Convert KDB to KDBX

A legacy KeePass 1.x vault may need conversion when a newer KeePass installation, mobile client, or compatible password manager accepts KDBX but not KDB. The safest method keeps the vault offline and uses KeePass to import the old database into a new encrypted KDBX file.

What the KDB format is

.kdb is the native database format of KeePass 1.x. It can contain encrypted groups and entries with usernames, passwords, URLs, notes, custom fields, and binary attachments.

KDB files commonly remain after an old KeePass 1.x installation, a legacy backup, or a migration from an older Windows computer. The extension is not definitive: unrelated database products also use .kdb, so this procedure applies only to KeePass 1.x databases.

What the KDBX format is

.kdbx is the native format of KeePass 2.x and is supported by many KeePass-compatible desktop and mobile applications. It supports the KeePass 2 data model, including tags, entry history, custom fields, improved attachment handling, and configurable key-derivation and encryption settings.

KeePass 2 normally saves databases as KDBX 4. KDBX 3.1 can be the better choice for older clients; select it only when a target application does not support KDBX 4. Both formats remain encrypted containers, and conversion does not remove the master password or decrypt the stored data for normal use.

How to convert KDB to KDBX

1. Copy the original .kdb file and use the copy for conversion. Keep the original unchanged as a backup.
2. Install the official KeePass 2 desktop application from the KeePass website or a trusted operating-system package source.
3. Open KeePass 2 and select File → Import.
4. Choose the KeePass 1.x import format, commonly shown as KeePass 1.x (*.kdb), and select the copied file.
5. Enter the KDB master password. Supply the original key file too if that database uses one.
6. Check the imported groups and entries, especially attachments, custom fields, notes, URLs, and entry history.
7. Select File → Save As, choose the available KDBX format, and save to a new filename ending in .kdbx. Use KDBX 3.1 only for compatibility with an older client; otherwise use KDBX 4.
8. Close and reopen the new file. Test representative logins, URLs, attachments, custom fields, and search results before retiring the KDB copy.

Some KeePass 2 releases also allow a KDB file to be opened directly through File → Open; if so, opening it and then using File → Save As produces the same result. The import route is the portable procedure when direct opening is unavailable.

KeePassXC may be used as an alternative desktop application when its current import dialog lists KeePass 1.x or KDB support, but its supported formats and import behavior depend on the installed release. Test the resulting database before deleting the source.

Compatibility and data checks

Most ordinary KeePass 1.x entries transfer, but plugins, plugin settings, external references, obsolete custom fields, and application-specific metadata are not guaranteed to migrate. Attachments and unusual fields deserve manual inspection, and plugin functionality must be reconfigured in the destination application.

Compare entry and group counts, open entries containing attachments, and verify important history records. A KDBX file may use different encryption or key-derivation settings from the source, so configure those settings in KeePass 2 according to the compatibility and security requirements of the target clients.

Do not upload a password database to an online converter. The file contains the complete credential vault, and a website would receive the encrypted database and potentially its key material or password during processing. No online service is appropriate when the conversion can be performed locally with KeePass.

Keep the original KDB and a separate backup of the new KDBX until the file has opened successfully on every intended device. Store the KDBX master password and any key file separately from routine file backups.