CHIPASS-CLI(1)

📦
version 2026.09.0 · 2 versions
, in arch rolling

🎀 keepassxc-cli(1) 🎀

okay so bestie, welcome to the manual page for keepassxc-cli(1) — yes, the whole thing lives in the terminal, and yes it's gonna be a journey 💖

Quick vibe check on the credits before we get into it, because we do NOT skip the credits in this house:

  • Author / keeper of the whole operation: KeePassXC Team 👑
  • The tool that spat this page out: Asciidoctor 2.0.26 ✨

tiny heads-up before we go any further: this part right here is literally just the boring scaffolding — the document head, the stylesheet, the fonts, the whole "please render me nicely in a browser" situation. Not a single flag or command yet, ngl. It's giving backstage pass, not main character energy 💀

So like… stay with me. The actual manual-page stuff — the sections, the options, the stuff you actually came here for — kicks off right after this 🙈

Also fr fr: keep everything you see in backticks exactly as written. No "fixing" it, no renaming it, no vibes-based reinterpretation. Commands and names are load-bearing 🫶

✨ and that's the last } of the stylesheet, bestie. </style> slams shut, </head> follows it out the door, and <body class="manpage"> swings wide open — the actual page is finally here. we're so back. 🫶

<div id="header"> walks in like it owns the place, and honestly? it does.

🌸 NAME 🌸

keepassxc-cli — command line interface for the ChiPass password manager

okay so that's the whole vibe in one line: it's the command line interface for the ChiPass password manager. terminal girlies, this one's for you. 💅

🦋 SYNOPSIS 🦋

keepassxc-cli command [options]

the shape of it, no cap: you run keepassxc-cli, you hand it a command, and then you sprinkle on whatever options you need. that's the pattern. main character energy from the very first line. ⭐

👑 DESCRIPTION 👑

okay so keepassxc-cli is the command line interface for the ChiPass password manager. that's the whole thing. that's the assignment.

and what does it actually do? it gives you the ability to query and modify the entries of a KeePass database — directly from the command line. 🎀

read that again. query. modify. your KeePass database entries. from the terminal. no clicking, no GUI, no leaving your cozy little shell. it's giving "I do everything in the terminal and I'm thriving." 🔥

lowkey the biggest flex here is that this is the cli for ChiPass, but the database it's poking at is a KeePass database. two names, both literal, both mattering — don't @ me, just keep them straight. 💀

and then — mid-thought, mid-breath — a fresh <div starts opening, and the next section rolls in... 🧚

a little note on the shapes of things

Every command below is written in that classic shape — square brackets around the optional bits, angle brackets around the you-gotta-give-me-this bits. Bestie, angle brackets = mandatory. No cap. 💅

