1 [![Linux](https://github.com/chazmcgarvey/File-KDBX/actions/workflows/linux.yml/badge.svg)](https://github.com/chazmcgarvey/File-KDBX/actions/workflows/linux.yml)
2 [![macOS](https://github.com/chazmcgarvey/File-KDBX/actions/workflows/macos.yml/badge.svg)](https://github.com/chazmcgarvey/File-KDBX/actions/workflows/macos.yml)
3 [![Windows](https://github.com/chazmcgarvey/File-KDBX/actions/workflows/windows.yml/badge.svg)](https://github.com/chazmcgarvey/File-KDBX/actions/workflows/windows.yml)
7 File::KDBX - Encrypted database to store secret text and files
17 my $kdbx = File::KDBX->new;
19 my $group = $kdbx->add_group(
23 my $entry = $group->add_entry(
28 $kdbx->dump_file('passwords.kdbx', 'M@st3rP@ssw0rd!');
30 $kdbx = File::KDBX->load_file('passwords.kdbx', 'M@st3rP@ssw0rd!');
32 $kdbx->entries->each(sub {
34 say 'Entry: ', $entry->title;
37 See ["RECIPES"](#recipes) for more examples.
41 **File::KDBX** provides everything you need to work with a KDBX database. A KDBX database is a hierarchical
42 object database which is commonly used to store secret information securely. It was developed for the KeePass
43 password safe. See ["Introduction to KDBX"](#introduction-to-kdbx) for more information about KDBX.
45 This module lets you query entries, create new entries, delete entries and modify entries. The distribution
46 also includes various parsers and generators for serializing and persisting databases.
48 This design of this software was influenced by the [KeePassXC](https://github.com/keepassxreboot/keepassxc)
49 implementation of KeePass as well as the [File::KeePass](https://metacpan.org/pod/File%3A%3AKeePass) module. **File::KeePass** is an alternative module
50 that works well in most cases but has a small backlog of bugs and security issues and also does not work with
51 newer KDBX version 4 files. If you're coming here from the **File::KeePass** world, you might be interested in
52 [File::KeePass::KDBX](https://metacpan.org/pod/File%3A%3AKeePass%3A%3AKDBX) that is a drop-in replacement for **File::KeePass** that uses **File::KDBX** for storage.
54 This software is a **pre-1.0 release**. The interface should be considered pretty stable, but there might be
55 minor changes up until a 1.0 release. Breaking changes will be noted in the `Changes` file.
59 This implementation of KDBX supports a lot of features:
61 - ☑ Read and write KDBX version 3 - version 4.1
62 - ☑ Read and write KDB files (requires [File::KeePass](https://metacpan.org/pod/File%3A%3AKeePass))
63 - ☑ Unicode character strings
64 - ☑ ["Simple Expression"](#simple-expression) Searching
65 - ☑ [Placeholders](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AEntry#Placeholders) and [field references](#resolve_reference)
66 - ☑ [One-time passwords](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AEntry#One-time-passwords)
67 - ☑ [Very secure](#security)
68 - ☑ ["Memory Protection"](#memory-protection)
69 - ☑ Challenge-response key components, like [YubiKey](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKey%3A%3AYubiKey)
70 - ☑ Variety of [key file](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKey%3A%3AFile) types: binary, hexed, hashed, XML v1 and v2
71 - ☑ Pluggable registration of different kinds of ciphers and key derivation functions
72 - ☑ Built-in database maintenance functions
73 - ☑ Pretty fast, with [XS optimizations](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AXS) available
74 - ☒ Database synchronization / merging (not yet)
76 ## Introduction to KDBX
78 A KDBX database consists of a tree of _groups_ and _entries_, with a single _root_ group. Entries can
79 contain zero or more key-value pairs of _strings_ and zero or more _binaries_ (i.e. octet strings). Groups,
80 entries, strings and binaries: that's the KDBX vernacular. A small amount of metadata (timestamps, etc.) is
81 associated with each entry, group and the database as a whole.
83 You can think of a KDBX database kind of like a file system, where groups are directories, entries are files,
84 and strings and binaries make up a file's contents.
86 Databases are typically persisted as a encrypted, compressed files. They are usually accessed directly (i.e.
87 not over a network). The primary focus of this type of database is data security. It is ideal for storing
88 relatively small amounts of data (strings and binaries) that must remain secret except to such individuals as
89 have the correct _master key_. Even if the database file were to be "leaked" to the public Internet, it
90 should be virtually impossible to crack with a strong key. The KDBX format is most often used by password
91 managers to store passwords so that users can know a single strong password and not have to reuse passwords
92 across different websites. See ["SECURITY"](#security) for an overview of security considerations.
112 Hash of UUIDs for objects that have been deleted. This includes groups, entries and even custom icons.
116 Bytes contained within the encrypted layer of a KDBX file. This is only set when using
117 [File::KDBX::Loader::Raw](https://metacpan.org/pod/File%3A%3AKDBX%3A%3ALoader%3A%3ARaw).
121 A text string associated with the database. Often unset.
125 The UUID of a cipher used to encrypt the database when stored as a file.
127 See ["File::KDBX::Cipher"](#file-kdbx-cipher).
129 ## compression\_flags
131 Configuration for whether or not and how the database gets compressed. See
132 [":compression" in File::KDBX::Constants](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AConstants#compression).
136 The master seed is a string of 32 random bytes that is used as salt in hashing the master key when loading
137 and saving the database. If a challenge-response key is used in the master key, the master seed is also the
140 The master seed _should_ be changed each time the database is saved to file.
144 The transform seed is a string of 32 random bytes that is used in the key derivation function, either as the
145 salt or the key (depending on the algorithm).
147 The transform seed _should_ be changed each time the database is saved to file.
151 The number of rounds or iterations used in the key derivation function. Increasing this number makes loading
152 and saving the database slower by design in order to make dictionary and brute force attacks more costly.
