Password sprawl is a quiet problem on every Linux box. It starts with one root password in a text file, then a few database credentials in a notes app, and then a browser that offers to remember 300 logins. Months later, nobody can say where the Cloudflare token lives or who last rotated it. Anyone who has run production servers for a while has seen that mess, and it rarely ends well.

KeePassXC fixes it without asking for a subscription or a cloud account. It is a free, open-source, cross-platform password manager. It keeps everything in a single encrypted .kdbx file that you control. Because the file format is shared with the KeePass ecosystem, you are never locked in. The desktop app also ships with a command-line sibling, keepassxc-cli, which is handy for scripting and for SSH sessions into headless machines.

Ubuntu 26.04 LTS “Resolute Raccoon” arrived on April 23, 2026 with a Wayland-only GNOME 50 desktop, a new kernel and several Rust-based system tools. That changes how some KeePassXC features behave, and it makes the choice of package format matter more than it used to. Four installation paths exist, and they are not equal.

This guide covers all four: the Ubuntu repository package, the official PPA, Flatpak and Snap. It explains which one to pick, how to verify the install, how to set up a sensible vault, and how to fix the problems that actually show up in practice.

Which Installation Method Should You Pick?

Do not run the first command you find. Each method behaves differently in terms of version freshness, browser integration and sandboxing.

KeePassXC’s own download page recommends Flatpak as the most reliable way to run it with automatic updates, and it also lists the Snap and the Ubuntu PPA. Version numbers move, so run apt policy keepassxc or check Flathub before assuming the table is current.

My rule of thumb after years of dealing with this: if you use browser integration with Firefox or Chromium, the native DEB (repo or PPA) causes the fewest headaches. If you want sandboxing and do not care about the browser extension, Flatpak is excellent. Snap comes last.

Before You Start: Prepare the System

A clean update first. It takes thirty seconds and avoids half the strange dependency errors people report later.

sudo apt update
sudo apt full-upgrade -y

Check what you are running:

lsb_release -a
uname -r
echo $XDG_SESSION_TYPE

On 26.04 the last command should print wayland. That detail matters later when auto-type comes up.

If this is a fresh minimal install, make sure basic tooling exists:

sudo apt install -y software-properties-common curl ca-certificates gnupg

Ubuntu 26.04 ships sudo-rs, a Rust reimplementation of sudo, alongside memory-safe replacements for some core utilities. For the commands in this guide you will not notice a difference. If a script of yours depends on an obscure sudo flag, test it first.

Method 1: Install KeePassXC from the Ubuntu Repository

This is the simplest option and the one that survives long-term maintenance best. The package comes from the universe component, so make sure universe is enabled (it is by default on desktop installs).

sudo apt install keepassxc

Since Ubuntu 24.10, the archive has also offered keepassxc-minimal and keepassxc-full variants. The minimal build drops some optional features such as network-related ones, which reduces the attack surface. If you prefer a trimmed build, install it explicitly:

sudo apt install keepassxc-minimal

The full variant includes browser integration, SSH agent support, and the other extras. If you are unsure which you need, install the full one:

sudo apt install keepassxc-full

Why would anyone pick minimal? On a hardened workstation, fewer features means fewer things that can break or be abused. You lose the browser extension connection, though, so decide upfront.

Confirm what landed on disk:

apt policy keepassxc
keepassxc --version
keepassxc-cli --version

Ubuntu freezes package versions at release time, so the repository build will lag behind upstream. The 26.04 archive carries 2.7.10. For many people that is fine. Password managers are not like browsers, and the file format has been stable for years. But if you need a recent fix or feature, move to the PPA or Flatpak.

Method 2: Install from the Official KeePassXC PPA

The PPA is maintained by the KeePassXC project itself, so you are not trusting a random third party. It gives you native DEB packages with newer versions.

sudo add-apt-repository ppa:phoerious/keepassxc -y
sudo apt update
sudo apt install keepassxc

On modern Ubuntu, add-apt-repository writes a deb822-style .sources file under /etc/apt/sources.list.d/. You can inspect it:

ls /etc/apt/sources.list.d/
cat /etc/apt/sources.list.d/phoerious-ubuntu-keepassxc-*.sources

Check that APT now prefers the PPA build:

apt policy keepassxc

You should see the PPA candidate version above the Ubuntu archive one. The PPA currently lifts 26.04 to 2.7.12.

