KeePassXC is a cross-platform password manager (Qt Widgets GUI plus CLI) written in C++/Qt. In production it creates, stores, and retrieves credentials in KeePass 2 (KDBX 3/4) database files encrypted with AES, ChaCha20, or Twofish and keyed by Argon2/AES-KDF through the Botan crypto library. It is entirely local-file based — no hosted backend — and adds local integrations: Auto-Type keystroke injection (X11/Wayland/Windows/macOS), YubiKey challenge-response, RFC 6238 TOTP generation, an SSH agent implementing the ssh-agent wire protocol, a FreeDesktop.org Secret Service D-Bus daemon so Linux desktop apps can read stored secrets, browser-extension access via native messaging (including passkey/WebAuthn registration and authentication), and KeeShare encrypted group sharing. The CLI (keepassxc-cli, entry point src/cli/keepassxc-cli.cpp plus src/main.cpp for the GUI) exposes the same core model for scripting: create/edit/show/search/merge databases, generate passwords, analyze HIBP breach exposure, import/export, and dump to CSV/HTML. Architecture is a modular desktop monolith: a core domain layer (src/core: Database/Entry/Group, config, clock, search, password generation, password health), a crypto layer (src/crypto: ciphers, hashes, KDFs), a stream layer (src/streams: hashed/HMAC block streams that give the KDBX format tamper-evident framing), a format layer (src/format: KDBX3/4 readers and writers, CSV parser/exporter, HTML exporter, importers for 1Password OPVault/1PUX, Bitwarden, Proton Pass, KeePass 1), and feature modules (browser, fdosecrets, sshagent, keeshare, autotype, quickunlock) that feed both GUI and CLI surfaces. Platform abstraction lives in OSUtilsBase plus per-OS AutoType/device-listener/screen-lock implementations; background work uses AsyncTask (QtConcurrent) wrappers; several plugin-like interfaces (IReportsPage, IEditGroupPage, ISettingsPage, KeyComponentWidget) allow modular extension. External dependencies: Qt 6, Botan, libsodium, zxcvbn, libusb/PCSC for YubiKey, QuaZip/minizip, and vendored ykcore C code. The test suite is extensive (~100 unit/GUI test files covering format round-trips, crypto known-answer tests, streams, merge, CLI, and browser). Notable weaknesses: heavy conditional compilation (#ifdef for KPXC_FEATURE_BROWSER/NETWORK/SSHAGENT/FDOSECRETS plus platform), near-duplicate report widgets, and a suspected early-return bug in EditGroupWidget::apply() under the browser-feature #ifdef that can skip group save logic, all of which add maintenance friction.
git-credential-keepassxc is a Rust-based Git credential helper that enables Git and shell scripts to store and retrieve credentials from KeePassXC. It implements the KeePassXC browser protocol to communicate with the password manager via socket/named pipe interfaces. The application provides subcommands for getting credentials (get), generating TOTP codes (totp), storing credentials (store), managing configuration (configure), verifying caller identity (caller), and other auxiliary functions. It features optional security enhancements including strict caller verification, YubiKey-based encryption of configuration files, and desktop notifications. The architecture follows a modular Rust CLI pattern with clear separation between argument parsing, configuration management, core protocol implementation, and utility functions.