Why I keep KeePassXC as a backup for 1Password

Or: trusting a tool doesn't mean putting all your eggs in one basket.

I like 1Password. I like the interface, the browser integration, how easy it is to have my logins on every device, and most of all the peace of mind it gives me day to day. I'm not looking for a replacement, and I plan to keep using it.

But there's a small quirk in how I organize my digital life: I also keep a copy of my passwords in KeePassXC.

I trust 1Password's security just fine. I can't predict the future, though.

Convenience has a price#

Over the years I've piled up an almost ridiculous number of accounts, servers, side projects, services and other small digital creatures that need passwords. Handing all of that to a password manager is comfortable, and 1Password is excellent at the job.

1Password works offline on devices you've already set up, and it keeps local copies of your data. Your internet going down won't lock you out of your passwords.

The problem I care about is a different one. What if, for whatever reason, I need to leave the service? What if something goes wrong with my account? What if I simply wake up one day and decide I want to manage my credentials some other way?

I don't want to learn how to migrate on the exact day I need to migrate. Nobody thinks clearly at 2 a.m. with a locked account and a server on fire.

Meet KeePassXC#

KeePassXC is free, open source, and runs on Windows, Linux and macOS. Your whole vault lives in a single encrypted file, usually with the .kdbx extension.

No account to create, no subscription, no remote server standing between you and your passwords. You can keep that file wherever you want, make copies, keep it offline, and open it with any program that understands the KeePass format. On Android there's KeePassDX, on iOS there's KeePassium and Strongbox, and that's a big part of the charm: the file isn't married to any single app.

I love this simplicity: one file, one strong password and a program to open it.

And it's not a bare-bones tool either. KeePassXC has a browser extension, Auto-Type, built-in TOTP codes for two-factor authentication, passkey support, and it can protect the database with a key file or a hardware key like a YubiKey on top of the password.

How to make the copy#

KeePassXC can import 1Password exports directly, in the .1pux format. The whole thing takes a few minutes.

1. Export from 1Password. In the 1Password 8 desktop app, go to File > Export and choose your account. It will ask for your password. Pick the 1PUX format. Skip CSV: it only carries logins and passwords, and it leaves out custom fields like 2FA backup codes, which are exactly the kind of thing you'll want in an emergency.

2. Import into KeePassXC. Open KeePassXC, go to Database > Import, choose 1Password (.1pux) and point it to the file. Save the result as a new .kdbx database protected by a strong, unique password. Don't reuse your 1Password password here. If you want to go further, add a key file or a YubiKey.

3. Check it. Open a few entries and see if things arrived the way you expect: usernames, passwords, notes, TOTP codes. Pay extra attention to anything that matters a lot, like your email account and your servers.

4. Destroy the export. This step is the one people forget, so I'll say it loudly: the **.1pux** file is not encrypted. Anyone who opens it can read every password you have. It should exist only for the few minutes of the transfer, on a computer you trust, and then disappear. It should never sit forgotten in your Downloads folder, get synced to a cloud drive or end up in an email attachment. Delete it and empty the trash. On Linux, shred -u export.1pux overwrites the file before deleting it, though on SSDs that's less of a guarantee than it sounds, which is one more reason to keep the file's life as short as possible.

The passkey problem#

Passkeys deserve their own section because they don't behave like passwords.

The 1Password desktop export leaves passkeys out. That's on purpose: a passkey's private key is designed to be hard to copy around. The iOS and Android apps can move passkeys to other apps through the new Credential Exchange standard, but only to apps that support it, and that list is still growing.

In practice this means the KeePassXC copy is a backup of your passwords and most of your other data, not of your passkeys. For the accounts that really matter, make sure you have another way in: a password, recovery codes stored in the backup, or a second passkey created directly in KeePassXC.

Making the backup worth having#

A backup that's badly cared for can cause more trouble than it solves. A few rules I think are worth following:

• Strong master password. A long passphrase is easier to remember than a short mess of symbols, and much harder to crack.
• Keep it in more than one place. An encrypted USB stick in a drawer, a copy on another computer, maybe a copy in a different cloud than the one you use for everything else. The file is encrypted, so storing it outside your house is reasonable if the password is good.
• Turn on backup on save. KeePassXC can make a backup of the database file right before each save. It costs nothing.
• Update it on a schedule. This is a snapshot, not a sync. If you add twenty new accounts and never refresh the copy, those twenty are missing. Once a month, or after any big change, is a good rhythm. Put it in your calendar.
• Test it. Every now and then, open the file on a different machine and log in to something with it.

And while you're at it, print the 1Password Emergency Kit and keep it somewhere safe. It has your Secret Key, and without it, getting back into your account on a new device is much harder.

Why a second copy helps#

Anyone who manages servers learns early that backups matter, and also that a backup nobody ever tested might not be much of a backup.

1Password has its own redundancy and recovery mechanisms, and they're good. A second copy, in a different format and under my control, protects me from a different category of problems: account issues, business decisions I have no say in, or my own future change of heart.

Two copies aren't automatically safer than one, though. Every extra copy is one more thing that needs protecting. An outdated KeePassXC database stored carelessly or locked with a weak password is a liability. The goal is one well-kept alternative, and that's very different from scattering passwords around.

A matter of philosophy#

If you follow my little projects, you've probably noticed I have a soft spot for decentralization, free software and anything that lets people stay in control of their own stuff.

I'm not a purist, though. I use proprietary software when it solves a problem well, and I have no trouble admitting it. What I try to avoid is letting convenience turn into total dependence. I want to choose a tool because I like it, and I want to keep that choice open.

1Password is still my main password manager. KeePassXC sits quietly in the background as an independent way out, ready for the day I might need it.

Maybe I never will, and I hope I don't.

But I like knowing that getting to my passwords doesn't depend on any one company or subscription.