Pinning, if you want control

On a machine where stability matters more than novelty, you might want updates from the PPA only for this one package. Create a preference file:

sudo tee /etc/apt/preferences.d/keepassxc-ppa >/dev/null <<'EOF'
Package: *
Pin: release o=LP-PPA-phoerious-keepassxc
Pin-Priority: 100

Package: keepassxc*
Pin: release o=LP-PPA-phoerious-keepassxc
Pin-Priority: 600
EOF
sudo apt update
apt policy keepassxc

This keeps the PPA from replacing anything except the KeePassXC packages. It is a small touch, but one that saves you on fleets where somebody later adds extra PPAs.

Removing the PPA cleanly

Changing your mind is easy:

sudo apt install keepassxc=2.7.10* --allow-downgrades   # adjust to the repo version shown by apt policy
sudo add-apt-repository --remove ppa:phoerious/keepassxc
sudo apt update

If a downgrade complains, sudo apt install ppa-purge followed by sudo ppa-purge ppa:phoerious/keepassxc handles it in one pass.

Method 3: Install KeePassXC with Flatpak

Flatpak is what upstream recommends for most desktop users. The bundled runtime means the app does not depend on your system libraries, and updates arrive independently of the OS.

Install Flatpak if it is not present:

sudo apt install flatpak

Add the Flathub remote:

sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

Then install:

sudo flatpak install flathub org.keepassxc.KeePassXC -y

If you would rather keep it per-user without root, use the --user variant:

flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak install --user flathub org.keepassxc.KeePassXC

Run it:

flatpak run org.keepassxc.KeePassXC

A reboot or re-login may be needed before the launcher shows up in the GNOME grid, because the Flatpak export directories are added to XDG_DATA_DIRS at session start.

Sandbox permissions worth knowing

Flatpak restricts filesystem access. If your database lives in ~/Documents or on a mounted drive, check what the app is allowed to see:

flatpak info --show-permissions org.keepassxc.KeePassXC

Give it access to a specific folder only when needed:

flatpak override --user --filesystem=~/Vaults org.keepassxc.KeePassXC

I prefer granting one dedicated folder rather than the whole home directory. Doing so keeps the point of the sandbox intact.

The catch is browser integration. According to the ubuntuusers wiki, if Firefox is installed as a Snap, it may be unable to talk to a KeePassXC Flatpak, and the DEB package is the recommended workaround. Ubuntu ships Firefox as a Snap by default, so this is the most common stumbling block in practice.

Method 4: Install the Snap Package

The command is short:

sudo snap install keepassxc

It works, and the sandbox is decent. But the package lags: one guide notes the Snap sits at 2.7.9 and its Snapcraft listing says the project provides only minimal support for this format. Treat it as a fallback when the other three do not suit you.

To see what the Snap can access and connect extra interfaces if needed:

snap connections keepassxc
sudo snap connect keepassxc:removable-media

The removable-media connection is the one people forget when their vault sits on a USB drive.

Installing on Other Distributions (Debian, AlmaLinux, Rocky)

Readers on mixed fleets often ask. The Flatpak route works the same on any distribution with Flatpak installed. For native packages:

# Debian 12/13
sudo apt install keepassxc

# AlmaLinux / Rocky Linux 9 (EPEL)
sudo dnf install epel-release
sudo dnf install keepassxc

Check the version with keepassxc --version afterwards. EPEL builds trail upstream, just like Ubuntu’s repository.

First Launch: Create a Vault That Will Not Bite You Later

Open KeePassXC from the app grid or run keepassxc in a terminal. Choose Create new database and walk through the wizard.

Pick the encryption settings deliberately

The defaults are sound, but a few choices deserve thought:

• Encryption algorithm: AES-256 and ChaCha20 are both fine. Pick whichever you like; neither is the weak link.
• KDF: Argon2id is the modern choice. Raise the decryption time to something that takes around one second on your slowest device. If you also open the vault on an old phone, test there, or the unlock will crawl.
• Master password: a long passphrase of four or five random words beats a short complex string. Length wins.
• Key file or hardware key (optional): adds a second factor. A YubiKey in challenge-response mode is a popular combination.

