Importing from KeePass

Vaultigen imports XML exports from KeePass 2.x and KeePassXC, including groups, custom fields, tags, expiry dates, attachments and TOTP seeds. This page covers what is specific to KeePass; the wizard itself is described in Importing data.

Native .kdbx database files and the old KeePassX 0.4 format are not supported. Export to XML first.

Export from KeePass or KeePassXC

KeePass 2.x

1. Open and unlock the database.
2. Choose File → Export.
3. Select the format KeePass XML (2.x) and save the file.

KeePassXC

1. Open and unlock the database.
2. Choose Database → Export → XML File and confirm the warning about the unencrypted file.
3. Save the file.

The XML export is not encrypted. It contains every password in plain text. Create it on a trusted machine, transfer it directly to the browser you import from, and delete it securely as soon as the import has finished.

A file that still contains encrypted (protected) values is not a plain export and is refused. Export it again as plain XML from KeePass or KeePassXC.

Import into Vaultigen

1. Open System → Import and choose KeePass / KeePassXC (XML export).

2. Select the XML file and click Stage upload. No password is needed. The file is parsed once, including its attachments, and immediately re-encrypted under a Vaultigen import key.

3. In Setup, check the summary: entries, groups, attachments and TOTP seeds, plus what was skipped or needs attention (see below). Then choose a layout:

   • A single vault (default): everything in one vault, with each Group path as a folder, for example Servers / Production.
   • One vault per top-level group: each first-level group becomes a vault, and the Subgroup path below it becomes a folder.
   • One vault per group: each group path becomes its own vault.
   • One vault per subgroup: each path below the top-level group becomes a vault; the top-level group can become a folder or a tag.

   For Top-level group, Subgroup and Group path you can each choose a separate vault, a folder, a tag or skip. Group path cannot be combined with the other two.

4. Review the Vaults and Tags steps.

5. In Confirm and import, click Run import. No password is needed.

Entries directly in the root group have no group. They are placed at the root of a vault named after the KeePass root group or database.

What gets imported

KeePass	Vaultigen
Entry	Login entry with title, username, password, URL and notes
Group	A separate vault, a folder or a tag, depending on the layout
Additional string fields	Custom fields. Fields marked as protected in KeePass become concealed fields.
Tags	Tags (global or vault-local)
Expiry date	The entry’s expiry date
Attachments	Encrypted attachments on the entry
TOTP	The entry’s TOTP seed (see below)

Skipped and shown in the summary:

• Recycle bin: entries in the KeePass recycle bin are not imported.
• History: older versions of an entry are not imported; only the current version is.

TOTP

Vaultigen reads the TOTP settings of KeePassXC (otp field), of KeePass 2.47 and newer (TimeOtp-* fields) and the older TOTP Seed / TOTP Settings fields. Login entries generate SHA-1 codes with 6 digits every 30 seconds, so only seeds with exactly these settings are imported as TOTP.

Any other configuration is counted under Unsupported TOTP. The entry is still imported, and its original TOTP fields are kept as concealed custom fields so you can set it up by hand. No imported entry ever generates wrong codes.

Field references

KeePass field references such as {REF:P@I:…} are not resolved; they are imported as literal text. The summary counts affected entries under Field references. Replace them with the actual values after the import.

Attachments

Each attachment is stored as an ordinary encrypted Vaultigen attachment and subject to the same limits:

• the per-file limit (VAULTIGEN_ATTACHMENT_MAX_BYTES, 25 MB by default),
• the per-vault quota (VAULTIGEN_VAULT_ATTACHMENT_MAX_BYTES, 500 MB by default),
• a total for all attachments in one import (VAULTIGEN_IMPORT_ATTACHMENT_MAX_BYTES, 64 MB by default). If the export exceeds it, nothing is staged.

Attachments that cannot be read are counted under Unreadable attachments. An attachment that cannot be stored does not fail its entry: the entry is imported, and the report lists the missing file so you can add it by hand.

The XML file contains all attachments, Base64-encoded, so it is larger than the database. The export file can be at most 64 MB. For large exports, raise PHP’s upload_max_filesize and post_max_size to match (see Requirements).