156 The initialization vector used by the cipher.
158 The encryption IV _should_ be changed each time the database is saved to file.
160 ## inner\_random\_stream\_key
162 The encryption key (possibly including the IV, depending on the cipher) used to encrypt the protected strings
165 ## stream\_start\_bytes
167 A string of 32 random bytes written in the header and encrypted in the body. If the bytes do not match when
168 loading a file then the wrong master key was used or the file is corrupt. Only KDBX 2 and KDBX 3 files use
169 this. KDBX 4 files use an improved HMAC method to verify the master key and data integrity of the header and
172 ## inner\_random\_stream\_id
174 A number indicating the cipher algorithm used to encrypt the protected strings within the database, usually
175 Salsa20 or ChaCha20. See [":random\_stream" in File::KDBX::Constants](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AConstants#random_stream).
179 A hash/dict of key-value pairs used to configure the key derivation function. This is the KDBX4+ way to
180 configure the KDF, superceding ["transform\_seed"](#transform_seed) and ["transform\_rounds"](#transform_rounds).
184 The name of the software used to generate the KDBX file.
188 The header hash used to verify that the file header is not corrupt. (KDBX 2 - KDBX 3.1, removed KDBX 4.0)
192 Name of the database.
194 ## database\_name\_changed
196 Timestamp indicating when the database name was last changed.
198 ## database\_description
200 Description of the database
202 ## database\_description\_changed
204 Timestamp indicating when the database description was last changed.
208 When a new entry is created, the _UserName_ string will be populated with this value.
210 ## default\_username\_changed
212 Timestamp indicating when the default username was last changed.
214 ## maintenance\_history\_days
216 TODO... not really sure what this is. 😀
220 A color associated with the database (in the form `#ffffff` where "f" is a hexidecimal digit). Some agents
221 use this to help users visually distinguish between different databases.
223 ## master\_key\_changed
225 Timestamp indicating when the master key was last changed.
227 ## master\_key\_change\_rec
229 Number of days until the agent should prompt to recommend changing the master key.
231 ## master\_key\_change\_force
233 Number of days until the agent should prompt to force changing the master key.
235 Note: This is purely advisory. It is up to the individual agent software to actually enforce it.
236 `File::KDBX` does NOT enforce it.
240 Array of custom icons that can be associated with groups and entries.
242 This list can be managed with the methods ["add\_custom\_icon"](#add_custom_icon) and ["remove\_custom\_icon"](#remove_custom_icon).
244 ## recycle\_bin\_enabled
246 Boolean indicating whether removed groups and entries should go to a recycle bin or be immediately deleted.
248 ## recycle\_bin\_uuid
250 The UUID of a group used to store thrown-away groups and entries.
252 ## recycle\_bin\_changed
254 Timestamp indicating when the recycle bin was last changed.
256 ## entry\_templates\_group
258 The UUID of a group containing template entries used when creating new entries.
260 ## entry\_templates\_group\_changed
262 Timestamp indicating when the entry templates group was last changed.
264 ## last\_selected\_group
266 The UUID of the previously-selected group.
268 ## last\_top\_visible\_group
270 The UUID of the group visible at the top of the list.
272 ## history\_max\_items
274 The maximum number of historical entries allowed to be saved for each entry.
276 ## history\_max\_size
278 The maximum total size (in bytes) that each individual entry's history is allowed to grow.
282 Timestamp indicating when the database settings were last updated.
286 Alias of the ["memory\_protection"](#memory_protection) setting for the _Title_ string.
290 Alias of the ["memory\_protection"](#memory_protection) setting for the _UserName_ string.
294 Alias of the ["memory\_protection"](#memory_protection) setting for the _Password_ string.
298 Alias of the ["memory\_protection"](#memory_protection) setting for the _URL_ string.
302 Alias of the ["memory\_protection"](#memory_protection) setting for the _Notes_ string.
308 $kdbx = File::KDBX->new(%attributes);
309 $kdbx = File::KDBX->new($kdbx); # copy constructor
311 Construct a new [File::KDBX](https://metacpan.org/pod/File%3A%3AKDBX).
315 $kdbx = $kdbx->init(%attributes);
317 Initialize a [File::KDBX](https://metacpan.org/pod/File%3A%3AKDBX) with a set of attributes. Returns itself to allow method chaining.
319 This is called by ["new"](#new).
323 $kdbx = $kdbx->reset;
325 Set a [File::KDBX](https://metacpan.org/pod/File%3A%3AKDBX) to an empty state, ready to load a KDBX file or build a new one. Returns itself to allow
330 $kdbx_copy = $kdbx->clone;
331 $kdbx_copy = File::KDBX->new($kdbx);
333 Clone a [File::KDBX](https://metacpan.org/pod/File%3A%3AKDBX). The clone will be an exact copy and completely independent of the original.
343 $kdbx = KDBX::File->load(\$string, $key);
344 $kdbx = KDBX::File->load(*IO, $key);
345 $kdbx = KDBX::File->load($filepath, $key);
346 $kdbx->load(...); # also instance method
348 $kdbx = File::KDBX->load_string($string, $key);
349 $kdbx = File::KDBX->load_string(\$string, $key);
350 $kdbx->load_string(...); # also instance method
352 $kdbx = File::KDBX->load_file($filepath, $key);
353 $kdbx->load_file(...); # also instance method
355 $kdbx = File::KDBX->load_handle($fh, $key);
356 $kdbx = File::KDBX->load_handle(*IO, $key);
357 $kdbx->load_handle(...); # also instance method
359 Load a KDBX file from a string buffer, IO handle or file from a filesystem.
361 [File::KDBX::Loader](https://metacpan.org/pod/File%3A%3AKDBX%3A%3ALoader) does the heavy lifting.
371 $kdbx->dump(\$string, $key);
372 $kdbx->dump(*IO, $key);
373 $kdbx->dump($filepath, $key);
375 $kdbx->dump_string(\$string, $key);
376 \$string = $kdbx->dump_string($key);
378 $kdbx->dump_file($filepath, $key);
380 $kdbx->dump_handle($fh, $key);
381 $kdbx->dump_handle(*IO, $key);
383 Dump a KDBX file to a string buffer, IO handle or file in a filesystem.
385 [File::KDBX::Dumper](https://metacpan.org/pod/File%3A%3AKDBX%3A%3ADumper) does the heavy lifting.
