Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read on Keepass website that Keepass keeps password encrypted in the memory.

So is it secure to keep Keypass window open?

share|improve this question
Unless someone can argue for why this specifically should be closed as not constructive, I'm going to assume that it could be answered with undisputable fact. – oKtosiTe Mar 31 '13 at 12:18

Why don't you read the Keepass manual, and decide yourself?

Process Memory Protection

While KeePass is running, sensitive data (like the hash of the master key and entry passwords) is stored encrypted in process memory.

This means that even if you would dump the KeePass process memory to disk, you couldn't find the passwords.

For example, when you are copying a password to the clipboard, KeePass first decrypts the password field, copies it to the clipboard and immediately re-encrypts it using the random key.

Additionally, KeePass erases all security-critical memory when it's not needed anymore, i.e. it overwrites these memory areas before releasing them (this applies to all security-critical memory, not only the password fields).

KeePass ≥ 1.15 and 2.x use the Windows DPAPI for in-memory encrypting the sensitive data. With DPAPI, the key for in-memory encryption is stored in a secure, non-swappable memory area managed by Windows. If DPAPI is not available or disabled (advanced KeePass options, by default using DPAPI is enabled), KeePass uses the ARC4 encryption algorithm with a random key. Note that this is less secure than DPAPI, mainly not because ARC4 cryptographically isn't that strong, but because the key for in-memory encryption is also stored in swappable process memory.

share|improve this answer

Depends if anyone has access to your computer. Certainly if you lock your computer when you're not around, I don't see a problem.

share|improve this answer

Well if you care about protecting your passwords enough to use keepass I wouldn't recommend it. Security is only as good as it's weakest link. Unless you are logged out and in a non-public place I wouldn't recommend it.

share|improve this answer
And the weakest link here is? – TFM Mar 30 '13 at 15:59
Keeping the program up. – Griffin Mar 30 '13 at 16:17
Wow, that was crystal clear. – TFM Mar 30 '13 at 17:08
@TFM I know this is a little late (3 years) but I think I was referring to automated tasks being easier to perform. A quick off the top of my head example would be an automated task to copy the password to the clipboard paste it to a text file and send it to someone. Of course the machine has to be compromised in the first place but the only disadvantage I see to closing it is inconvenience. – Griffin Jul 14 at 13:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .