Tip

Freeware tool for password tracking and storage

Keeping track of one password is easy enough, but, overall, password management can be a problematic task. It's hard to remember many of them, and writing them down would defeat the purpose of keeping passwords secret in the first place.

KeePass Password Safe is a new open-source/freeware project that runs on all 32-bit versions of Windows. It's designed to help you manage and protect all kinds of passwords. The source code is freely available, so it can be inspected by security-conscious programmers (who can, in turn, suggest improvements).

You can store any number of passwords in the program, which can either be typed in by hand or imported from a variety of sources, including CSV (comma-separated value) files. The passwords are then stored in a database encrypted using the very strong Advanced Encryption Standard (AES) or Twofish algorithms to keep them from being compromised. Even when the program is running, the passwords are encrypted in memory, so caching the program's memory to disk will not compromise security.

KeePass typically works by using a master password or passphrase to unlock the database. It's also possible to use a physical key disk, such as a removable USB "pen" drive or a floppy disk, as the database key. The two approaches can also be combined for even greater security. The passwords themselves can be organized and presented according to many different sort/search criteria, grouped together or arranged hierarchically. Password lists can be exported (only if you must!), transferred between instances of the program or generated on demand. If you've ever needed to machine generate a whole list of passwords on demand for new installations in an organization, this is one quick way to do it.

One of KeePass' best features is that it can be used to automatically fill in a password field (i.e. in a Web page form) without any retyping. The password itself doesn't even have to be exposed. The program also has a plug-in architecture that makes it possible to expand on the program's basic functionality, and a few such plug-ins have already been written (i.e., XML importer). The entire project is open source, which keeps it from being compromised in turn.

The most recent version of the program is 1.0, with new revisions coming regularly (about once a month). The authors have also created multiple language resource files for the program (including Japanese, Polish, Russian and Hebrew).

About the author: Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check it out for the latest advice and musings on the world of Windows network administrators -- and please share your thoughts as well!


More information from SearchWindowsSecurity.com

  • Tip: Avoid these Windows password management myths
  • Tip: Get 25 password hardening tips in 25 minutes
  • Tip: Find out how easily passwords can be cracked


  • This was first published in July 2005

    There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.