387 ## user\_agent\_string
389 $string = $kdbx->user_agent_string;
391 Get a text string identifying the database client software.
393 ## memory\_protection
395 \%settings = $kdbx->memory_protection
396 $kdbx->memory_protection(\%settings);
398 $bool = $kdbx->memory_protection($string_key);
399 $kdbx->memory_protection($string_key => $bool);
401 Get or set memory protection settings. This globally (for the whole database) configures whether and which of
402 the standard strings should be memory-protected. The default setting is to memory-protect only _Password_
405 Memory protection can be toggled individually for each entry string, and individual settings take precedence
406 over these global settings.
410 $version = $kdbx->minimum_version;
412 Determine the minimum file version required to save a database losslessly. Using certain databases features
413 might increase this value. For example, setting the KDF to Argon2 will increase the minimum version to at
414 least `KDBX_VERSION_4_0` (i.e. `0x00040000`) because Argon2 was introduced with KDBX4.
416 This method never returns less than `KDBX_VERSION_3_1` (i.e. `0x00030001`). That file version is so
417 ubiquitious and well-supported, there are seldom reasons to dump in a lesser format nowadays.
419 **WARNING:** If you dump a database with a minimum version higher than the current ["version"](#version), the dumper will
420 typically issue a warning and automatically upgrade the database. This seems like the safest behavior in order
421 to avoid data loss, but lower versions have the benefit of being compatible with more software. It is possible
422 to prevent auto-upgrades by explicitly telling the dumper which version to use, but you do run the risk of
423 data loss. A database will never be automatically downgraded.
427 $group = $kdbx->root;
430 Get or set a database's root group. You don't necessarily need to explicitly create or set a root group
431 because it autovivifies when adding entries and groups to the database.
433 Every database has only a single root group at a time. Some old KDB files might have multiple root groups.
434 When reading such files, a single implicit root group is created to contain the actual root groups. When
435 writing to such a format, if the root group looks like it was implicitly created then it won't be written and
436 the resulting file might have multiple root groups. This allows working with older files without changing
437 their written internal structure while still adhering to modern semantics while the database is opened.
439 The root group of a KDBX database contains all of the database's entries and other groups. If you replace the
440 root group, you are essentially replacing the entire database contents with something else.
444 \@lineage = $kdbx->trace_lineage($group);
445 \@lineage = $kdbx->trace_lineage($group, $base_group);
446 \@lineage = $kdbx->trace_lineage($entry);
447 \@lineage = $kdbx->trace_lineage($entry, $base_group);
449 Get the direct line of ancestors from `$base_group` (default: the root group) to a group or entry. The
450 lineage includes the base group but _not_ the target group or entry. Returns `undef` if the target is not in
451 the database structure.
455 $group = $kdbx->recycle_bin;
456 $kdbx->recycle_bin($group);
458 Get or set the recycle bin group. Returns `undef` if there is no recycle bin and ["recycle\_bin\_enabled"](#recycle_bin_enabled) is
459 false, otherwise the current recycle bin or an autovivified recycle bin group is returned.
463 $group = $kdbx->entry_templates;
464 $kdbx->entry_templates($group);
466 Get or set the entry templates group. May return `undef` if unset.
470 $group = $kdbx->last_selected;
471 $kdbx->last_selected($group);
473 Get or set the last selected group. May return `undef` if unset.
475 ## last\_top\_visible
477 $group = $kdbx->last_top_visible;
478 $kdbx->last_top_visible($group);
480 Get or set the last top visible group. May return `undef` if unset.
484 $kdbx->add_group($group);
485 $kdbx->add_group(%group_attributes, %options);
487 Add a group to a database. This is equivalent to identifying a parent group and calling
488 ["add\_group" in File::KDBX::Group](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AGroup#add_group) on the parent group, forwarding the arguments. Available options:
490 - `group` (aka `parent`) - Group object or group UUID to add the group to (default: root group)
494 \&iterator = $kdbx->groups(%options);
495 \&iterator = $kdbx->groups($base_group, %options);
497 Get an [File::KDBX::Iterator](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AIterator) over _groups_ within a database. Options:
499 - `base` - Only include groups within a base group (same as `$base_group`) (default: ["root"](#root))
500 - `inclusive` - Include the base group in the results (default: true)
501 - `algorithm` - Search algorithm, one of `ids`, `bfs` or `dfs` (default: `ids`)
505 $kdbx->add_entry($entry, %options);
506 $kdbx->add_entry(%entry_attributes, %options);
508 Add a entry to a database. This is equivalent to identifying a parent group and calling
509 ["add\_entry" in File::KDBX::Group](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AGroup#add_entry) on the parent group, forwarding the arguments. Available options:
511 - `group` (aka `parent`) - Group object or group UUID to add the entry to (default: root group)
515 \&iterator = $kdbx->entries(%options);
516 \&iterator = $kdbx->entries($base_group, %options);
518 Get an [File::KDBX::Iterator](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AIterator) over _entries_ within a database. Supports the same options as ["groups"](#groups),
521 - `auto_type` - Only include entries with auto-type enabled (default: false, include all)
522 - `searching` - Only include entries within groups with searching enabled (default: false, include all)
523 - `history` - Also include historical entries (default: false, include only current entries)
527 \&iterator = $kdbx->objects(%options);
528 \&iterator = $kdbx->objects($base_group, %options);
530 Get an [File::KDBX::Iterator](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AIterator) over _objects_ within a database. Groups and entries are considered objects,
531 so this is essentially a combination of ["groups"](#groups) and ["entries"](#entries). This won't often be useful, but it can be
532 convenient for maintenance tasks. This method takes the same options as ["groups"](#groups) and ["entries"](#entries).
