In the following, we assume that the second configuration slot of your YubiKey is unconfigured and free.Ģ. We use the YubiKey Manager to configure the YubiKey(s). If you set up the mode in KeePassXC, you can't open the database in KeePass anymore (and vice versa). While the original KeePass and KeePassXC use the same database format, they implement the challenge-response mode differently. (Edit: also tested with newest version April 2022) If you install another version of the YubiKey Manager, the setup and usage might differ. For this tutorial, we use the YubiKey Manager 1.2.4, released in March 2021. Install the “YubiKey Manager” (ykman) to configure the YubiKeys.

You need a free configuration slot per YubiKey for this tutorial.Ĥ. You can get two YubiKeys (one primary, one backup) as a precaution. Get at least one YubiKey 5 (or a similar security token). (Edit: also tested with KeepassXC 2.7.1ģ. If you install another version of KeePassXC, the setup and usage might differ. For this tutorial, we use KeePassXC 2.6.6, released in July 2021. In the following, we assume that you already have a KeePassXC database.Ģ. The following steps are required before proceeding:Ĭreate and save your first KeePassXC database. The original article also seems offline at the time of writing this (July 2021 due to website maintenance)) Note: this tutorial is based on the excellent guides provided by the InfoSec Handbook website.

Compatibility with KeePassium/Strongbox (iOS) & KeePass2Android (Android).Configure additional YubiKeys (optional).This method is also compatible with iOS and Android clients allowing you to access your passwords on a wide range of devices. So in this tutorial I will not only show you how to add a Yubikey to a KeePassXC dstabass but also how to set up a second YubiKey as a backup and/or store the secret to program a backup/new YubiKey at a later stage with the same secret. A YubiKey additionally protects the KeePassXC database, depending on your threat model and use cases.However, if you lose or damage your YubiKey you might lose access to your database.

Keepassxc arch