Weakening security of master password: Medium.

Plugins could change default parameters, but not likely to do so accidentally, and nothing a user couldn't configure in KeePass anyway.

Weakening security of kdbx database file: Negligible.Unless the plugin is specifically designed to serve data to the internet, it's not going to happen.

Exposing data to the internet: Very, very low.Mitigation is the same as for any other software does the publisher look trustworthy, are enough other people using it without complaint, is it open source? While anything you download and run from the internet could be malicious and extract data from an unlocked KeePass database, it's a little easier to write a KeePass plugin to do so. Deliberate malicious exfiltration of data: Slightly higher than that of running any other software on your system.Call it paranoia or reaction to the LastPass leaks last year (of course, unrelated to anything involving KeePass), but I've deleted those plugins.Īs a plugin author, I would estimate the risks are: I had been using two plugins, namely YetAnotherFaviconDownloader and HIBPOfflineCheck. Is there any protection in the main KeePass program to control what plugins can do, or are they more or less free to do anything? I assume the latter, since the two plugins I've used in the past can transmit info over the internet. I'd like to understand mainly the technically feasibility of doing that. Two concerns of mine are accidental issues (bugs that accidentally cause leaks) and intentional security issues (plugins that could steal info). What are people's thoughts about KeePass plugins? Is the concept generally trustworthy, or does it really depend on the individual writers of the plugins? There is a whole lot of focus and attention on KeePass's safety itself (the source code and just the project in general), however it seems very little attention is paid to the plugins. Just wanted to have a bit of a discussion, mostly on a couple points. I'm sure this has been asked many times before, and is officially discussed as a factor for KeePassXC ( ).

Keepass 2 android