keepassxc-cli

keepassxc-cli is the command line interface for the KeePassXC password manager. It provides the ability to query and modify the entries of a KeePass database, directly from the command line.

Documentation

• man 1 'keepassxc-cli' [EN]

Syntax

keepassxc-cli SUBCOMMAND [PARAMETER ...]

Subcommands & Parameters

Global parameters

The following parameters can be used with the subcommands below:

-q <PATH>, --quiet <PATH>

Silences password prompt and other secondary outputs.

-v, --version

Displays the program version.

clip [PARAMETER ...] <DATABASE> <ENTRY> [TIMEOUT]

Copies the password or the current TOTP (if the -t option specified) of a DATABASE ENTRY to the clipboard. If no attribute name is specified using the -a option, the password is copied. If multiple entries with the same name exist in different groups, only the password for the first one is going to be copied. For copying the password of an entry in a specific group, the group path to the entry should be specified as well, instead of just the name. Optionally, a TIMEOUT in seconds can be specified to automatically clear the clipboard.

-a <ATRIBUTE>, --attribute <ATRIBUTE>

Copies the specified ATRIBUTE to the clipboard. If no attribute is specified, the password attribute is the default. For example, -a username would copy the username to the clipboard. Default: password

-t, --totp

Copies the current TOTP instead of current password to clipboard. Will report an error if no TOTP is configured for the entry.

diceware [PARAMETER ...]

Generates a random diceware passphrase.

-w <PATH>, --word-list <PATH>

Sets the PATH of the wordlist for the diceware generator. The wordlist must have > 1000 words, otherwise the program will fail. If the wordlist has < 4000 words a warning will be printed to stderr.

-W <NUMBER>, --words <NUMBER>

Sets the desired NUMBER of words for the generated passphrase. Default: 7

generate [PARAMETER ...]

Generates a random password.

-e, --extended

Uses extended ASCII characters for the generated password.

--every-group

Include characters from every selected group.

--exclude-similar

Exclude similar looking characters.

-l, --lower

Uses lowercase characters for the generated password.

-L <LENGTH>, --length <LENGTH>

Sets the desired LENGTH for the generated password. Default: 16

-n, --numeric

Uses numbers characters for the generated password.

-s, --special

Uses special characters for the generated password.

-U, --upper

Uses uppercase characters for the generated password.

-x <CHARS>, --exclude <CHARS>

Comma-separated list of CHARS to exclude from the generated password.

show [PARAMETER ...] <DATABASE> <ENTRY>

Shows the title, username, password, URL and notes of a DATABASE ENTRY. Can also show the current TOTP. Regarding the occurrence of multiple entries with the same name in different groups, everything stated in the clip command section also applies here.

-a <ATTRIBUTES>, --attributes <ATTRIBUTES>

Shows the named ATTRIBUTES. This option can be specified more than once, with each attribute shown one-per-line in the given order. If no attributes are specified and -t is not specified, a summary of the default attributes is given. Protected attributes will be displayed in clear text if specified explicitly by this option.

-s, --show-protected

Shows the protected attributes in clear text.

-t, --totp

Also shows the current TOTP, reporting an error if no TOTP is configured for the entry.

Examples

Generate a 15 characters long password

keepassxc-cli generate --every-group --exclude-similar --length=25 \
                       --upper --lower --numeric --special

Output:

bKV<A-v}'.mh)nJ9S%-z=V"3d

Generate a 6 words long diceware using a German wordlist

wordlist="${HOME}/tmp/dictware_de.wordlist"

curl --silent 'http://world.std.com/~reinhold/diceware_german.txt' \
| cut -f 2 -d ' ' >"${wordlist}"

keepassxc-cli diceware --word-list="${wordlist}" --words=6

rm "${wordlist}"

Output:

senden sonst riesig laut enges leiter

Attach a disk image using a password from keepassxc-cli

keepassxc-cli show --attributes 'password' --show-protected \
                   "${HOME}/passwd.kdbx" 'Container/Image' \
| tr -d '\n' \
| hdiutil attach -stdinpass "${HOME}/image.dmg.sparseimage"