Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I read on Keepass website that Keepass keeps password encrypted in the memory.

So is it secure to keep Keypass window open?

share|improve this question
    
Unless someone can argue for why this specifically should be closed as not constructive, I'm going to assume that it could be answered with undisputable fact. –  oKtosiTe Mar 31 '13 at 12:18
add comment

3 Answers

Why don't you read the Keepass manual, and decide yourself?

Process Memory Protection

While KeePass is running, sensitive data (like the hash of the master key and entry passwords) is stored encrypted in process memory.

This means that even if you would dump the KeePass process memory to disk, you couldn't find the passwords.

For example, when you are copying a password to the clipboard, KeePass first decrypts the password field, copies it to the clipboard and immediately re-encrypts it using the random key.

Additionally, KeePass erases all security-critical memory when it's not needed anymore, i.e. it overwrites these memory areas before releasing them (this applies to all security-critical memory, not only the password fields).

KeePass ≥ 1.15 and 2.x use the Windows DPAPI for in-memory encrypting the sensitive data. With DPAPI, the key for in-memory encryption is stored in a secure, non-swappable memory area managed by Windows. If DPAPI is not available or disabled (advanced KeePass options, by default using DPAPI is enabled), KeePass uses the ARC4 encryption algorithm with a random key. Note that this is less secure than DPAPI, mainly not because ARC4 cryptographically isn't that strong, but because the key for in-memory encryption is also stored in swappable process memory.

share|improve this answer
add comment

Depends if anyone has access to your computer. Certainly if you lock your computer when you're not around, I don't see a problem.

share|improve this answer
add comment

Well if you care about protecting your passwords enough to use keepass I wouldn't recommend it. Security is only as good as it's weakest link. Unless you are logged out and in a non-public place I wouldn't recommend it.

share|improve this answer
    
And the weakest link here is? –  TFM Mar 30 '13 at 15:59
    
Keeping the program up. –  Griffin Mar 30 '13 at 16:17
    
Wow, that was crystal clear. –  TFM Mar 30 '13 at 17:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.