If you want to drive that likelihood/accessibility factor to near zero, change the passwords for all of the sensitive credentials you manage with KeePass, and sleep like a baby. Is the data that might be put at risk with the compromise of those things in your KeePass db valuable enough to warrant the Amazon compute time it would take to crack your password? Probably not, so the likelihood factor in the risk equation goes way down, because that's the only way the actors are going to get in without out having that master key. Other than going off the grid, I cannot think of anything else to do.Īs others have noted, KeePass's encryption is not the weak spot, key management is. My laptop, which is the only other device with OneDrive on it, is encrypted in the SSD and using Windows 10 encryption for the folder with the KeePass file in it, I have MFA on Office 365 to prevent remote access to my OneDrive folders. If anyone gets past my armored front door and alarm system and gets it all, I still can manually change all critical passwords and negate them if one were to break the layers of encryption. Kingston DataTraveler Vault Privacy 3.0 hardware-encrypted USB drive that never leaves the house, and is only plugged in when needed. My WatchGuard password KeePass file is separate, and my banking KeePass file my wife uses is on her own I also have a less-critical-password file on my desktop in my OneDrive folder, which has vendor account logins and the like. If it gets stolen or lost, the finder has 10 tries to get into it, at which point it wipes the drive. I have a Kingston DataTraveler Vault Privacy 3.0 hardware-encrypted USB drive (256-bit AES hardware-based encryption in XTS mode) with my QuickBooks backup and my KeePass critical database file on it.

Keepassium pro