KEEPASSXC-CLI(1)

📦
version 2.8.0 · 11 versions
, in arch rolling, fedora 43, fedora 44, nixpkgs unstable

🎀 KEEPASSXC-CLI 🎀

okay bestie, so this is the manual page for keepassxc-cli — General Commands Manual, that's the vibe — and it's literally your golden ticket to the KeePassXC password manager from the terminal. no GUI, no clicking, just you and the command line being iconic together 💅

✨ NAME ✨

keepassxc-cli — the command line interface for the KeePassXC password manager 🫶

✨ SYNOPSIS ✨

keepassxc-cli command [options]

✨ DESCRIPTION ✨

so keepassxc-cli is, like, the command line interface for the KeePassXC password manager. what it gives you is the ability to query and modify the entries of a KeePass database, directly from the command line. no windows, no mouse, just vibes and flags 💖

👑 COMMANDS 👑

your whole arsenal, bestie. every single one. let's go 🦋

add [options] <database> <entry>

Adds a new entry to a database. you can have a password generated for you (that's the -g option ✨), or you can get a prompt to type the password in yourself (that's the -p option). and here's the cute part — when you've got -g set, you can use all the same password generation options that are documented for the generate command. same energy, same flags 💅

analyze [options] <database>

Analyzes passwords in a database for weaknesses, using offline HIBP SHA-1 hash lookup. it's giving detective era 🔍 and no, it's offline, so your hashes aren't going on a lil field trip 🌸

attachment-export [options] <database> <entry> <attachment_name> <export_file>

Exports the content of an attachment to a specified file. wanna skip the file entirely and just yeet it to the terminal? use the --stdout option and the contents of the attachment go straight to stdout instead 🎀

attachment-import [options] <database> <entry> <attachment_name> <import_file>

Imports the attachment into an entry. and heads up — an existing attachment with the same name may be overwritten if you specify the -f option 👀 so like, know before you do it

attachment-rm <database> <entry> <attachment_name>

Removes the named attachment from an entry. bye bestie 🫶 (the attachment. the attachment is the bestie leaving)

clip [options] <database> <entry> [timeout]

Copies an attribute — or the current TOTP, if you passed the -t option — of a database entry to the clipboard. if you don't name an attribute with the -a option, then the password is what gets copied. now listen: if multiple entries with the same name exist in different groups, only the attribute for the first one gets copied 😭 so if you need the attribute of an entry in a specific group, specify the group path to the entry as well, instead of just the name. also you can optionally pass a timeout in seconds to automatically clear the clipboard — the default timeout is 10 seconds, and you set it to 0 to disable it entirely. iconic security behavior actually 👑

close

In interactive mode, closes the currently opened database (see open). that's it. that's the whole thing 💜

db-create [options] <database>

Creates a new database with a password and/or a key file. the key file will be created if the file that is referred to does not exist ✨ and real talk: if both the key file and password are empty, no database will be created. nothing. nada. don't do that 💀

db-edit [options] <database>

Edits a database. and when you're setting a key file, that key file will be created if the file that is referred to does not exist 🌈

db-info [options] <database>

Show a database's information. just the facts, bestie 🍓

diceware [options]

Generates a random diceware passphrase. roll the dice, get a passphrase, slay 🎲

edit [options] <database> <entry>

Edits a database entry. password can be generated (-g option ✨) or you can get a prompt to input the password (-p option). and same as before — with -g set, all the same password generation options documented for the generate command apply 💅

estimate [options] [password]

Estimates the entropy of a password. you can hand over the password to estimate as a positional argument, or you can feed it in using the standard input. your call, no judgment 🧚

exit

Exits interactive mode. Synonymous with quit. twin commands, both valid 💖

export [options] <database>

Exports the content of a database to standard output in the specified format (defaults to XML). straight to stdout, no cap 📤

generate [options]

Generates a random password. the moment you've been waiting for 🔥

help [command]

Displays a list of available commands, or detailed information about the specified command. when in doubt, ask for help — that's main character energy 🎀

import [options] <xml> <database>

Imports the contents of an XML exported database to a new created database with a password and/or key file. the key file will be created if the file that is referred to does not exist ✨ if both the key file and password are empty, no database will be created — fr fr, nothing happens 💀 and the new database will be in kdbx 4 format 🦋

ls [options] <database> [group]

