Opening Error

First and foremost, bear in mind that a KeePass file is an encrypted file and that its integrity must be guaranteed for it to work. Please ensure you handle, store, copy and move it with due care.

If, despite your backup strategy, you encounter any problems, your database won't open and the message Could not read credentials appears, errors may occur that prevent your database from opening.

This page lists possible causes and may be of help.

Types

There are currently three known causes that could prevent your encrypted .kdbx database file from opening.:

• Incorrect file synchronization
• Edition by an external app
• A bug in KeePassDX

File synchronization

This is the most common problem. Most cloud applications today do not handle file synchronization properly, and several issues can arise.

For example, synchronization over the network may be interrupted, file conflicts may cause hash values to change, or simply part or all of the file may be deleted.

It is your responsibility to ensure that the tools you use are fully functional and meet minimum requirements. The wiki page on file synchronization can help you choose the best file manager. https://github.com/Kunzisoft/KeePassDX/wiki/File-Manager-and-Sync

External data edition

If you are using another KeePass-compatible app, even though the format is open and accessible, there may be incompatibilities. These are either

• Unintentional: Different versions of the KeePass format may be implemented with errors or with incompatibilities caused by plugins or bugs.
• Targeted and deliberate: KeePass clients can be used to delete, alter, or retrieve user data. Be sure to examine the source code and check the reliability of your preferred client.

Make sure the compatible application is indeed open source and that it fully complies with the KeePass format and its conventions.

Bug

Whilst the first two scenarios are the most common, the last one can nevertheless occur despite our best efforts. That is why we do everything we can to identify and resolve any issues as quickly as possible once they have been brought to our attention, thanks to you.

To ensure complete transparency and to provide visibility about bugs that might affect your files, KeePassDX will list the issues encountered and explain their causes, the affected versions, and the solutions.

32 zero-bytes Keyfile

Patched version	Affected version	Severity	Reported by
4.5.3	> 4.4.0beta01 < 4.5.3	Medium	@Selaron

Problem

A technical oversight in handling exactly 32-byte key files caused them to be accidentally erased in the app's memory after a database was opened. If a user saved their database while this "erased" state existed, the database was re-encrypted using a key of 32 zero bytes instead of their original random key. This makes the original key appear "invalid" to other software and to KeePassDX itself in future sessions.

This problem arose after we improved the application's security by implementing a system to clear data after usage in commits 287795d and bedd960 to fix #2480

The only databases affected are those saved by KeePassDX versions 4.4.0beta01 through 4.5.2 using a key file that is exactly 32 bytes in size.

Solution

Version 4.5.3 fixes the issue by simply copying the byteArray from the key file to maintain a valid reference in commit e3f5ab3

Recovery Guide

1. Identify: If your 32-byte key file stopped working after saving with a previous version of KeePassDX, your database is likely now protected by a "zero-key."
2. Action: Download the temporary recovery key file containing 32 zero bytes zero.zip and unzip it.
3. Unlock: Attempt to open your "broken" database using your password and this zero.key.
4. Re-secure: Once opened, immediately go to database settings and change the master credentials to generate a new, secure key file (using the default XML format is recommended as it was not affected by this bug).