536 \%icon = $kdbx->custom_icon($uuid);
537 $kdbx->custom_icon($uuid => \%icon);
538 $kdbx->custom_icon(%icon);
539 $kdbx->custom_icon(uuid => $value, %icon);
541 Get or set custom icons.
543 ## custom\_icon\_data
545 $image_data = $kdbx->custom_icon_data($uuid);
547 Get a custom icon image data.
551 $uuid = $kdbx->add_custom_icon($image_data, %attributes);
552 $uuid = $kdbx->add_custom_icon(%attributes);
554 Add a custom icon and get its UUID. If not provided, a random UUID will be generated. Possible attributes:
556 - `uuid` - Icon UUID (default: autogenerated)
557 - `data` - Image data (same as `$image_data`)
558 - `name` - Name of the icon (text, KDBX4.1+)
559 - `last_modification_time` - Just what it says (datetime, KDBX4.1+)
561 ## remove\_custom\_icon
563 $kdbx->remove_custom_icon($uuid);
565 Remove a custom icon.
569 \%all_data = $kdbx->custom_data;
570 $kdbx->custom_data(\%all_data);
572 \%data = $kdbx->custom_data($key);
573 $kdbx->custom_data($key => \%data);
574 $kdbx->custom_data(%data);
575 $kdbx->custom_data(key => $value, %data);
577 Get and set custom data. Custom data is metadata associated with a database.
579 Each data item can have a few attributes associated with it.
581 - `key` - A unique text string identifier used to look up the data item (required)
582 - `value` - A text string value (required)
583 - `last_modification_time` (optional, KDBX4.1+)
585 ## custom\_data\_value
587 $value = $kdbx->custom_data_value($key);
589 Exactly the same as ["custom\_data"](#custom_data) except returns just the custom data's value rather than a structure of
590 attributes. This is a shortcut for:
592 my $data = $kdbx->custom_data($key);
593 my $value = defined $data ? $data->{value} : undef;
595 ## public\_custom\_data
597 \%all_data = $kdbx->public_custom_data;
598 $kdbx->public_custom_data(\%all_data);
600 $value = $kdbx->public_custom_data($key);
601 $kdbx->public_custom_data($key => $value);
603 Get and set public custom data. Public custom data is similar to custom data but different in some important
604 ways. Public custom data:
606 - can store strings, booleans and up to 64-bit integer values (custom data can only store text values)
607 - is NOT encrypted within a KDBX file (hence the "public" part of the name)
608 - is a plain hash/dict of key-value pairs with no other associated fields (like modification times)
610 ## add\_deleted\_object
612 $kdbx->add_deleted_object($uuid);
614 Add a UUID to the deleted objects list. This list is used to support automatic database merging.
616 You typically do not need to call this yourself because the list will be populated automatically as objects
619 ## remove\_deleted\_object
621 $kdbx->remove_deleted_object($uuid);
623 Remove a UUID from the deleted objects list. This list is used to support automatic database merging.
625 You typically do not need to call this yourself because the list will be maintained automatically as objects
628 ## clear\_deleted\_objects
630 Remove all UUIDs from the deleted objects list. This list is used to support automatic database merging, but
631 if you don't need merging then you can clear deleted objects to reduce the database file size.
633 ## resolve\_reference
635 $string = $kdbx->resolve_reference($reference);
636 $string = $kdbx->resolve_reference($wanted, $search_in, $expression);
638 Resolve a [field reference](https://keepass.info/help/base/fieldrefs.html). A field reference is a kind of
639 string placeholder. You can use a field reference to refer directly to a standard field within an entry. Field
640 references are resolved automatically while expanding entry strings (i.e. replacing placeholders), but you can
641 use this method to resolve on-the-fly references that aren't part of any actual string in the database.
643 If the reference does not resolve to any field, `undef` is returned. If the reference resolves to multiple
644 fields, only the first one is returned (in the same order as iterated by ["entries"](#entries)). To avoid ambiguity, you
645 can refer to a specific entry by its UUID.
647 The syntax of a reference is: `{REF:<WantedField>@<SearchIn>:<Text>}`. `Text` is a
648 ["Simple Expression"](#simple-expression). `WantedField` and `SearchIn` are both single character codes representing a field:
656 - `O` - Other custom strings
658 Since `O` does not represent any specific field, it cannot be used as the `WantedField`.
662 To get the value of the _UserName_ string of the first entry with "My Bank" in the title:
664 my $username = $kdbx->resolve_reference('{REF:U@T:"My Bank"}');
665 # OR the {REF:...} wrapper is optional
666 my $username = $kdbx->resolve_reference('U@T:"My Bank"');
667 # OR separate the arguments
668 my $username = $kdbx->resolve_reference(U => T => '"My Bank"');
670 Note how the text is a ["Simple Expression"](#simple-expression), so search terms with spaces must be surrounded in double
673 To get the _Password_ string of a specific entry (identified by its UUID):
675 my $password = $kdbx->resolve_reference('{REF:P@I:46C9B1FFBD4ABC4BBB260C6190BAD20C}');
681 Encrypt all protected binaries strings in a database. The encrypted strings are stored in
682 a [File::KDBX::Safe](https://metacpan.org/pod/File%3A%3AKDBX%3A%3ASafe) associated with the database and the actual strings will be replaced with `undef` to
683 indicate their protected state. Returns itself to allow method chaining.
685 You can call `code` on an already-locked database to memory-protect any unprotected strings and binaries
686 added after the last time the database was locked.
692 Decrypt all protected strings in a database, replacing `undef` placeholders with unprotected values. Returns
693 itself to allow method chaining.
697 $guard = $kdbx->unlock_scoped;
699 Unlock a database temporarily, relocking when the guard is released (typically at the end of a scope). Returns
700 `undef` if the database is already unlocked.
702 See ["lock"](#lock) and ["unlock"](#unlock).
706 $string = $kdbx->peek(\%string);
707 $string = $kdbx->peek(\%binary);
709 Peek at the value of a protected string or binary without unlocking the whole database. The argument can be
710 a string or binary hashref as returned by ["string" in File::KDBX::Entry](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AEntry#string) or ["binary" in File::KDBX::Entry](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AEntry#binary).