Lists the contents of a group in a database. if no group is specified, it will default to the root group. root group is the default bestie 🌸

merge [options] <database1> <database2>

Merges two databases together. ⚠️ okay real talk time: the first database file is going to be replaced by the result of the merge, so for that reason it is advisable to keep a backup of the two database files before attempting a merge. like, actually do it. back it up. i'm not playing 🙈 and in the case that both databases make use of the same credentials, the --same-credentials or -s option can be used 👑

mkdir [options] <database> <group>

Adds a new group to a database. new group, who dis 💅

mv [options] <database> <entry> <group>

Moves an entry to a new group. relocation era ✨

open [options] <database>

Opens the given database in a shell-style interactive mode. this is useful for performing multiple operations on a single database (e.g. ls followed by show) 🎀

quit

Exits interactive mode. Synonymous with exit. same thing, different spelling, both iconic 💖

rm [options] <database> <entry>

Removes an entry from a database. and here's the nuance bestie — if the database has a recycle bin, the entry will be moved there. but if the entry is already in the recycle bin, it will be removed permanently 💀 so like, double-check where you are before you do this

rmdir [options] <database> <group>

Removes a group from a database. same deal as rm: if the database has a recycle bin, the group will be moved there. if the group is already in the recycle bin, it will be removed permanently 😭

search [options] <database> <term>

Searches all entries that match a specific search term in a database. find your people 🔍

show [options] <database> <entry>

Shows the title, username, password, URL and notes of a database entry. can also show the current TOTP ✨ and regarding the occurrence of multiple entries with the same name in different groups — everything stated in the clip command section also applies here. so yeah, first one wins unless you give the group path 🫶

to be continued, bestie… more of this page is coming 🌈

✨ OPTIONS ✨

okay bestie, this is the big one. every single flag, no skips, we're going the whole way 💅

🌸 General options

  • --debug-info — spills all the debugging tea. when something's acting up, this is the receipt.
  • -k, --key-file <path> — points at a key file to unlock the database. heads up: in a merge operation, this one is the key file path for the first database. two databases, two key files, don't mix them up 🫶
  • --no-password — turns off the password key for the database. bye password 👋
  • -y, --yubikey <slot[:serial]> — names the YubiKey slot used to unlock the database. and in a merge operation? this one is the YubiKey slot for the first database. (yes, <slot[:serial]> — the serial part is optional.)
  • -q, --quiet <path> — shushes the password prompt and all the other secondary output. lowkey the "let me live" flag.
  • -h, --help — help info. the classic.
  • -v, --version — tells you which program version you're running.

🔀 Merge options

  • -d, --dry-run <path> — prints everything the merge found, and changes nothing in the database. it's giving window shopping. zero commitment ✨
  • --key-file-from <path> — sets the path of the key file for the second database.
  • --no-password-from — deactivates the password key for the database you're merging from.
  • --yubikey-from <slot[:serial]> — YubiKey slot for the second database.
  • -s, --same-credentials — one set of credentials, both databases unlocked. efficient icon behaviour 👑

🎀 Add and edit options

fr fr important: when the -g option is set, the exact same password generation options documented for the generate command can be used with these 2 commands. same options, same energy.
  • -u, --username <username> — sets the username of the entry.
  • --url <url> — sets the URL of the entry.
  • --notes <notes> — sets the notes of the entry.
  • -p, --password-prompt — pops a prompt so you can type the entry's password yourself.
  • -g, --generate — generates a brand new password for the entry. slay.

🦋 Edit options

  • -t, --title <title> — sets the title of the entry. yes, just the one option here. she's a short section and she ate.

🔍 Estimate options

  • -a, --advanced — does the advanced analysis on the password. going deeper, bestie.

💀 Analyze options

  • -H, --hibp <filename> — checks whether any passwords have been publicly leaked, by comparing against the given list of password SHA-1 hashes. that list must be in "Have I Been Pwned" format. files like that live at https://haveibeenpwned.com/Passwords — but bestie, they are large, so this operation typically takes some time. we're talking minutes, up to an hour or so 😭 go make a snack.
  • --okon <okon-cli path> — use the specified okon-cli program to do offline breach checks. you can get okon-cli from https://github.com/stryku/okon. ⚠️ when you use this option, -H, --hibp must point to a post-processed okon file (e.g. file.okon).

