zomboryzoltan

Hi,

It would be nice to have it, because it can work on MacOS as well, lot of ppl use keepass and this is a big blocker.

The message based API is here:

https://github.com/keepassxreboot/keepassxc-browser/blob/develop/keepassxc-protocol.md

Protocol V2 draft · keepassxreboot/keepassxc-browser Wiki · GitHub

GitHub - keepassxreboot/keepassxc-browser: KeePassXC Browser Extension

https://github.com/keepassxreboot/keepassxc-browser/wiki/Troubleshooting-guide

You can connect to keepassxc via keepassxc-proxy or socket IO.

How it can work

"KeePassXC-Browser communicates with KeePassXC through keepassxc-proxy. The proxy handles listening to STDIN/STDOUT and transfers these messages through Unix domain sockets / named pipes to KeePassXC. This means KeePassXC can be used and started normally without inteference from Native Messaging API. KeePassXC-Browser starts only the proxy application and there's no risk of shutting down KeePassXC or losing any unsaved changes. You don't need to install keepassxc-proxy separately. "

Tips

Prototype the handshake; verify you can echo "action":"get-database-statuses" and parse the reply.

Tehen build higher-level helpers (search, TOTP retrieval, auto-lock listeners).

The database must already be unlocked. Your app can set "triggerUnlock": true, but KeePassXC will still pop up its master-key dialog.

Users can revoke a client at any time in Tools ▸ Settings ▸ Browser Integration ▸ Connected Browsers. Your app must handle errorCode: 201 (client ID not found).

Minimum viable implementation (illustrative)

1. Generate a key pair (Curve25519).

2. change-public-keys (unencrypted) → receive KeePassXC’s pub-key.

3. associate (encrypted) → KeePassXC displays a pairing prompt; on approval you get id + hash.

4. Store that id/keys so you don’t have to pair again.

5. get-database-entries or get-credentials with the [Current Connection Key] array to pull data. NB: get-database-entries returns titles/URLs/UUIDs only unless the user has ticked “Allow accessing password data” in Settings GitHub.

6. Optionally subscribe to the database-locked / database-unlocked signals so your UI greys out when the vault locks.

A tiny proof-of-concept in any language is ~100 lines once you have libsodium/TweetNaCl bindings for the crypto routines.

The protocol is stable, documented, and already used by third-party tools,

Usage: For example you have a compromised password and would like to find all entries with that password even when the CAPS is different or there is a password containing it.

On the DVLS web interface I didn't found a way to search for a password

under

"Administration" -> "Reports" you can select the

"Password Usage" report.

This solution was suggested by the Devolutions support team and it's not very user friendy. (Very hard to find, it would be much better around the search window like keepass, there is only one search window)

Please allow to search for a password in the stored accounts on DVLS web page and allow to search for a partial password in RDM.

In RDM you can search for an account with a specific password, but not for a partial password.

For example if the password is "Password1" RDM will not match:

• "password1"

• "assword"