Recover a protected KeePass database password

Needs: Complete database, compatible converter, and every required factor; a feasible password candidate strategy

Shell commands

# Baseline
keepass2john vault.kdbx > keepass.hash
john --wordlist=wordlist.txt keepass.hash
john --show keepass.hash

# Hashcat alternative after confirming KDBX/KDF and input format
hashcat -hh | grep -i keepass
hashcat -a 0 -m 13400 keepass.hash wordlist.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 13400 keepass.hash --show

Mode 13400 covers common KeePass 1/2 AES formats. Installed help and example hashes decide for the actual file. A recovered master password still requires opening and validating the vault.

Verify → Open the database with all factors and distinguish vault credentials from target account credentials.

If it fails → Missing factors, unsupported versions or malformed conversion require fixing the input, not endless password guessing. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state
JavaScript endpoints, backup names, exposed configuration or Git metadata → Inspect source, backups, configuration and repository artifacts
Needs: Readable application artifact or a complete recoverable repository; preserve the public-source scope

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Recover a protected KeePass database password

USE WHEN: A readable KeePass database and possible associated key file
STARTING ACCESS: A credential artifact with a recorded source and possible account context
RESULT: An opened vault or a valid recovered database password

Recognize the clue

Look for a vault in readable backups/shares/application data, then inspect file identity and nearby factor/configuration references.

file FILE
keepass2john FILE > keepass.hash

SYNTHETIC EXAMPLE OUTPUT

FILE: Keepass password database
Converter: supported verifier produced
Possible additional key file: KEY_FILE

Means: A supported database gives a recovery target, but a referenced key file indicates a separate factor.

Confirm: Confirm vault version, required key/account factors and a feasible password search.

After validation: All required factors are available and the recovered password opens the vault: inspect its typed credentials.
Ruled out in this context: An unavailable mandatory key factor prevents this password-only route.
Still inconclusive: A converter result alone does not identify every required factor; inspect relevant vault configuration.

Troubleshooting: Missing factors, unsupported versions or malformed conversion require fixing the input, not endless password guessing.

Hashcat alternative after confirming KDBX/KDF and input format:

Mode 13400 covers common KeePass 1/2 AES formats. Installed help and example hashes decide for the actual file. A recovered master password still requires opening and validating the vault.

Why it works

Cracking targets the database's password-derived protection. A key file or other required factor is independent; the password alone may not unlock the vault.

Worked example · hypothetical

Observation: a backup contains a vault. Test: inspect required factors and convert its verifier. Illustrative output: the candidate is recovered but the vault still requests a key file. Interpretation: search the relevant backup context for that factor.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