🎀 Clip options

  • -a, --attribute — copies the specified attribute to the clipboard. if you don't name an attribute, the password attribute is the default. for example, "-a username" would copy the username to the clipboard. [Default: password]
  • -t, --totp — copies the current TOTP to the clipboard instead of the specified attribute. 💀 will report an error if no TOTP is configured for the entry.
  • -b, --best — tries to find and copy a unique entry matching the input. if a unique matching entry is found it gets copied to the clipboard. if multiple entries match, they get listed so you can refine your search — and no clip is performed. (no clip performed, bestie, read it again.)

🌈 Db-create, Db-edit and Import options

  • --set-key-file <path> — set the key file for the database.
  • -p, --set-password — set a password for the database.

⭐ Db-create, Import options

  • -t, --decryption-time <time> — target decryption time in MS for the database.

💜 Db-edit options

  • --unset-password <path> — removes the password for the database.
  • --unset-key-file <path> — removes the key file for the database.

✨ Show options

  • -a, --attributes <attribute>... — shows the named attributes. you can specify this option more than once, and each attribute is shown one-per-line in the order you gave them. if you specify no attributes and -t isn't specified, you get a summary of the default attributes instead. 👀 and heads up: protected attributes will be displayed in clear text if you specify them explicitly with this option.
  • --all — shows all the attributes of the entry. the whole lore.
  • -s, --show-protected — shows the protected attributes in clear text. (yes. out loud. in public. 🙈)
  • --show-attachments — shows the attachment names along with the size of the attachments.
  • -t, --totp — also shows the current TOTP, and reports an error if no TOTP is configured for the entry.

🧚 Diceware options

  • -W, --words <count> — sets the desired number of words for the generated passphrase. [Default: 7]
  • -w, --word-list <path> — sets the Path of the wordlist for the diceware generator. the wordlist must have > 1000 words, otherwise the program will fail. if the wordlist has < 4000 words, a warning gets printed to STDERR. any diceware-compatible wordlist works. ⚠️ but note: KeePassXC will NOT verify the PGP signature of signed wordlists. so, like, trust responsibly.

🍓 Export options

  • -f, --format — format to use when exporting. available choices are xml or csv. defaults to xml.

🌸 List options

  • -R, --recursive — recursively lists the elements of the group.
  • -f, --flatten — flattens the output to single lines. when this option is enabled, subgroups and subentries get displayed with a relative group path instead of indentation.

👑 Generate options

  • -L, --length <length> — sets the desired length for the generated password. [Default: 16]
  • -l, --lower — uses lowercase characters for the generated password. [Default: Enabled]
  • -U, --upper — uses uppercase characters for the generated password. [Default: Enabled]
  • -n, --numeric — uses numbers characters for the generated password. [Default: Enabled]
  • -s, --special — uses special characters for the generated password. [Default: Disabled]
  • -e, --extended — uses extended ASCII characters for the generated password. [Default: Disabled]
  • -x, --exclude <chars> — comma-separated list of characters to exclude from the generated password. None is excluded by default.
  • --exclude-similar — exclude similar looking characters. [Default: Disabled]
  • --every-group — include characters from every selected group. [Default: Disabled]

📚 NOTES

✍️ AUTHOR

This manual page was originally written by Manolis Agkopian m.agkopian@gmail.com. credit where credit is due, icon 🫶

🐛 REPORTING BUGS

Bugs and feature requests can be reported on GitHub at https://github.com/keepassxreboot/keepassxc/issues.

Copyright (C) 2016-2020 KeePassXC Team team@keepassxc.org

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License, either version 2 or version 3. There is NO WARRANTY, to the extent permitted by law.

no warranty bestie. it's free software, not a safety net 💜

👀 SEE ALSO

👑 AUTHOR

KeePassXC Team

and that's the whole page, bestie!! 🌈✨ this one's from KeePassXC 2.8.0, dated 2022-08-20 — the KEEPASSXC-CLI(1) manual. now go lock down those passwords, you absolute legend 💅💖🦋

📦 where this page comes from