Save the file somewhere you will remember, for example ~/Vaults/main.kdbx. Then lock the permissions:

mkdir -p ~/Vaults
chmod 700 ~/Vaults
chmod 600 ~/Vaults/main.kdbx

Structure that scales

Resist the urge to build a perfect hierarchy on day one. A simple layout works well for sysadmins:

• Infrastructure (servers, panels, DNS, registrar)
• Clients (one group per client)
• Cloud and API keys
• Personal
• Recovery codes

Use tags for cross-cutting labels such as prod or 2fa-backup. Attach the SSH key files themselves to entries if you want them in one place, though a dedicated SSH agent workflow (see below) is cleaner.

Settings Worth Changing Right Away

Open Tools, Settings and check these:

1. Security: enable auto-lock after inactivity (five minutes is reasonable) and lock on session lock.
2. Clear clipboard: keep it at the default 10 seconds or lower. Copy a password, paste it, and let the clipboard wipe itself.
3. Backups: under the database settings, enable backup of the database file before saving. A corrupt save is rare but not unheard of, especially on flaky network mounts.
4. Minimize to tray: useful if you want it always available but out of the way.

Browser Integration on Ubuntu 26.04

This is the feature that makes KeePassXC feel like a modern manager. It is also where most trouble begins.

In Tools, Settings, Browser Integration, tick “Enable browser integration” and choose your browser. Then install the KeePassXC-Browser extension from your browser’s store. In the extension, click Connect, and KeePassXC will prompt you to name the association.

If the browser is a Snap (Firefox by default), the native messaging file must be somewhere that the confined browser can read. When it fails, you will see “Key exchange was not successful” or a “Cannot connect to KeePassXC” message. Two solutions exist:

• Use the DEB version of KeePassXC and, if needed, replace the Snap browser with a Mozilla APT-repo or other non-Snap build.
• Use the Flatpak KeePassXC together with a Flatpak browser, which keeps both sandboxes on the same side.

Mixing a Snap browser with a Flatpak vault app is where the pain lives. Pick a matching pair and the extension tends to work first time.

Check the native messaging manifest exists:

ls ~/.mozilla/native-messaging-hosts/
ls ~/.config/google-chrome/NativeMessagingHosts/ 2>/dev/null
ls ~/.config/chromium/NativeMessagingHosts/ 2>/dev/null

Look for a file named org.keepassxc.keepassxc_browser.json. If it is missing, toggle the browser integration checkbox off and on in KeePassXC to regenerate it.

Wayland and Auto-Type: What Changed

Ubuntu 26.04 is Wayland-only on the desktop. Auto-type, the feature that types your username and password into another window, depends on being able to simulate keystrokes and read the active window title. Wayland’s security model deliberately blocks that for ordinary applications, so global auto-type is less reliable than on the old X11 session.

Practical consequences:

• Auto-type may work only with XWayland applications, or not at all, depending on the version and the compositor.
• Browser integration is unaffected because it uses native messaging, not simulated keystrokes.
• For native Wayland apps, copy and paste with the clipboard timeout is the dependable fallback.

Test auto-type early instead of assuming it works. If it matters to your workflow, check the release notes of your KeePassXC version for Wayland updates, since upstream has been working on this area.

Using KeePassXC from the Command Line

The CLI is where a sysadmin gets real value. It is bundled with the package. Flatpak users can call it through flatpak run --command=keepassxc-cli org.keepassxc.KeePassXC.

List entries:

keepassxc-cli ls ~/Vaults/main.kdbx

Show an entry:

keepassxc-cli show ~/Vaults/main.kdbx "Infrastructure/web01-root"

Copy a single attribute to the clipboard:

keepassxc-cli clip ~/Vaults/main.kdbx "Infrastructure/web01-root" 10

The trailing number is the clipboard timeout in seconds. Generate a strong password:

keepassxc-cli generate -L 32 -lUns

Add a new entry with a generated password:

keepassxc-cli add -g -L 32 ~/Vaults/main.kdbx "Infrastructure/db01-admin"

Be careful about scripting this. Piping a master password into the CLI stores it in your shell history or process list if you are sloppy. Use the interactive prompt, or read from a protected file descriptor, and never hardcode it in a cron job.

