kpx is a pure Rust implementation of the KeePassXC browser integration protocol along with an accompanying CLI tool. The workspace hosts two crates:
kpx: a synchronous client that handles the native messaging handshake, key exchange, and encrypted request/response lifecycle.kpx-cli: a small utility that stores associations in the OS keyring and prints structured JSON.
What is this useful for? storing secrets in KeePassXC and retrieving them programmatically.
If you use keepassxc-cli, you will be required to enter your database password every time you want to fetch an entry. With kpx, you can set up a trust relationship once and then retrieve entries without having to input the password every time, as long as the database is unlocked. Whether this happens automatically or with a prompt is controlled by KeePassXC and depends on your database configuration.
WARNING: This project is not affiliated with or endorsed by the KeePassXC project.
WARNING: This project is experimental and may not cover all edge cases of the KeePassXC protocol.
WARNING: After association, this tool is able to access your KeePassXC database entries. Depending on your KeePassXC configuration, it may be able to read entries without notifying you if the database is unlocked. Therefore, it can be used to exfiltrate sensitive information. Use with caution!.
Install from source and fetch credentials:
cargo install kpx-cli
kpx associations new
kpx get --url https://example.comkpx-cli stores associations in the OS keyring so subsequent invocations can reuse the same KeePassXC trust relationship.
This crate has only been tested on Ubuntu 24.04.3 LTS on x86_64 with KeePassXC 2.7.6. Other platforms and versions are published for user's convenience and may work but are untested.
Licensed under MIT, see the workspace LICENSE file for details.