It's a bit like storing your keys on a keychain. However if you have a complex password, this should still take almost forever (depending on your password randomness/entropy).īut adding another factor does add extra security as an attacker will still have to get two things from you, rather than one. If you store the keyfile along the database, an attacker would 'just' need to bruteforce or dictionary attack the keyfile (which is a lot smaller and takes a lot less time than attack the whole database). So this is two factors of authentication. If the keyfile is additionally encrypted with a password (as you should) then he also needs something you know. So should an attacker obtain your database, he would still need to get your keyfile, something you have. If you do not have the key file it's impossible to derive the key from the ciphertext obtain the plaintext equivalent. They key file contains the key used to encrypt the database. Using a key file in addition to a master password is helpful, as it raises the difficulty of successfully compromising your password database. This makes it slightly more difficult for an attacker to obtain my key file. I store my key file on a USB drive which I keep on my person at all times. My phone and tablet has a copy of it, because there is no way I can insert a USB drive into those devices, but my desktop and laptop does not. However, I do not store my key file together with my password database. I store my password database on Dropbox which allows me to keep it in sync between my various devices. My desktop has a copy, my laptop has a copy, my phone has a copy, my tablet has a copy. Personally, I have copies of my password database everywhere.

Ideally, this key file needs to be stored in a secure location. The key file acts as something the user has. The user memorizes it in his head and can 'retrieve' it from memory as and when it is needed. Authentication methods can often be divided into one of three areas: something the user knows, something the user has and something the user is.

Keepass change password