aes256-offline VS keepassxc

Make a hidden Veracrypt vault on cold computer. Inside the Veracrypt vault save Keepassxc vaults. Store your seeds inside the Keepassxc vaults. For a paper backup, encrypt your seeds using an offline AES256/512 text encryptor/decryptor. Encode the encrypted text using an offline qrcode generator. Print out the qrcode. Test recovery using a dummy wallet. Be sure you can scan and decrypt. Bonus: Laser etch the qrcodes on metal plates. Make a multi-factor recovery vault, in case you forget your passwords. Shimar's secret sharing scheme is a useful tool for making your recovery vault. Never store your seed unencrypted anywhere, ever. Never input your seed on an online computer, ever. Always protect your seeds with something you know (password), something you have (vaults and keyfiles). Do not upload your vault to the cloud. Keep backups in multiple locations. Necessary tools: Cold computer: Any old computer will do. Just physically disable network access. Veracrypt: https://www.veracrypt.fr/code/VeraCrypt/ KeepassXC: https://keepassxc.org/ Cross-platform, open-source text string encryptor. https://github.com/a3diti/aes256-offline/ Cross-platform, open source QR code generators: https://kazuhikoarase.github.io/qrcode-generator/js/demo/ https://github.com/amanuel/JS-HTML5-QRCode-Generator https://github.com/nayuki/QR-Code-generator Shamir's Secret Sharing: https://github.com/paritytech/banana\_split

Cross-platform, open-source text string encryptor. https://github.com/a3diti/aes256-offline/

Necessary tools: Cold computer: Any old computer will do. Just disable network access. Veracrypt: https://www.veracrypt.fr/code/VeraCrypt/ KeepassXC: https://keepassxc.org/ Cross-platform, open-source text string encryptor. https://github.com/a3diti/aes256-offline/ Cross-platform, open source QR code generators: https://kazuhikoarase.github.io/qrcode-generator/js/demo/ https://github.com/amanuel/JS-HTML5-QRCode-Generator https://github.com/nayuki/QR-Code-generator Cross-platform, open-source text string encryptor. https://github.com/a3diti/aes256-offline/ Shamir's Secret Sharing: https://github.com/paritytech/banana\_split

KeepassXC supports exporting, but i don't think it is released in a stable version / to the public yet:

https://github.com/keepassxreboot/keepassxc/pull/8825

If you use KeePass, make sure you use the KeePassXC variant. KeePass is dead.

https://keepassxc.org/

That's why you use the superior one, KeePassXC, as linked in the NIST link: https://github.com/keepassxreboot/keepassxc/discussions/9433

Over there, they got pissed about people constantly bugging them about it and closed the bug with the last comment reading:

for the internet, use a password manager like keepassxc with a strong password.

Another regression is that KeePassX/C AutoType doesn't work with Wayland, so now instead of a simple CTRL+V in KeePassXC, I have to separately copy and paste the user and the pass.

https://github.com/keepassxreboot/keepassxc/issues/2281

That's really a shame, I know keepassxc has (recently) added support for passkeys, but does it also support import/exporting them? I only found this comment[0] in the github issue.

---

0: https://github.com/keepassxreboot/keepassxc/issues/1870#issu...