How to Install KeePassXC on Ubuntu

KeePassXC helps you store and organize passwords, usernames, URLs, and notes in an encrypted offline database. Because your data never leaves your computer, you maintain complete control over your sensitive information. Common use cases include managing login credentials across multiple websites, storing SSH keys with the built-in SSH agent, generating strong passwords, and sharing password databases securely between team members using KeeShare. By the end of this guide, you will have KeePassXC installed and verified on Ubuntu, ready to create your first encrypted password database.

Choose Your KeePassXC Installation Method

Ubuntu offers several installation paths for KeePassXC, each with different trade-offs between version freshness, system integration, and maintenance requirements. The comparison table below summarizes your options, and the sections that follow provide complete instructions for each method.

Method	Channel	Version	Updates	Best For
Ubuntu Repository	Ubuntu Repos	Distribution default	Automatic via apt upgrade	Users who prefer distro-tested packages
KeePassXC PPA	Launchpad PPA	Latest stable	Automatic via apt upgrade	Users on 22.04/24.04 who want newest features
Flatpak	Flathub	Latest stable	Automatic via flatpak update	Users who prefer sandboxed applications
Snap	Snapcraft	Latest stable	Automatic background updates	Users who want automatic updates with confinement
Source Compilation	GitHub	Any version	Manual recompilation	Developers and users who need custom build options

For most users, the Ubuntu repository method is recommended because it provides automatic security updates and requires no additional configuration. If you need the latest features and are running Ubuntu 22.04 or 24.04, the official PPA offers newer versions while maintaining APT integration.

This guide covers Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS installations. The KeePassXC PPA does not currently provide packages for Ubuntu 26.04 LTS (resolute), so users on that release should use the Ubuntu repository, Flatpak, Snap, or compile from source. Commands shown work identically across all supported LTS releases unless otherwise noted.

Update Ubuntu Before Installation

Before installing any new software, update your package index and upgrade existing packages. This ensures you have the latest security patches and that your package manager can resolve dependencies correctly.

Open your terminal by searching for “Terminal” in Activities, then run the following command:

sudo apt update && sudo apt upgrade

The first part refreshes your package index from all configured repositories, while the second upgrades any installed packages that have newer versions available. Confirm with Y when prompted.

Method 1: Install KeePassXC from Ubuntu Repository

The Ubuntu repository includes a stable version of KeePassXC that receives security updates through the standard apt upgrade process. Additionally, this method works on all supported Ubuntu LTS releases without additional configuration.

To install KeePassXC from the default repository, run:

sudo apt install keepassxc

After installation completes, verify that KeePassXC is available by checking the installed version. The keepassxc-cli command provides version information without requiring a graphical display, making it reliable for terminal-only environments:

keepassxc-cli --version

Expected output varies by Ubuntu version. On Ubuntu 26.04 LTS, you should see:

2.7.10

On Ubuntu 24.04 LTS, the version is 2.7.6, while on Ubuntu 22.04 LTS, it is 2.6.6. Although these versions are older than the latest upstream release, they receive security patches through Ubuntu’s update process.

Method 2: Install KeePassXC from Official PPA

The official KeePassXC PPA is maintained by the KeePassXC developer and provides the latest stable release. This method gives you access to new features and improvements while maintaining APT package management.

The KeePassXC PPA currently supports Ubuntu 22.04 LTS (jammy) and 24.04 LTS (noble). Ubuntu 26.04 LTS (resolute) is not yet available in this PPA. If you are running 26.04, use one of the other installation methods described in this guide.

First, add the PPA to your system’s package sources:

sudo add-apt-repository ppa:phoerious/keepassxc -y

The -y flag automatically confirms the addition without prompting. After adding the PPA, refresh your package index to include the new source:

sudo apt update

Next, install KeePassXC from the PPA:

sudo apt install keepassxc

Then verify the installation and confirm you have the PPA version:

keepassxc-cli --version

You should see version 2.7.11 or newer:

2.7.11

Method 3: Install KeePassXC via Flatpak

Flatpak provides a sandboxed installation that runs independently of your system libraries. Furthermore, this method works on all Ubuntu LTS releases and receives updates directly from Flathub, typically delivering new versions faster than distribution repositories.

Flatpak is not pre-installed on Ubuntu. If you have not set it up yet, install it with sudo apt install flatpak and restart your session before continuing. For detailed setup including the Flathub repository, follow our Flatpak installation guide for Ubuntu.

Once Flatpak and Flathub are configured, install KeePassXC with:

sudo flatpak install flathub org.keepassxc.KeePassXC -y

By default, the --system scope is used with sudo, making KeePassXC available to all users on the system. After installation, verify the Flatpak package is installed:

flatpak list | grep -i keepass

Expected output showing the installed version:

KeePassXC	org.keepassxc.KeePassXC	2.7.11	stable	system

To launch KeePassXC via Flatpak from the terminal, use:

flatpak run org.keepassxc.KeePassXC

Alternatively, the application appears in your desktop’s application menu after installation.

