$ show keepassxreboot/keepassxc
KeePassXC is a cross-platform password manager (Qt Widgets GUI plus CLI) written in C++/Qt. In production it creates, stores, and retrieves credentials in KeePass 2 (KDBX 3/4) database files encrypted with AES, ChaCha20, or Twofish and keyed by Argon2/AES-KDF through the Botan crypto library. It is entirely local-file based — no hosted backend — and adds local integrations: Auto-Type keystroke injection (X11/Wayland/Windows/macOS), YubiKey challenge-response, RFC 6238 TOTP generation, an SSH agent implementing the ssh-agent wire protocol, a FreeDesktop.org Secret Service D-Bus daemon so Linux desktop apps can read stored secrets, browser-extension access via native messaging (including passkey/WebAuthn registration and authentication), and KeeShare encrypted group sharing. The CLI (keepassxc-cli, entry point src/cli/keepassxc-cli.cpp plus src/main.cpp for the GUI) exposes the same core model for scripting: create/edit/show/search/merge databases, generate passwords, analyze HIBP breach exposure, import/export, and dump to CSV/HTML. Architecture is a modular desktop monolith: a core domain layer (src/core: Database/Entry/Group, config, clock, search, password generation, password health), a crypto layer (src/crypto: ciphers, hashes, KDFs), a stream layer (src/streams: hashed/HMAC block streams that give the KDBX format tamper-evident framing), a format layer (src/format: KDBX3/4 readers and writers, CSV parser/exporter, HTML exporter, importers for 1Password OPVault/1PUX, Bitwarden, Proton Pass, KeePass 1), and feature modules (browser, fdosecrets, sshagent, keeshare, autotype, quickunlock) that feed both GUI and CLI surfaces. Platform abstraction lives in OSUtilsBase plus per-OS AutoType/device-listener/screen-lock implementations; background work uses AsyncTask (QtConcurrent) wrappers; several plugin-like interfaces (IReportsPage, IEditGroupPage, ISettingsPage, KeyComponentWidget) allow modular extension. External dependencies: Qt 6, Botan, libsodium, zxcvbn, libusb/PCSC for YubiKey, QuaZip/minizip, and vendored ykcore C code. The test suite is extensive (~100 unit/GUI test files covering format round-trips, crypto known-answer tests, streams, merge, CLI, and browser). Notable weaknesses: heavy conditional compilation (#ifdef for KPXC_FEATURE_BROWSER/NETWORK/SSHAGENT/FDOSECRETS plus platform), near-duplicate report widgets, and a suspected early-return bug in EditGroupWidget::apply() under the browser-feature #ifdef that can skip group save logic, all of which add maintenance friction.
The LLM identified 4 files worth highlighting for reuse:
A configurable, stateful streaming CSV parser supporting arbitrary delimiters, text qualifiers, comment characters, backslash escaping, codec detection, and reparse. It is decoupled from the KeePass data model (operates on QIODevice/QString), has dedicated unit tests (TestCsvParser), and can be extracted into any Qt project needing robust, edge-case-tolerant CSV ingestion instead of naive split()-based parsing.
A clean RFC 6238 TOTP implementation supporting SHA-1/256/512 variants, configurable time steps and digits, plus a Steam TOTP variant with a custom Steam alphabet encoder. It depends only on the CryptoHash abstraction and is fully covered by TestTotp, making it directly portable to any application needing time-based one-time passwords.
A multi-format secret-key loader that auto-detects XML (KeePass 2.0 and 2.1), binary, hex, and hashed key-file variants, enforces hash verification before acceptance, and can generate reference key files. The format detection and verification logic is self-contained (depends on CryptoHash and QXmlStreamReader only) and demonstrates genuine binary-format decoding skill reusable for other secret-material file formats.
Implements the KDBX4 HMAC-authenticated block stream pattern: data is split into fixed-size blocks, each ciphertext block carries an HMAC computed over (block index || ciphertext), and every block is authenticated on read. Combined with HashedBlockStream and SymmetricCipherStream it forms a layered stream architecture that cleanly separates framing, integrity, and encryption. The indexed-HMAC-over-ciphertext block pattern is a directly reusable template for any tamper-evident streaming container format, though extraction requires taking the crypto primitives (CryptoHash/SymmetricCipher) along or adapting to another crypto API.