714 $bool = $kdbx->is_locked;
716 Get whether or not a database's strings are memory-protected. If this is true, then some or all of the
717 protected strings within the database will be unavailable (literally have `undef` values) until ["unlock"](#unlock) is
720 ## remove\_empty\_groups
722 $kdbx->remove_empty_groups;
724 Remove groups with no subgroups and no entries.
726 ## remove\_unused\_icons
728 $kdbx->remove_unused_icons;
730 Remove icons that are not associated with any entry or group in the database.
732 ## remove\_duplicate\_icons
734 $kdbx->remove_duplicate_icons;
736 Remove duplicate icons as determined by hashing the icon data.
740 $kdbx->prune_history(%options);
742 Remove just as many older historical entries as necessary to get under certain limits.
744 - `max_items` - Maximum number of historical entries to keep (default: value of ["history\_max\_items"](#history_max_items), no limit: -1)
745 - `max_size` - Maximum total size (in bytes) of historical entries to keep (default: value of ["history\_max\_size"](#history_max_size), no limit: -1)
746 - `max_age` - Maximum age (in days) of historical entries to keep (default: 365, no limit: -1)
750 $kdbx->randomize_seeds;
752 Set various keys, seeds and IVs to random values. These values are used by the cryptographic functions that
753 secure the database when dumped. The attributes that will be randomized are:
755 - ["encryption\_iv"](#encryption_iv)
756 - ["inner\_random\_stream\_key"](#inner_random_stream_key)
757 - ["master\_seed"](#master_seed)
758 - ["stream\_start\_bytes"](#stream_start_bytes)
759 - ["transform\_seed"](#transform_seed)
761 Randomizing these values has no effect on a loaded database. These are only used when a database is dumped.
762 You normally do not need to call this method explicitly because the dumper does it explicitly by default.
767 $key = $kdbx->key($key);
768 $key = $kdbx->key($primitive);
770 Get or set a [File::KDBX::Key](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKey). This is the master key (e.g. a password or a key file that can decrypt
771 a database). See ["new" in File::KDBX::Key](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKey#new) for an explanation of what the primitive can be.
773 You generally don't need to call this directly because you can provide the key directly to the loader or
774 dumper when loading or dumping a KDBX file.
778 $key = $kdbx->composite_key($key);
779 $key = $kdbx->composite_key($primitive);
781 Construct a [File::KDBX::Key::Composite](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKey%3A%3AComposite) from a primitive. See ["new" in File::KDBX::Key](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKey#new) for an explanation of
782 what the primitive can be. If the primitive does not represent a composite key, it will be wrapped.
784 You generally don't need to call this directly. The parser and writer use it to transform a master key into
785 a raw encryption key.
789 $kdf = $kdbx->kdf(%options);
790 $kdf = $kdbx->kdf(\%parameters, %options);
792 Get a [File::KDBX::KDF](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKDF) (key derivation function).
796 - `params` - KDF parameters, same as `\%parameters` (default: value of ["kdf\_parameters"](#kdf_parameters))
800 $cipher = $kdbx->cipher(key => $key);
801 $cipher = $kdbx->cipher(key => $key, iv => $iv, uuid => $uuid);
803 Get a [File::KDBX::Cipher](https://metacpan.org/pod/File%3A%3AKDBX%3A%3ACipher) capable of encrypting and decrypting the body of a database file.
805 A key is required. This should be a raw encryption key made up of a fixed number of octets (depending on the
806 cipher), not a [File::KDBX::Key](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AKey) or primitive.
808 If not passed, the UUID comes from `$kdbx->headers->{cipher_id}` and the encryption IV comes from
809 `$kdbx->headers->{encryption_iv}`.
811 You generally don't need to call this directly. The parser and writer use it to decrypt and encrypt KDBX
816 $cipher = $kdbx->random_stream;
817 $cipher = $kdbx->random_stream(id => $stream_id, key => $key);
819 Get a [File::KDBX::Cipher::Stream](https://metacpan.org/pod/File%3A%3AKDBX%3A%3ACipher%3A%3AStream) for decrypting and encrypting protected values.
821 If not passed, the ID and encryption key comes from `$kdbx->headers->{inner_random_stream_id}` and
822 `$kdbx->headers->{inner_random_stream_key}` (respectively) for KDBX3 files and from
823 `$kdbx->inner_headers->{inner_random_stream_key}` and
824 `$kdbx->inner_headers->{inner_random_stream_id}` (respectively) for KDBX4 files.
826 You generally don't need to call this directly. The parser and writer use it to scramble protected strings.
830 ## Create a new database
832 my $kdbx = File::KDBX->new;
834 my $group = $kdbx->add_group(name => 'Passwords);
835 my $entry = $group->add_entry(
836 title => 'WayneCorp',
837 username => 'bwayne',
838 password => 'iambatman',
839 url => 'https://example.com/login'
841 $entry->add_auto_type_window_association('WayneCorp - Mozilla Firefox', '{PASSWORD}{ENTER}');
843 $kdbx->dump_file('mypasswords.kdbx', 'master password CHANGEME');
845 ## Read an existing database
847 my $kdbx = File::KDBX->load_file('mypasswords.kdbx', 'master password CHANGEME');
848 $kdbx->unlock; # cause $entry->password below to be defined
850 $kdbx->entries->each(sub {
852 say 'Found password for: ', $entry->title;
853 say ' Username: ', $entry->username;
854 say ' Password: ', $entry->password;
857 ## Search for entries
859 my @entries = $kdbx->entries(searching => 1)
860 ->grep(title => 'WayneCorp')
861 ->each; # return all matches
863 The `searching` option limits results to only entries within groups with searching enabled. Other options are
864 also available. See ["entries"](#entries).
866 See ["QUERY"](#query) for many more query examples.
868 ## Search for entries by auto-type window association
870 my $window_title = 'WayneCorp - Mozilla Firefox';
872 my $entries = $kdbx->entries(auto_type => 1)
874 my ($ata) = grep { $_->{window} =~ /\Q$window_title\E/i } @{$_->auto_type_associations};
875 return [$_, $ata->{keystroke_sequence}] if $ata;
878 my ($entry, $keys) = @$_;
879 say 'Entry title: ', $entry->title, ', key sequence: ', $keys;
884 Entry title: WayneCorp, key sequence: {PASSWORD}{ENTER}
886 ## Remove entries from a database
889 ->grep(notes => {'=~' => qr/too old/i})
890 ->each(sub { $_->recycle });
892 Recycle all entries with the string "too old" appearing in the **Notes** string.
894 ## Remove empty groups
896 $kdbx->groups(algorithm => 'dfs')
897 ->where(-true => 'is_empty')
900 With the search/iteration `algorithm` set to "dfs", groups will be ordered deepest first and the root group
901 will be last. This allows removing groups that only contain empty groups.
903 This can also be done with one call to ["remove\_empty\_groups"](#remove_empty_groups).
907 One of the biggest threats to your database security is how easily the encryption key can be brute-forced.
908 Strong brute-force protection depends on:
910 - Using unguessable passwords, passphrases and key files.