SSH agent integration

KeePassXC can load SSH keys stored as attachments into your agent when the vault unlocks, and remove them again on lock. Enable it under Settings, SSH Agent. It needs a running ssh-agent or the GNOME keyring agent.

echo $SSH_AUTH_SOCK
ssh-add -l

If SSH_AUTH_SOCK is empty, nothing will connect. This is a classic problem on minimal sessions and is easy to overlook.

Syncing and Backing Up the Vault

A password manager without a backup plan is a time bomb. The .kdbx file is a single point of failure, so treat it like one.

A sensible approach:

• Keep the primary vault on local disk.
• Sync with Syncthing, Nextcloud or a plain rsync job to another machine.
• Take versioned, offline backups on a schedule.

A simple dated backup script:

#!/usr/bin/env bash
set -euo pipefail
SRC="$HOME/Vaults/main.kdbx"
DST="/mnt/backup/keepass"
mkdir -p "$DST"
cp --preserve=timestamps "$SRC" "$DST/main-$(date +%F-%H%M).kdbx"
find "$DST" -name 'main-*.kdbx' -mtime +90 -delete

Run it from a systemd timer, which is cleaner than cron for user-level tasks:

mkdir -p ~/.config/systemd/user
cat > ~/.config/systemd/user/keepass-backup.service <<'EOF'
[Unit]
Description=Backup KeePassXC vault

[Service]
Type=oneshot
ExecStart=%h/bin/keepass-backup.sh
EOF

cat > ~/.config/systemd/user/keepass-backup.timer <<'EOF'
[Unit]
Description=Daily KeePassXC vault backup

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target
EOF

systemctl --user daemon-reload
systemctl --user enable --now keepass-backup.timer
systemctl --user list-timers

Make sure the script exists at ~/bin/keepass-backup.sh and is executable before enabling the timer.

When two devices write to the same file at once, you can end up with sync conflicts. KeePassXC handles this reasonably through Database, Merge from database, but avoid editing the vault on two machines simultaneously. One writer at a time is a simple rule that prevents most grief.

Troubleshooting Common Problems

“Unable to locate package keepassxc”

Universe is probably disabled, or the package index is stale.

sudo add-apt-repository universe
sudo apt update
sudo apt install keepassxc

PPA added but version did not change

Run apt policy keepassxc. If the candidate is still the archive version, either apt update did not complete or a pin is overriding it. Look for stray files in /etc/apt/preferences.d/.

Browser extension: “Key exchange was not successful”

Most often this is a sandbox mismatch. A Snap Firefox cannot reach a Flatpak or an unprepared native host. Switch to a matching pair, regenerate the native messaging manifest by toggling the browser integration setting, and restart both applications. Also check that the database is unlocked, because the extension cannot talk to a locked vault.

Auto-type does nothing

Check echo $XDG_SESSION_TYPE. On Wayland, global auto-type is restricted, so the behaviour you are seeing may be expected. Use browser integration or clipboard copy instead.

Flatpak can’t open my database file

The sandbox cannot see the path. Grant access with flatpak override, or move the file into a location the app can read. Confirm with flatpak info --show-permissions org.keepassxc.KeePassXC.

Icon missing from the app grid after Flatpak install

Log out and back in so the exported desktop files are picked up. As a quick check, run flatpak run org.keepassxc.KeePassXC directly.

“Database file has been modified” or sync conflict

Another device saved while yours was open. Use Database, Merge from database against the conflicted copy, review the result, then save. Disable simultaneous editing in your workflow.

Cannot connect to SSH agent

Confirm SSH_AUTH_SOCK is set and the agent is running:

echo $SSH_AUTH_SOCK
systemctl --user status ssh-agent 2>/dev/null

Start the agent in your session or enable the GNOME keyring SSH component, then restart KeePassXC.

Snap version can’t see my USB drive

sudo snap connect keepassxc:removable-media

Dependency problems after upgrading from 24.04

An in-place upgrade can leave an old PPA entry disabled. Re-enable or re-add the PPA after the upgrade, then sudo apt update && sudo apt install --reinstall keepassxc.