Method 4: Install KeePassXC via Snap

Snap packages are confined applications that update automatically in the background. Since Ubuntu includes Snap support by default on standard desktop and server installations, this method is immediately available without additional setup.

To install KeePassXC from the Snap Store, run:

sudo snap install keepassxc

After installation completes, verify the installed version:

keepassxc-cli --version

Expected output:

2.7.11

Additionally, you can verify the Snap installation with:

snap list keepassxc

Ubuntu includes Snap by default on standard installs. If snap is missing (minimal, WSL, or container environments), install it with sudo apt install snapd.

Method 5: Compile KeePassXC from Source

Compiling from source gives you maximum control over build options and allows you to use the very latest development version. In particular, this method is useful when you need features not yet available in packaged releases, want to enable or disable specific components, or are contributing to KeePassXC development.

Install Build Dependencies

KeePassXC requires Qt5, various cryptographic libraries, and standard build tools. The cmake build system orchestrates compilation, while git clones the source code. Install all necessary dependencies with the following command:

sudo apt install build-essential cmake g++ git asciidoctor \
    qtbase5-dev qtbase5-private-dev qttools5-dev qttools5-dev-tools \
    libqt5svg5-dev libargon2-dev libminizip-dev libbotan-2-dev libqrencode-dev \
    libkeyutils-dev zlib1g-dev libreadline-dev libpcsclite-dev libusb-1.0-0-dev \
    libxi-dev libxtst-dev libqt5x11extras5-dev

This dependency list comes from the official KeePassXC build documentation and has been verified on Ubuntu 22.04, 24.04, and 26.04 LTS.

Clone the Source Code

Next, create a build directory and clone the KeePassXC repository. Using the latest tag ensures you get the most recent stable release:

mkdir -p ~/keepassxc-build && cd ~/keepassxc-build
git clone --depth 1 --branch latest https://github.com/keepassxreboot/keepassxc.git

Note that the --depth 1 flag creates a shallow clone with only the latest commit, which downloads faster than the full repository history.

Configure and Compile

Then navigate into the source directory, create a build subdirectory, and run cmake with the recommended options:

cd keepassxc
mkdir build && cd build
cmake -DWITH_XC_ALL=ON -DCMAKE_BUILD_TYPE=Release ..

The -DWITH_XC_ALL=ON flag enables all optional features including Auto-Type, browser integration, SSH agent, YubiKey support, KeeShare, and FreeDesktop.org Secret Service integration. However, if you prefer a minimal build, omit this flag and enable only the features you need.

Once configuration completes successfully, compile KeePassXC:

make -j$(nproc)

The -j$(nproc) flag uses all available CPU cores to speed up compilation. On a modern system, this typically takes 5-10 minutes.

Install the Compiled Binary

Finally, after compilation completes, install KeePassXC to /usr/local:

sudo make install

Then verify the installation by checking the version:

keepassxc-cli --version

If the system reports command not found, ensure /usr/local/bin is in your PATH. Alternatively, use the full path /usr/local/bin/keepassxc-cli --version to confirm the installation.

Update Script for Source Installation

To simplify future updates, you can create an update script that pulls the latest changes and recompiles:

cat <<'EOF' | sudo tee /usr/local/bin/update-keepassxc
#!/bin/bash
set -e

BUILD_DIR="$HOME/keepassxc-build/keepassxc"

if [[ ! -d "$BUILD_DIR" ]]; then
    echo "Error: Build directory not found at $BUILD_DIR"
    echo "Please update the BUILD_DIR variable or run the initial installation first."
    exit 1
fi

CURRENT_VERSION=$(keepassxc-cli --version 2>/dev/null | head -1 || echo "not installed")
echo "Current version: $CURRENT_VERSION"

cd "$BUILD_DIR"
git fetch --tags
LATEST_TAG=$(git describe --tags --abbrev=0 origin/latest 2>/dev/null || git tag -l 'v*' --sort=-v:refname | head -1)

if [[ -z "$LATEST_TAG" ]]; then
    echo "Error: Could not determine latest version"
    exit 1
fi

echo "Latest available: $LATEST_TAG"

if [[ "$CURRENT_VERSION" == *"${LATEST_TAG#v}"* ]]; then
    echo "Already up to date."
    exit 0
fi

echo "Updating to $LATEST_TAG..."
git checkout "$LATEST_TAG"

cd build
cmake -DWITH_XC_ALL=ON -DCMAKE_BUILD_TYPE=Release ..
make -j$(nproc)
sudo make install

echo "Update complete!"
keepassxc-cli --version
EOF
sudo chmod +x /usr/local/bin/update-keepassxc

Since the script is installed to /usr/local/bin, you can run it from any directory in your terminal:

update-keepassxc

Example output when already up to date:

Current version: 2.7.11
Latest available: 2.7.11
Already up to date.

When an update is available, the script automatically pulls the new version, recompiles, and installs it.