  • add [options] <database> <entry> — adds a shiny new entry to a database. You can have a password generated for you (that's the -g option ✨) or get a lil prompt so you can type it in yourself (that's -p). And ooh — when -g is on, you get to use all the same password generation options that are documented for the generate command. iconic.
  • analyze [options] <database> — sniffs out weak passwords in a database using offline HIBP SHA-1 hash lookup. detective mode fr 🔍
  • attachment-export [options] <database> <entry> <attachment_name> <export_file> — dumps the content of an attachment into the file you name. Or use the --stdout option to just spit the attachment's contents out to stdout instead. your choice, bestie 🎀
  • attachment-import [options] <database> <entry> <attachment_name> <import_file> — pulls an attachment into an entry. heads up: if an attachment with the same name is already chillin' there, it may get overwritten — only if you specify the -f option. 🙈
  • attachment-rm <database> <entry> <attachment_name> — removes the named attachment from an entry. gone. bye. 💀
  • clip [options] <database> <entry> [timeout] — copies an attribute, or the current TOTP (when you pass the -t option), of a database entry to the clipboard.
    • if you don't name an attribute with the -a option, it copies the password. defaults, slay.
    • if multiple entries with the same name live in different groups, only the attribute for the first one gets copied. like, rude but okay.
    • want the attribute from an entry in a specific group? then specify the group path to the entry too, not just the name. iykyk 🗺️
    • optionally you can pass a timeout in seconds to auto-clear the clipboard. the default timeout is 10 seconds, and you set it to 0 to disable it entirely. safety queen 💅
  • close — in interactive mode, closes the currently opened database (peep open).
  • db-create [options] <database> — creates a brand new database with a password and/or a key file. the key file gets created if the file it refers to doesn't exist yet. and uh — if both the key file and password are empty, no database will be created. nothing happens. the void. 😭
  • db-edit [options] <database> — edits a database. when you set a key file, that key file will be created if the file it refers to does not exist. same deal as above ✨
  • db-info [options] <database> — shows a database's information. the tea ☕
  • diceware [options] — generates a random diceware passphrase. literally the most old-school-cool way to get a passphrase 🎲
  • edit [options] <database> <entry> — edits a database entry. again: generate the password with -g, or get a prompt to type it in with -p. and again, when -g is set you can use all the same password generation options documented for the generate command. 🫶
  • estimate [options] [password] — estimates the entropy of a password. you can hand the password over as a positional argument, or feed it in through standard input. either way, we're judging it 💖
  • exit — exits interactive mode. synonymous with quit. two names, one exit door 🚪
  • export [options] <database> — exports the content of a database to standard output in the specified format (defaults to XML). out it goes 📤
  • generate [options] — generates a random password. that's it. that's the whole thing. and yet, so powerful 🔥
  • help [command] — displays a list of available commands, or detailed information about the specified command. when you're lost, start here 🧭
  • import [options] <xml> <database> — imports the contents of an XML exported database into a newly created database with a password and/or key file.
    • the key file gets created if the file it refers to doesn't exist.
    • if both the key file and password are empty, no database will be created.
    • the new database will be in kdbx 4 format. ✨
  • ls [options] <database> [group] — lists the contents of a group in a database. if you don't specify a group, it defaults to the root group. 🗂️
  • merge [options] <database1> <database2> — merges two databases together. important: the first database file is going to be replaced by the result of the merge — so it is advisable to keep a backup of the two database files before attempting a merge. seriously. back it up bestie 😭
    • in the case that both databases make use of the same credentials, you can use the --same-credentials or -s option.
  • mkdir [options] <database> <group> — adds a new group to a database. new folder energy 🎀
  • mv [options] <database> <entry> <group> — moves an entry to a new group. relocating ✈️
  • open [options] <database> — opens the given database in a shell-style interactive mode. this is useful for performing multiple operations on a single database (e.g. ls followed by show). honestly the best way to live 💅
  • quit — exits interactive mode. synonymous with exit. same door, different name 🚪
  • rm [options] <database> <entry> — removes an entry from a database. if the database has a recycle bin, the entry gets moved there instead. and if the entry is already in the recycle bin, it will be removed permanently. no takebacks 😬
  • rmdir [options] <database> <group> — removes a group from a database. if the database has a recycle bin, the group gets moved there. if the group is already in the recycle bin, it will be removed permanently. same rules, group edition 💀
  • search [options] <database> <term> — searches all entries that match a specific search term in a database. go find your stuff 🔎
  • show [options] <database> <entry> — shows the title, username, password, URL and notes of a database entry. it can also show the current TOTP. and about the whole "multiple entries with the same name in different groups" situation — everything stated in the clip command section also applies here. so go read that one again 🫶

✨ OPTIONS ✨

General options

the everyday essentials, bestie 💜

  • --debug-info — displays debugging information. for when you need the lore 🕵️
  • -k, --key-file <path> — specifies a path to a key file for unlocking the database. in a merge operation, this option is used to specify the key file path for the first database. 🔑
  • --no-password — deactivates the password key for the database. no password, no problem 💅
  • -y, --yubikey <slot[:serial]> — specifies a yubikey slot for unlocking the database. in a merge operation, this option is used to specify the YubiKey slot for the first database. hardware keys are so main character 🔥
  • -q, --quiet <path> — silences the password prompt and other secondary outputs. shhh 🤫
  • -h, --help — displays help information. the classic 🫶
  • -v, --version — displays the program version. know your build ✨

Merge options

these only matter when you're doing the whole merge thing, okay? 🌸

  • -d, --dry-run <path> — prints the changes detected by the merge operation without making any changes to the database. peek, don't touch 👀
  • --key-file-from <path> — sets the path of the key file for the second database. 🔑
  • --no-password-from — deactivates the password key for the database to merge from. 🚫
  • --yubikey-from <slot[:serial]> — YubiKey slot for the second database. 🔥
  • -s, --same-credentials — uses the same credentials for unlocking both databases. one login, two databases, slay 💅

Add and edit options

the same password generation options as documented for the generate command can be used with those 2 commands when the -g option is set. 🎀
  • -u, --username <username> — specifies the username of the entry. who dis 👑
  • --url <url> — specifies the URL of the entry. the link 🌈
  • --notes
  • <notes> — specifies the notes of the entry 📝 like the little lore dump that lives on your entry, slay.
  • -p, --password-prompt — uses a password prompt for the entry's password 🔐 so you type it live instead of it just sitting there, iykyk.
  • -g, --generate — generates a new password for the entry ✨ fresh out the oven, no cap.

🎀 Edit options 🎀

  • -t, --title <title> — specifies the title of the entry 💅 the name tag basically.

🧚 Estimate options 🧚

  • -a, --advanced — performs advanced analysis on the password 🔍 like a full vibe check on how strong it actually is.

🔥 Analyze options 🔥

  • -H, --hibp <filename> — checks if any passwords have been publicly leaked, by comparing against the given list of password SHA-1 hashes, which must be in "Have I Been Pwned" format. Such files are available from https://haveibeenpwned.com/Passwords; note that they are large, and so this operation typically takes some time (minutes up to an hour or so) 😭 literally go make a snack.
  • --okon <okon-cli path> — use the specified okon-cli program to perform offline breach checks. You can obtain okon-cli from https://github.com/stryku/okon. When using this option, -H, --hibp must point to a post-processed okon file (e.g. file.okon) 🫶.

