iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can keep SSH private-key material in a local encrypted KeePassXC database and use it with an existing compatible SSH agent. The database protects the key while it is locked; the agent makes a loaded key available for authentication while you work. These are separate security layers, and neither automatically hides hostnames or protects an already-compromised computer.
What a local SSH vault does—and what it does not
A KeePassXC database can store an SSH private key as an entry attachment, or protect the decryption key for a private-key file kept elsewhere. When configured, KeePassXC can add the selected key to a compatible SSH agent after the database is unlocked and remove it when the database is locked. KeePassXC integrates with an agent; it does not provide a separate SSH agent. See the KeePassXC documentation and FAQ for supported setups and limitations.
This creates two distinct states. At rest, the database is encrypted while locked. At runtime, the agent holds access to loaded keys so SSH clients can authenticate without repeatedly decrypting the on-disk key. The agent is therefore a sensitive part of the workflow, not just a convenience feature. OpenSSH describes the agent’s role and security boundary in its agent restriction documentation and features documentation; the protocol is also described in RFC 9987.
What belongs in the vault, and what stays in SSH configuration?
For a simple local setup, put the private-key material—or the credential needed to decrypt a key file—in the encrypted database. Keep connection aliases and options in your SSH client configuration if that is useful for your workflow. A hostname or alias in an ordinary SSH configuration file is not protected merely because the corresponding key is in KeePassXC. The KeePassXC sources do not establish a method here for encrypting ~/.ssh/config, so treat host details according to where that file is stored and backed up.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
SSH authentication does not reveal the private key to the remote host. However, a process permitted to communicate with the local agent can ask it to perform signing operations. The agent’s runtime access, rather than exposure of the key file itself, is the relevant risk to manage.
Set up the local vault and agent workflow
- Create a local database. Install KeePassXC for your operating system and create a database stored on your computer. Choose a strong master credential and keep a recovery copy somewhere separate and appropriately protected. KeePassXC’s Getting Started Guide explains database creation and warns that losing the database password can permanently prevent access.
- Choose how the key is protected. Add the private key to a database entry as an attachment, or use the database to protect the decryption key for a private-key file stored elsewhere. KeePassXC’s SSH integration supports OpenSSH-format keys, including encrypted keys; its documentation says PuTTY
.ppkand RFC4716 files are not supported by that integration. - Check the agent and platform requirements. KeePassXC documents integration on Linux, macOS, and Windows, but setup depends on the platform and an existing compatible agent. Follow the current KeePassXC documentation for your installed release and environment rather than assuming every agent behaves alike. Some implementations have limits involving key removal, confirmation constraints, or supported key types.
- Configure the SSH Agent integration. In KeePassXC, enable its SSH Agent feature and configure the entry containing the key to be used with the agent. Exact interface wording and setup details may differ by release and operating system; use the current official documentation for the applicable setup.
- Test with a non-critical connection. Unlock the database, confirm the intended key is available to the agent, and try an SSH connection. Then lock the database and verify that the key is no longer available if your agent supports removal. Do not assume every agent can remove identities in the same way.
Understand the security boundary while the vault is unlocked
Encryption at rest applies while the KeePassXC database is locked. KeePassXC states that information is decrypted in computer memory when accessed. Consequently, this arrangement is not a defense against malware or a compromised logged-in session, and it should not be described as preventing every form of memory or endpoint capture.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Lock the database when finished, load only the keys needed for the task, and remove stale identities from the agent where supported. Avoid agent forwarding unless a remote workflow genuinely requires it. Forwarding does not copy the private key to the server, but it can make agent operations available through a remote connection; OpenSSH’s agent restriction guidance explains why that access deserves care. Use confirmation or host-bound restrictions when your environment supports them and they fit the task.
Backups and optional database protection
Keep a recoverable backup of the database and verify that it can be restored. Preserve the master credential separately: KeePassXC warns that a forgotten database password may mean permanent loss of access, and its getting-started guidance recommends protecting the database from loss or accidental deletion.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
KeePassXC also documents an optional YubiKey challenge-response setup to enhance the database encryption key. Treat this as an additional database-protection choice, not a universal requirement. Compatibility depends on the operating system, KeePassXC version, and supported security key; check the current documentation before choosing a device.
Quick Recap
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Operational checklist
- Confirm the database backup restores successfully.
- Keep a protected recovery copy of the master credential.
- Load only the SSH keys required for the current work.
- Lock the database when finished and check whether the agent removes its identities.
- Remove stale agent identities when they are no longer needed.
- Do not enable agent forwarding unless the remote workflow requires it.
- Store and back up host configuration according to its own privacy needs; the vault does not automatically conceal it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