911 - Using a brute-force resistent key derivation function.
913 The first factor is up to you. This module does not enforce strong master keys. It is up to you to pick or
914 generate strong keys.
916 The KDBX format allows for the key derivation function to be tuned. The idea is that you want each single
917 brute-foce attempt to be expensive (in terms of time, CPU usage or memory usage), so that making a lot of
918 attempts (which would be required if you have a strong master key) gets _really_ expensive.
920 How expensive you want to make each attempt is up to you and can depend on the application.
922 This and other KDBX-related security issues are covered here more in depth:
923 [https://keepass.info/help/base/security.html](https://keepass.info/help/base/security.html)
925 Here are other security risks you should be thinking about:
929 This distribution uses the excellent [CryptX](https://metacpan.org/pod/CryptX) and [Crypt::Argon2](https://metacpan.org/pod/Crypt%3A%3AArgon2) packages to handle all crypto-related
930 functions. As such, a lot of the security depends on the quality of these dependencies. Fortunately these
931 modules are maintained and appear to have good track records.
933 The KDBX format has evolved over time to incorporate improved security practices and cryptographic functions.
934 This package uses the following functions for authentication, hashing, encryption and random number
947 At the time of this writing, I am not aware of any successful attacks against any of these functions. These
948 are among the most-analyzed and widely-adopted crypto functions available.
950 The KDBX format allows the body cipher and key derivation function to be configured. If a flaw is discovered
951 in one of these functions, you can hopefully just switch to a better function without needing to update this
952 software. A later software release may phase out the use of any functions which are no longer secure.
956 It is not a good idea to keep secret information unencrypted in system memory for longer than is needed. The
957 address space of your program can generally be read by a user with elevated privileges on the system. If your
958 system is memory-constrained or goes into a hibernation mode, the contents of your address space could be
959 written to a disk where it might be persisted for long time.
961 There might be system-level things you can do to reduce your risk, like using swap encryption and limiting
962 system access to your program's address space while your program is running.
964 **File::KDBX** helps minimize (but not eliminate) risk by keeping secrets encrypted in memory until accessed
965 and zeroing out memory that holds secrets after they're no longer needed, but it's not a silver bullet.
967 For one thing, the encryption key is stored in the same address space. If core is dumped, the encryption key
968 is available to be found out. But at least there is the chance that the encryption key and the encrypted
969 secrets won't both be paged out together while memory-constrained.
971 Another problem is that some perls (somewhat notoriously) copy around memory behind the scenes willy nilly,
972 and it's difficult know when perl makes a copy of a secret in order to be able to zero it out later. It might
973 be impossible. The good news is that perls with SvPV copy-on-write (enabled by default beginning with perl
974 5.20) are much better in this regard. With COW, it's mostly possible to know what operations will cause perl
975 to copy the memory of a scalar string, and the number of copies will be significantly reduced. There is a unit
976 test named `t/memory-protection.t` in this distribution that can be run on POSIX systems to determine how
977 well **File::KDBX** memory protection is working.
979 Memory protection also depends on how your application handles secrets. If your app code is handling scalar
980 strings with secret information, it's up to you to make sure its memory is zeroed out when no longer needed.
981 ["erase" in File::KDBX::Util](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AUtil#erase) et al. provide some tools to help accomplish this. Or if you're not too concerned
982 about the risks memory protection is meant to mitigate, then maybe don't worry about it. The security policy
983 of **File::KDBX** is to try hard to keep secrets protected while in memory so that your app might claim a high
984 level of security, in case you care about that.
986 There are some memory protection strategies that **File::KDBX** does NOT use today but could in the future:
988 Many systems allow programs to mark unswappable pages. Secret information should ideally be stored in such
989 pages. You could potentially use [mlockall(2)](http://man.he.net/man2/mlockall) (or equivalent for your system) in your own application to
990 prevent the entire address space from being swapped.
992 Some systems provide special syscalls for storing secrets in memory while keeping the encryption key outside
993 of the program's address space, like `CryptProtectMemory` for Windows. This could be a good option, though
994 unfortunately not portable.
998 To find things in a KDBX database, you should use a filtered iterator. If you have an iterator, such as
999 returned by ["entries"](#entries), ["groups"](#groups) or even ["objects"](#objects) you can filter it using ["where" in File::KDBX::Iterator](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AIterator#where).
1001 my $filtered_entries = $kdbx->entries->where($query);
1003 A `$query` is just a subroutine that you can either write yourself or have generated for you from either
1004 a ["Simple Expression"](#simple-expression) or ["Declarative Syntax"](#declarative-syntax). It's easier to have your query generated, so I'll cover
1007 ## Simple Expression
1009 A simple expression is mostly compatible with the KeePass 2 implementation
1010 [described here](https://keepass.info/help/base/search.html#mode_se).
1012 An expression is a string with one or more space-separated terms. Terms with spaces can be enclosed in double
1013 quotes. Terms are negated if they are prefixed with a minus sign. A record must match every term on at least
1014 one of the given fields.
1016 So a simple expression is something like what you might type into a search engine. You can generate a simple
1017 expression query using ["simple\_expression\_query" in File::KDBX::Util](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AUtil#simple_expression_query) or by passing the simple expression as
1018 a **scalar reference** to `where`.
1020 To search for all entries in a database with the word "canyon" appearing anywhere in the title:
1022 my $entries = $kdbx->entries->where(\'canyon', qw[title]);
1024 Notice the first argument is a **scalarref**. This disambiguates a simple expression from other types of
1025 queries covered below.
