It is problematic, because most people will keep the vanilla keepass and won't be able to fit to their needs. Google won't help you, because these malicious plugins can be at the top of a google search.Īt the end of the day, most intermediate users probably won't install any plugin except a few of the very popular ones. It already happened in the past and It is still happening. Otherwise, we can't be sure that there isn't a malicious plugin out there.

It's true that people can check the source themselves, If they have the skill required to do so, but even in this case for it to be truly secure we need hundreds of eyes and a few audits made by professionals. We need more audits and people looking at the source code. Speaking of plugins, here's the BIG problem with keepass plugin system. Unfortunately, not everyone likes keepass interface and there aren't a lot of plugins to help with this. Once we get used to the interface, It's quite straightforward to use.

Keepass can achieve all the functions of paid password managers competitors, with a few tweaks or plugins. The code has been audited several times, has a good history and is likely to be secure.

Keepass review