Launch KeePassXC

After installation via any method, you can launch KeePassXC from either the terminal or your desktop environment’s application menu.

Launch from Terminal

For APT, PPA, or source installations, run:

keepassxc

For Flatpak installations:

flatpak run org.keepassxc.KeePassXC

Note that Snap installations use the same command as APT since Snap adds keepassxc to your PATH automatically.

Launch from Applications Menu

All installation methods create a desktop entry that appears in your application menu. To launch KeePassXC graphically:

1. Click on Activities (or press the Super key).
2. Type KeePassXC in the search field.
3. Click the KeePassXC icon to launch the application.

Manage KeePassXC

Update KeePassXC

How you update KeePassXC depends on which installation method you used.

APT or PPA installations:

sudo apt update && sudo apt upgrade

This command updates all packages on your system, including KeePassXC. Alternatively, to update only KeePassXC without upgrading other packages:

sudo apt install --only-upgrade keepassxc

Flatpak installations:

sudo flatpak update org.keepassxc.KeePassXC

Snap installations:

Snaps update automatically in the background. However, to force an immediate update:

sudo snap refresh keepassxc

Source installations:

For source installations, use the update script created earlier:

update-keepassxc

Remove KeePassXC

Choose the removal commands that match your installation method.

APT or PPA installations:

sudo apt remove keepassxc
sudo apt autoremove

Additionally, the autoremove command cleans up any dependencies that were installed automatically and are no longer needed.

If you installed from the PPA, you should also remove the repository:

sudo add-apt-repository --remove ppa:phoerious/keepassxc -y

Flatpak installations:

sudo flatpak uninstall org.keepassxc.KeePassXC
sudo flatpak uninstall --unused

Note that the second command removes any runtimes that are no longer used by other Flatpak applications.

Snap installations:

sudo snap remove keepassxc

Source installations:

sudo rm -f /usr/local/bin/keepassxc /usr/local/bin/keepassxc-cli /usr/local/bin/keepassxc-proxy
sudo rm -rf /usr/local/share/keepassxc /usr/local/share/applications/org.keepassxc.KeePassXC.desktop
sudo rm -f /usr/local/bin/update-keepassxc
rm -rf ~/keepassxc-build

Remove User Configuration Data

Warning: The following command permanently deletes your KeePassXC configuration and local state. Your password databases (*.kdbx files) are stored separately and are not affected, but any application settings, recent database history, and cached data will be lost. Back up these directories first if you want to preserve your settings.

rm -rf ~/.config/keepassxc ~/.local/share/keepassxc ~/.cache/keepassxc

Troubleshooting

KeePassXC Command Not Found After Installation

If you receive “command not found” after installing from source, the /usr/local/bin directory may not be in your PATH. First, verify the binary exists:

ls -la /usr/local/bin/keepassxc

If the file exists but the command is not found, add /usr/local/bin to your PATH by adding this line to your ~/.bashrc:

export PATH="/usr/local/bin:$PATH"

Then reload the configuration:

source ~/.bashrc

PPA Add Fails on Ubuntu 26.04

If you see an error when adding the PPA on Ubuntu 26.04 LTS, this is expected behavior. The PPA does not yet provide packages for the resolute codename. Instead, use an alternative installation method such as the Ubuntu repository, Flatpak, Snap, or compile from source.

Browser Integration Not Working

Browser integration requires installing the KeePassXC-Browser extension in your web browser and enabling browser integration in KeePassXC settings. Navigate to Tools → Settings → Browser Integration and enable integration for your browser.

For Snap and Flatpak installations, browser integration may require additional configuration due to sandboxing. While the Snap package includes browser integration support, Flatpak users may need to configure portal permissions.

YubiKey Not Detected

If KeePassXC does not detect your YubiKey, ensure the required USB libraries are installed:

sudo apt install libusb-1.0-0 pcscd

Next, start and enable the PC/SC smart card daemon:

sudo systemctl enable pcscd
sudo systemctl start pcscd

Additionally, you may need to add your user to the appropriate group:

sudo usermod -aG plugdev $USER

Finally, log out and back in for group changes to take effect.

Conclusion

You now have KeePassXC installed on Ubuntu, whether through the default repository, official PPA, Flatpak, Snap, or source compilation. Each method provides the same core functionality: a secure offline password manager that gives you complete control over your credentials. With your installation verified, you can now create encrypted password databases, set up browser integration for automatic credential filling, and configure SSH agent integration to manage your SSH keys securely.

Useful Links

For additional information about KeePassXC, refer to these official resources:

• KeePassXC Official Website: Download options, news, and project information.
• KeePassXC Documentation: Comprehensive guides for installation, configuration, and feature usage.
• KeePassXC GitHub Repository: Source code, issue tracker, and development documentation.
• Building KeePassXC Wiki: Official build instructions and dependency documentation.
• KeePassXC on Flathub: Flatpak package information and changelog.
• KeePassXC on Snapcraft: Snap package details and installation instructions.