1027 As mentioned, a simple expression can have multiple terms. This simple expression query matches any entry that
1028 has the words "red" **and** "canyon" anywhere in the title:
1030 my $entries = $kdbx->entries->where(\'red canyon', qw[title]);
1032 Each term in the simple expression must be found for an entry to match.
1034 To search for entries with "red" in the title but **not** "canyon", just prepend "canyon" with a minus sign:
1036 my $entries = $kdbx->entries->where(\'red -canyon', qw[title]);
1038 To search over multiple fields simultaneously, just list them all. To search for entries with "grocery" (but
1039 not "Foodland") in the title or notes:
1041 my $entries = $kdbx->entries->where(\'grocery -Foodland', qw[title notes]);
1043 The default operator is a case-insensitive regexp match, which is fine for searching text loosely. You can use
1044 just about any binary comparison operator that perl supports. To specify an operator, list it after the simple
1045 expression. For example, to search for any entry that has been used at least five times:
1047 my $entries = $kdbx->entries->where(\5, '>=', qw[usage_count]);
1049 It helps to read it right-to-left, like "usage\_count is greater than or equal to 5".
1051 If you find the disambiguating structures to be distracting or confusing, you can also the
1052 ["simple\_expression\_query" in File::KDBX::Util](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AUtil#simple_expression_query) function as a more intuitive alternative. The following example is
1053 equivalent to the previous:
1055 my $entries = $kdbx->entries->where(simple_expression_query(5, '>=', qw[usage_count]));
1057 ## Declarative Syntax
1059 Structuring a declarative query is similar to ["WHERE CLAUSES" in SQL::Abstract](https://metacpan.org/pod/SQL%3A%3AAbstract#WHERE-CLAUSES), but you don't have to be
1060 familiar with that module. Just learn by examples here.
1062 To search for all entries in a database titled "My Bank":
1064 my $entries = $kdbx->entries->where({ title => 'My Bank' });
1066 The query here is `{ title => 'My Bank' }`. A hashref can contain key-value pairs where the key is an
1067 attribute of the thing being searched for (in this case an entry) and the value is what you want the thing's
1068 attribute to be to consider it a match. In this case, the attribute we're using as our match criteria is
1069 ["title" in File::KDBX::Entry](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AEntry#title), a text field. If an entry has its title attribute equal to "My Bank", it's
1072 A hashref can contain multiple attributes. The search candidate will be a match if _all_ of the specified
1073 attributes are equal to their respective values. For example, to search for all entries with a particular URL
1076 my $entries = $kdbx->entries->where({
1077 url => 'https://example.com',
1081 To search for entries matching _any_ criteria, just change the hashref to an arrayref. To search for entries
1082 with a particular URL **OR** username:
1084 my $entries = $kdbx->entries->where([ # <-- Notice the square bracket
1085 url => 'https://example.com',
1089 You can use different operators to test different types of attributes. The ["icon\_id" in File::KDBX::Entry](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AEntry#icon_id)
1090 attribute is a number, so we should use a number comparison operator. To find entries using the smartphone
1093 my $entries = $kdbx->entries->where({
1094 icon_id => { '==', ICON_SMARTPHONE },
1097 Note: ["ICON\_SMARTPHONE" in File::KDBX::Constants](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AConstants#ICON_SMARTPHONE) is just a constant from [File::KDBX::Constants](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AConstants). It isn't
1098 special to this example or to queries generally. We could have just used a literal number.
1100 The important thing to notice here is how we wrapped the condition in another arrayref with a single key-value
1101 pair where the key is the name of an operator and the value is the thing to match against. The supported
1104 - `eq` - String equal
1105 - `ne` - String not equal
1106 - `lt` - String less than
1107 - `gt` - String greater than
1108 - `le` - String less than or equal
1109 - `ge` - String greater than or equal
1110 - `==` - Number equal
1111 - `!=` - Number not equal
1112 - `<` - Number less than
1113 - `>`> - Number greater than
1114 - `<=` - Number less than or equal
1115 - `>=` - Number less than or equal
1116 - `=~` - String match regular expression
1117 - `!~` - String does not match regular expression
1118 - `!` - Boolean false
1119 - `!!` - Boolean true
1121 Other special operators:
1123 - `-true` - Boolean true
1124 - `-false` - Boolean false
1125 - `-not` - Boolean false (alias for `-false`)
1126 - `-defined` - Is defined
1127 - `-undef` - Is not defined
1128 - `-empty` - Is empty
1129 - `-nonempty` - Is not empty
1130 - `-or` - Logical or
1131 - `-and` - Logical and
1133 Let's see another example using an explicit operator. To find all groups except one in particular (identified
1134 by its ["uuid" in File::KDBX::Group](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AGroup#uuid)), we can use the `ne` (string not equal) operator:
1136 my $groups = $kdbx->groups->where(
1138 'ne' => uuid('596f7520-6172-6520-7370-656369616c2e'),
1142 Note: ["uuid" in File::KDBX::Util](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AUtil#uuid) is a little utility function to convert a UUID in its pretty form into bytes.
1143 This utility function isn't special to this example or to queries generally. It could have been written with
1144 a literal such as `"\x59\x6f\x75\x20\x61..."`, but that's harder to read.
1146 Notice we searched for groups this time. Finding groups works exactly the same as it does for entries.
1148 Notice also that we didn't wrap the query in hashref curly-braces or arrayref square-braces. Those are
1149 optional. By default it will only match ALL attributes (as if there were curly-braces).
1151 Testing the truthiness of an attribute is a little bit different because it isn't a binary operation. To find
1152 all entries with the password quality check disabled:
1154 my $entries = $kdbx->entries->where('!' => 'quality_check');
1156 This time the string after the operator is the attribute name rather than a value to compare the attribute
1157 against. To test that a boolean value is true, use the `!!` operator (or `-true` if `!!` seems a little too
1158 weird for your taste):
1160 my $entries = $kdbx->entries->where('!!' => 'quality_check');
1161 my $entries = $kdbx->entries->where(-true => 'quality_check'); # same thing
1163 Yes, there is also a `-false` and a `-not` if you prefer one of those over `!`. `-false` and `-not`
1164 (along with `-true`) are also special in that you can use them to invert the logic of a subquery. These are
1165 logically equivalent:
1167 my $entries = $kdbx->entries->where(-not => { title => 'My Bank' });
1168 my $entries = $kdbx->entries->where(title => { 'ne' => 'My Bank' });
1170 These special operators become more useful when combined with two more special operators: `-and` and `-or`.
1171 With these, it is possible to construct more interesting queries with groups of logic. For example:
1173 my $entries = $kdbx->entries->where({
1174 title => { '=~', qr/bank/ },
1177 notes => { '=~', qr/business/ },
1178 icon_id => { '==', ICON_TRASHCAN_FULL },
1183 In English, find entries where the word "bank" appears anywhere in the title but also do not have either the
1184 word "business" in the notes or are using the full trashcan icon.
