KDBX
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
KeePass Database Preview.
At a glance
| Purpose | A KeePass 2 password database (.kdbx): a plain header followed by an encrypted, compressed XML database. |
| Extensions | .kdbx |
| Poka parser | poka-kdbx |
| Viewer | poka-metadata-card-viewer |
| Depth tier | Metadata card (see Depth tiers) |
| Breadth tier | B4 Summary (see Breadth tiers) |
How much Poka reads
B4 Summary. The container and metadata are read and summarised (counts, properties, structure), but the main content is not rendered.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-kdbx/src/main.rs (286 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has no .kdbx and .kdb sample. Covers .kdbx and .kdb. The card decodes the header: format, signatures, file version, cipher, compression, master seed, IV or nonce, key-derivation function and parameters, public custom data, header comment and end offset. Judgement: B4: the header is decoded in full; the database is encrypted and is never opened, by design.
What Poka does not read
- The database (groups, entries, passwords) is not decrypted (by design: no password or key file is asked for)
- KeePass 1 (.kdb) files are recognised but their header is not decoded (judgement from the code)
- The header hash and HMAC are not verified
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- keepass (candidate; MIT; Rust; https://github.com/sseemayer/keepass-rs) — KDBX4 keyvault
Sources
- parsers/poka-kdbx/src/main.rs
- parsers/poka-kdbx/plugin.json