K2A solves this problem by providing its own keyboard. We found that, for example, auto-fill functions for applications could be abused to steal the stored secrets from the password manager application using 'hidden phishing' attacks.” “Many apps completely ignore the problem of clipboard sniffing, meaning that there is no cleanup of the clipboard after credentials have been copied into it. This allows you to copy and paste usernames and passwords from an opened KeePass database to the app or webpage where they are needed. Most Android password managers (including most KeePass ports) work using Android’s built-in clipboard function. This is not as secure as K2A keyboard solution but does minimize the problem.

For anyone who is wary of Google, I recommend using either KeePass DX or KeePass Droid instead.īoth of these apps are available from F-Droid and mitigate the clipboard problem with a clipboard timeout. We are comfortable with the trade-off between this risk and the advantages listed above. This means that, in theory, Google could slip malicious code into an update at any time. The main downside of K2A is that it is only available via the Google Play Store, and is therefore updated via Google Play Services. Both of these advantages are related to K2A's custom keyboard feature (see below).

It does not rely on Android’s insecure clipboard function to work.

Or, indeed, than most commercials products we have reviewed.

It has much better Android integration than other Keepass ports.

Most of these are open source and can open and manipulate regular KeePass files. There are a number of KeePass ports for Android.

Keepass 2 chrome