Password manager
Option A: Master Password
KeePassXC
KeePassXC stores all passwords in an encrypted database. Unlocking requires a master password—minimum 20 characters, ideally a passphrase with high entropy.
Purpose
- One secure master password replaces dozens of weak individual passwords
- Generate randomised passwords via built-in generator
- Browser integration for automatic login
- Two-factor codes integrable
Installation
Available for Windows, macOS, Linux: keepassxc.org/download
First Steps
- Install, create database with master password (≥20 characters, mixed character sets)
- Store database file in password-protected HU Box library
- Connect library on each device
Password Generation
Integrated generator with customisable rules (length, character sets, similarity exclusion). Entropy display for existing entries; warning for weak or duplicate passwords.
Storage
| Component | Location | Function |
|---|---|---|
| Master password | Memory | Decrypts database; never store digitally |
| Database file (.kdbx) | Password-protected HU Box library | Contains all passwords; worthless without master password |
Important
| Aspect | Note |
|---|---|
| Backup | Export/back up database regularly; password loss = irreversible access loss |
| Conflicts | Avoid simultaneous editing; HU Box retains version history |
Option B: Key File
KeePassXC
KeePassXC stores all passwords in an encrypted file. Unlocking requires a key file.
Purpose
- One key file replaces dozens of weak individual passwords
- Generate more secure, randomised passwords easily
- Automatic login for websites and applications possible (browser integration)
- Two-factor codes integrable
Installation
Available for Windows, macOS, Linux: keepassxc.org/download
First Steps
- Install, create database with key file instead of password
- Store key file in HU Box library A (password-protected)
- Store database file in HU Box library B (password-protected)
- Connect both libraries on each device
Password Generation
Integrated generator with customisable rules (length, character sets, similarity exclusion). Entropy display for existing entries; warning for weak or duplicate passwords.
Segregated Storage
| File | Location | Function |
|---|---|---|
| Key file | Password-protected HU Box library A | Decrypts database; no access without it |
| Database file (.kdbx) | Password-protected HU Box library B | Contains all passwords; worthless alone without key file |
Important
| Aspect | Note |
|---|---|
| Backup | Back up key file separately; loss means locked access |
| Conflicts | Avoid simultaneous editing; HU Box retains version history |
Help
Detailed guide: keepassxc.org/docs/KeePassXC_GettingStarted
Questions regarding use at HU: uco@physik.hu-berlin.de
Comparison
| Criterion | Option A: Master Password | Option B: Key File |
|---|---|---|
| Entropy source | User's mnemonic security | Cryptographically random key |
| Attack vector | Keylogging, shoulder surfing, weak password | Theft of key file |
| Loss risk | Forgetting | File loss, synchronisation conflicts |
| HU Box integration | One library | Two libraries required (segregated storage) |
| Password-protected HU Box | Additional security layer | Additional security layer for both files |
The HU Box password protection layer increases protection against unauthorised access to stored files in both cases, but does not replace the cryptographic security of the KeePassXC database itself.