you use a key file and you lose control of your password database, your passwords are all exposed.

share|improve this answer
You are always going to be at risk if you store your 'password' somewhere (be it on a sticky note or as a key file). So long as you keep the password in your head (and it is complex enough) then you should be better off. – Sam Aug 14 '09 at 2:30
When using both password and key file, the final key is derived as follows: SHA-256(SHA-256(password), key file contents). Access to file alone is useless. But, knowledge of the password without the file contents makes breaking it more difficult. And, the file also adds a strong salt to your password. – nik Aug 15 '09 at 8:38

Use both. Keep your key file in your flash drive and bring it allways with you. But not somwhere on desktop (it is the same as writing password on sticky notes). I'm using this way to my encrypted HDD partition (with truecrypt). So if anybody still somehow get your password, they need keyfile too.

share|improve this answer
Just make sure to have a backup of your keyfile, as well as the password database itself. If either one of them ever gets corrupted you will need a fresh backup. – Torbjørn Sep 4 '09 at 4:15

I have opted for key file use. I have a also created a an email account used specifically to store my keyfile (I do not like hanging around witha USB flash each time I want to access my e-banking account for instance).

If the computer I am using is not my personal one, I simply log in to that email account on the computer I would like to use the key file, then log in to yet another email account which has the most recent version of my .kdbx file.

Lastly, I download KeePass and install it on the PC, use the key and .kdbx along with my Database password and that's it!

Of course, I wipe off both the .kdbx and key file on the PC used.

share|improve this answer
I would consider this bad security practice on many levels. – klyonrad Aug 13 '13 at 12:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.