KeePassNC - Releases

Added

• Icons for entries and groups: pick one of KeePass's 69 standard icons (redrawn in the app's own line style) or add your own picture. PNG, JPEG, GIF, WebP, BMP, ICO and SVG all work; they get shrunk (or, for SVG, drawn) to 128 px and saved as PNG, so KeePass, KeePassXC and the mobile apps show them too. The same picture twice is recognized, unused ones can be removed, and a group can hand its icon down to its subgroups and entries, just like in KeePassXC. Nothing is fetched from the web, not even favicons.
• Entries with a standard icon now show it in the list instead of the first letter. Entries with the default key icon keep their colorful letter.

Changed

• More URLs are clickable: a URL field holding just example.com opens https://example.com, and extra fields with a web address are links too (bare hostnames only in fields with "URL" in the name, say KP2A_URL_1). Ctrl+Shift+U follows the same rules. Things like cmd:// or {REF:…} stay plain text, and protected fields stay hidden.
• Unlocking no longer freezes the page: Argon2 does its heavy lifting in a background worker, so the page keeps reacting while your database unlocks. The worker is shut down right after, taking its (possibly gigabyte-sized) scratch memory with it. If the worker can't start, the page does the math itself like before.
• Database settings, part one: in Reports → Database, "Edit settings" lets you change the name, description and default username (pre-filled for new entries), switch the recycle bin on or off and set history limits per entry. Tighter history limits trim existing entries right away, after asking how many versions go. With the recycle bin off, deleting says "Delete permanently" and asks first, instead of promising a recycle bin that isn't there.
• Database settings, part two: the same dialog now has a Security section for encryption (AES-256 or ChaCha20), key derivation (Argon2id, Argon2d) with memory, iterations and parallelism, and the step from KDBX 3.1 up to KDBX 4. Only browser-friendly values are on offer, up to 1 GiB, and a traffic light tells you what phones will make of them. "≈ 1 s on this device" suggests iterations but never less work than you already have. Before anything is applied, the new values get a test run on this device, and you are asked first if they would make guessing your master password cheaper, need lots of memory, or make unlocking slow.

Fixed

• The database info showed 0 iterations for KDBX 3.1 files with AES-KDF. It now shows the real number of rounds.
• Saving after someone else changed the file no longer undoes their encryption settings. If KeePassXC (or another device) beefed up the key derivation or switched the cipher in the meantime, KeePassNC used to merge the entries but quietly write its own older settings back. Now the side that actually changed them wins.
• A database without any tags no longer greets you with a lonely "null" in the sidebar above the recycle bin.

Added

• KeePassNC now dresses like your Nextcloud. It takes the instance color (or your own, if you picked one), follows your light, dark or high-contrast choice from the accessibility settings, and keeps the familiar header with the 9-dot app menu and your account menu. Garish colors get toned down until text on them is readable again, and the plain Nextcloud blue leaves our night blue and gold alone. New setting "Same as Nextcloud" is the default for the color scheme; "Use the Nextcloud accent color" can be switched off. The header has no search, notifications or contacts menu, on purpose: those need Nextcloud's JavaScript, and that stays off this page.
• A "Pronounceable" mode in the password generator: syllables like Gosher9faggud3pizguz&dadkor that you can read out over the phone or type on a TV remote without losing your mind. Letters that get mixed up when spelled out (c/k, v/f/w, j/y, q, x) stay out, and so do braces, slashes and | between the groups. Out of the box it starts with a capital and mixes in a digit and a symbol, so the usual "one of each" password rules are happy. Every syllable is drawn uniformly, so the bit count is exact, not wishful.

Changed

• The App Store description is sorted into short sections with bullet points instead of one long paragraph, in English and German.
• The App Store listing links to the docs, and the app declares itself compatible up to Nextcloud 37 (newest tested version plus two) instead of "forever".
• The search field just says "Search" now, without the cheat sheet of filter examples. The filters (url:, is:weak, -tag: …) still work, the README has the full list.

Fixed

• The generator's strength meter now shows the exact entropy of what it generated. It used to guess from the characters and rated a six-word passphrase at well over 150 bits instead of the honest 77. The editor keeps the exact value as long as you don't touch the generated password.
• KDBX 4.1 files with custom icons or plugin data: their "last modified" stamps are now saved in the binary format the spec asks for, not as plain text that KeePass 2 chokes on with "Invalid Base-64 string". KeePassXC never minded, so you may not have noticed.

Fixed

• Custom fields with several lines (KeePass 2 and KeePassXC allow that) now show their line breaks instead of one long sausage, and editing such a field no longer flattens it into a single line on save. Protected fields stay hidden in the editor until you click the eye.

Changed

• New colors. Night blue and gold instead of the indigo-purple gradients: warm linen greys and night-blue buttons in light mode, a night-blue dark mode with gold buttons, a sage logo tile. Contrast checked for text and buttons in both.