1188 Lastly, as mentioned at the top, you can ignore all this and write your own subroutine. Your subroutine will
1189 be called once for each object being searched over. The subroutine should match the candidate against whatever
1190 criteria you want and return true if it matches or false to skip. To do this, just pass your subroutine
1193 To review the different types of queries, these are all equivalent to find all entries in the database titled
1196 my $entries = $kdbx->entries->where(\'"My Bank"', 'eq', qw[title]); # simple expression
1197 my $entries = $kdbx->entries->where(title => 'My Bank'); # declarative syntax
1198 my $entries = $kdbx->entries->where(sub { $_->title eq 'My Bank' }); # subroutine query
1200 This is a trivial example, but of course your subroutine can be arbitrarily complex.
1202 All of these query mechanisms described in this section are just tools, each with its own set of limitations.
1203 If the tools are getting in your way, you can of course iterate over the contents of a database and implement
1204 your own query logic, like this:
1206 my $entries = $kdbx->entries;
1207 while (my $entry = $entries->next) {
1208 if (wanted($entry)) {
1209 do_something($entry);
1218 Iterators are the built-in way to navigate or walk the database tree. You get an iterator from ["entries"](#entries),
1219 ["groups"](#groups) and ["objects"](#objects). You can specify the search algorithm to iterate over objects in different orders
1220 using the `algorith` option, which can be one of these [constants](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AConstants#iteration):
1222 - `ITERATION_IDS` - Iterative deepening search (default)
1223 - `ITERATION_DFS` - Depth-first search
1224 - `ITERATION_BFS` - Breadth-first search
1226 When iterating over objects generically, groups always precede their direct entries (if any). When the
1227 `history` option is used, current entries always precede historical entries.
1229 If you have a database tree like this:
1240 IDS order of groups is: Root, Group1, Group2, Group3
1241 IDS order of entries is: EntryA, EntryB, EntryC
1242 IDS order of objects is: Root, Group1, EntryA, Group2, EntryB, Group3, EntryC
1244 DFS order of groups is: Group2, Group1, Group3, Root
1245 DFS order of entries is: EntryB, EntryA, EntryC
1246 DFS order of objects is: Group2, EntryB, Group1, EntryA, Group3, EntryC, Root
1248 BFS order of groups is: Root, Group1, Group3, Group2
1249 BFS order of entries is: EntryA, EntryC, EntryB
1250 BFS order of objects is: Root, Group1, EntryA, Group3, EntryC, Group2, EntryB
1254 **TODO** - This is a planned feature, not yet implemented.
1258 Errors in this package are constructed as [File::KDBX::Error](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AError) objects and propagated using perl's built-in
1259 mechanisms. Fatal errors are propagated using ["die" in functions](https://metacpan.org/pod/functions#die) and non-fatal errors (a.k.a. warnings) are
1260 propagated using ["warn" in functions](https://metacpan.org/pod/functions#warn) while adhering to perl's [warnings](https://metacpan.org/pod/warnings) system. If you're already familiar
1261 with these mechanisms, you can skip this section.
1263 You can catch fatal errors using ["eval" in functions](https://metacpan.org/pod/functions#eval) (or something like [Try::Tiny](https://metacpan.org/pod/Try%3A%3ATiny)) and non-fatal errors using
1264 `$SIG{__WARN__}` (see ["%SIG" in variables](https://metacpan.org/pod/variables#SIG)). Examples:
1266 use File::KDBX::Error qw(error);
1268 my $key = ''; # uh oh
1270 $kdbx->load_file('whatever.kdbx', $key);
1272 if (my $error = error($@)) {
1273 handle_missing_key($error) if $error->type eq 'key.missing';
1277 or using `Try::Tiny`:
1280 $kdbx->load_file('whatever.kdbx', $key);
1286 Catching non-fatal errors:
1289 local $SIG{__WARN__} = sub { push @warnings, $_[0] };
1291 $kdbx->load_file('whatever.kdbx', $key);
1293 handle_warnings(@warnings) if @warnings;
1295 By default perl prints warnings to `STDERR` if you don't catch them. If you don't want to catch them and also
1296 don't want them printed to `STDERR`, you can suppress them lexically (perl v5.28 or higher required):
1299 no warnings 'File::KDBX';
1306 local $File::KDBX::WARNINGS = 0;
1310 or globally in your program:
1312 $File::KDBX::WARNINGS = 0;
1314 You cannot suppress fatal errors, and if you don't catch them your program will exit.
1318 This software will alter its behavior depending on the value of certain environment variables:
1320 - `PERL_FILE_KDBX_XS` - Do not use [File::KDBX::XS](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AXS) if false (default: true)
1321 - `PERL_ONLY` - Do not use [File::KDBX::XS](https://metacpan.org/pod/File%3A%3AKDBX%3A%3AXS) if true (default: false)
1322 - `NO_FORK` - Do not fork if true (default: false)
1326 Some features (e.g. parsing) require 64-bit perl. It should be possible and actually pretty easy to make it
1327 work using [Math::BigInt](https://metacpan.org/pod/Math%3A%3ABigInt), but I need to build a 32-bit perl in order to test it and frankly I'm still
1328 figuring out how. I'm sure it's simple so I'll mark this one "TODO", but for now an exception will be thrown
1329 when trying to use such features with undersized IVs.
1333 - [KeePass Password Safe](https://keepass.info/) - The original KeePass
1334 - [KeePassXC](https://keepassxc.org/) - Cross-Platform Password Manager written in C++
1335 - [File::KeePass](https://metacpan.org/pod/File%3A%3AKeePass) has overlapping functionality. It's good but has a backlog of some pretty critical bugs and lacks support for newer KDBX features.
1339 Please report any bugs or feature requests on the bugtracker website
1340 [https://github.com/chazmcgarvey/File-KDBX/issues](https://github.com/chazmcgarvey/File-KDBX/issues)
1342 When submitting a bug or request, please include a test-file or a
1343 patch to an existing test-file that illustrates the bug or desired
1348 Charles McGarvey <ccm@cpan.org>
1350 # COPYRIGHT AND LICENSE
1352 This software is copyright (c) 2022 by Charles McGarvey.
1354 This is free software; you can redistribute it and/or modify it under
1355 the same terms as the Perl 5 programming language system itself.