🦋 Clip options 🦋

  • -a, --attribute — copies the specified attribute to the clipboard. If no attribute is specified, the password attribute is the default. For example, -a username would copy the username to the clipboard. [Default: password]
  • -t, --totp — copies the current TOTP instead of the specified attribute to the clipboard. Will report an error if no TOTP is configured for the entry 💀.
  • -b, --best — try to find and copy to clipboard a unique entry matching the input. If a unique matching entry is found it will be copied to the clipboard. If multiple entries are found they will be listed to refine the search. (no clip performed) 👑

💜 Db-create, Db-edit and Import options 💜

  • --set-key-file <path> — set the key file for the database 🔑.
  • -p, --set-password — set a password for the database 🔒.

🌈 Db-create, Import options 🌈

  • -t, --decryption-time <time> — target decryption time in MS for the database ⏱️.

🍓 Db-edit options 🍓

  • --unset-password <path> — removes the password for the database 🚫.
  • --unset-key-file <path> — removes the key file for the database 🚫.

⭐ Show options ⭐

  • -a, --attributes <attribute>... — shows the named attributes. This option can be specified more than once, with each attribute shown one-per-line in the given order. If no attributes are specified and -t is not specified, a summary of the default attributes is given. Protected attributes will be displayed in clear text if specified explicitly by this option 👀.
  • --all — show all the attributes of the entry 💖.
  • -s, --show-protected — shows the protected attributes in clear text 🙈.
  • --show-attachments — shows the attachment names along with the size of the attachments 📎.
  • -t, --totp — also shows the current TOTP, reporting an error if no TOTP is configured for the entry 🕐.

🌸 Diceware options 🌸

  • -W, --words <count> — sets the desired number of words for the generated passphrase. [Default: 7]
  • -w, --word-list <path> — sets the Path of the wordlist for the diceware generator. The wordlist must have > 1000 words, otherwise the program will fail. If the wordlist has < 4000 words a warning will be printed to STDERR. Any diceware-compatible wordlist can be used. Note however that ChiPass will NOT verify the PGP signature of signed wordlists 😤 important bestie, don't skip that.

🎀 Export options 🎀

  • -f, --format — format to use when exporting. Available choices are xml or csv. Defaults to xml 📦.

🧚 List options 🧚

  • -R, --recursive — recursively lists the elements of the group 🌀.
  • -f, --flatten — flattens the output to single lines. When this option is enabled, subgroups and subentries will be displayed with a relative group path instead of indentation 📏.

🔥 Generate options 🔥

  • -L, --length <length> — sets the desired length for the generated password. [Default: 16]
  • -l, --lower — uses lowercase characters for the generated password. [Default: Enabled]
  • -U, --upper — uses uppercase characters for the generated password. [Default: Enabled]
  • -n, --numeric — uses numbers characters for the generated password. [Default: Enabled]
  • -s, --special — uses special characters for the generated password. [Default: Disabled]
  • -e, --extended — uses extended ASCII characters for the generated password. [Default: Disabled]
  • -x, --exclude <chars> — comma-separated list of characters to exclude from the generated password. None is excluded by default 🙅‍♀️.
  • --exclude-similar — exclude similar looking characters. [Default: Disabled]
  • --every-group — include characters from every selected group. [Default: Disabled]

📌 NOTES 📌

👑 AUTHOR 👑

This manual page was originally written by Manolis Agkopian <m.agkopian@gmail.com> 💖.

🐛 REPORTING BUGS 🐛

Bugs and feature requests can be reported on Codeberg at https://codeberg.org/ChiPass/ChiPass/issues 🫶 go off, tell them everything.

Copyright (C) 2016-2020 KeePassXC Team <team@keepassxc.org>

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License, either version 2 or version 3. There is NO WARRANTY, to the extent permitted by law 🫡.

🌈 SEE ALSO 🌈

keepassxc(1) ✨

👑 AUTHOR 👑

Okay bestie, credit where credit is due 💅 this manual page (yes, the very one you're reading, meta much?) was written by the lovely human behind <m.agkopian@gmail.com>. Say thank you 🫶

🐛 found a bug? got a feature idea?

No gatekeeping here — bugs and feature requests can be reported on Codeberg at https://codeberg.org/ChiPass/ChiPass/issues. Go off, tell them everything, they literally want to know 💖

Fr fr though, that's the spot for it — not the group chat, not the replies. The issue tracker. Periodt.

Copyright (C) 2016-2020 KeePassXC Team, https://keepassxc.org

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License, either version 2 or version 3.

There is NO WARRANTY, to the extent permitted by law. Like, none. Zero. Nada 😭 So don't come for anybody if it goes sideways — the license said what it said.

✨ And that's a wrap on the whole page, bestie! You made it to the very end — main character energy fr 🎀

This edition is Version 2026.09.0, and it was last updated on 2026-09-11 19:12:11 UTC. Go forth and chipass responsibly 👑💜

📦 where this page comes from