# KeePassXC

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FLpLayuXXLeiVAJdC3ROr%2Fbanner_kpxc.png?alt=media&#x26;token=56134034-d036-45c0-ae1e-e4b522c47e51" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
This tutorial requires one device of any in the following categories:

* [x] [YubiKey 5 Series](https://www.yubico.com/store/#yubikey-5-series)
* [x] [YubiKey 5 FIPs Series](https://www.yubico.com/store/#yubikey-5-fips-series)
  {% endhint %}

## <mark style="color:red;">❊ Configure Yubikey Slot</mark>

In order for KeePassXC to properly detect your Yubikey, you must setup one of your two OTP slots to use a <mark style="color:red;">**Challenge Response**</mark>**.**

Open Yubikey Manager, and select <mark style="color:red;">**Applications**</mark> -> <mark style="color:red;">**OTP**</mark>.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FkQXQZUYpGWVwpTaf1yIh%2Fanim_otp_challenge.gif?alt=media&#x26;token=85f619e1-af4c-4629-ae3a-f295ad65a458" alt=""><figcaption></figcaption></figure>

Next, select <mark style="color:red;">**Long Touch (Slot 2)**</mark>**&#x20;->&#x20;**<mark style="color:red;">**Configure**</mark>

In the list of options, select <mark style="color:red;">**Challenge Response**</mark>.

You will then be asked to provide a <mark style="color:red;">**Secret Key**</mark>. You can either come up with your own, or click the **Generate** button if you wish to just use a random one.

At the bottom left is the option to <mark style="color:red;">**Require Touch**</mark>. Enabling this means that every time you save your database or open your database, your Yubikey will require that you touch it before it completes the action. This is optional.

Before you click <mark style="color:red;">**Finish**</mark>, ensure you write down the secret key you've generated. You must save that secret key if you want to set up multiple Yubikeys to open the same database. All Yubikeys must have the same challenge response programmed into Slot 2.

## <mark style="color:red;">❊ Configure KeePassXC</mark>

Once you have **slot 2** on your Yubikey configured as a challenge response, open KeePassXC.

### <mark style="color:blue;">New Database</mark>

If creating a new database, create the database as you normally would and continue to click <mark style="color:blue;">**Next**</mark>.

When you get to the screen titled <mark style="color:blue;">**Database Credentials**</mark>, click the button <mark style="color:blue;">**Add Additional Protection**</mark> ...

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FX20XvPSuHRUlFytttzB6%2Fkpass_1.png?alt=media&#x26;token=61217767-df37-429e-be72-099e2a506e25" alt=""><figcaption></figcaption></figure>

Scroll down until you see the <mark style="color:blue;">**Challenge Response**</mark> -> <mark style="color:blue;">**Add Challenge Response**</mark>:

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FXjvX2WuX8HBCi3SsnJyj%2Fkpass_2.png?alt=media&#x26;token=58fe4503-3433-4a7e-8949-21b4fb6b4a28" alt=""><figcaption></figcaption></figure>

Scroll down to <mark style="color:blue;">**Challenge Response**</mark> and you should see a dropdown box that lists your Yubikey. Make sure your Yubikey is plugged in.

If you do not see your Yubikey, press <mark style="color:blue;">**Refresh**</mark>.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FobaaQobP048cUmoygCsE%2Fkpass_3.png?alt=media&#x26;token=7ac7748e-06fa-424c-bb73-99f47ae4b210" alt=""><figcaption></figcaption></figure>

From this point, you can finish setting up your database.

### <mark style="color:blue;">Existing Database</mark>

If you have an existing database you would like to add your Yubikey to, open your database with KeePassXC.

Once you are in, click <mark style="color:blue;">**Database**</mark> at the top left, and select <mark style="color:blue;">**Database Settings**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F0Eauf8nDHq5Z2cruLX0k%2Fkpass_4.png?alt=media&#x26;token=5296dcf7-792e-4f64-8064-ec932bed0c49" alt=""><figcaption></figcaption></figure>

Once the dialog box opens, on the left side select <mark style="color:blue;">**Security**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FsNJcuA054dn8VqiXkwsT%2Fkpass_5.png?alt=media&#x26;token=01fa1ebf-de09-490a-9604-0f5a55a90c62" alt=""><figcaption></figcaption></figure>

In the middle of the screen, click the button <mark style="color:blue;">**Add Challenge-Response**</mark>**.**

It should then load your Yubikey:

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2Fos7Dtptg6PXPu4seqIui%2Fkpass_6.png?alt=media&#x26;token=f87964d3-b151-4a05-8a21-85efec37d5b3" alt=""><figcaption></figcaption></figure>

If your Yubikey does not appear in the list, ensure it's plugged all the way in, and press the <mark style="color:blue;">**Refresh**</mark> button.

Once you see your Yubikey in the list, make sure it's selected.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FBTbMMA5mESoGhW4k6F20%2Fkpass_7png.png?alt=media&#x26;token=55e0679e-29a8-4bcc-ad97-263469e87eb8" alt=""><figcaption></figcaption></figure>

After it is selected, you can press ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2Fo0vxkD9tFMt2WZEzryb2%2Fkpass_ok.png?alt=media\&token=87b83a3f-130b-47d9-9e81-b3dea52c0d9a)

## <mark style="color:red;">❊ Yubikey Touch</mark>

If you selected <mark style="color:red;">**Require Touch**</mark> when you first assigned a Challenge Response to slot 2 in the Yubikey Manager, you will be prompted with a notification each time you make a change to your KeePassXC database:

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FGsk0nixlEPU0lmJKmsB2%2Fkpass_10.png?alt=media&#x26;token=88c4dd72-551b-4eb8-888c-ac6695d5dabc" alt=""><figcaption></figcaption></figure>

If you fail to touch your Yubikey within a certain number of seconds, your action will time out and changes will not be saved.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FUihjK6uvvFdZIK9vGRN9%2Fkpass_11.png?alt=media&#x26;token=bd75f8ef-3f71-495d-b904-48e3b9baa8d6" alt=""><figcaption></figcaption></figure>
