KeePassOTP: two factor codes inside the password manager

A plugin that puts one time passwords next to passwords

KeePassOTP is a plugin for KeePass that adds one time password support, and its purpose is to keep the secret that generates a one time password in the same encrypted database as the password it protects. The plugin is written in C#, published under the GPL-3.0 licence, and the repository is not archived, with the last push on 2026-09-18.

The release history shows a steady maintenance cadence with names that say what changed. Version 1.12 came on 2026-02-10 and version 1.11 on 2025-11-29, and version 1.10.2 is described as a fix for race conditions when displaying OTP values in the main view. That last one is the kind of release note worth reading carefully in a plugin whose whole job is to display a value that changes every thirty seconds, because a race there means the number you type is occasionally not the number on screen.

The design decision that makes the plugin convenient is that the working mode is a database-specific setting, chosen in the database-specific area of KeePass' options form, while the general area holds settings that apply to all databases. That split exists because a plugin that behaves differently per database is a plugin that has to be trusted differently: the way it stores and displays secrets is a property of the database, and the rest is a property of your installation.

Everything is reachable from the entry context menu, and the plugin also adds an optional column to the entry list, which is what makes the OTP visible without opening anything.

TOTP and HOTP, plus the two proprietary formats

The algorithm coverage is broader than the two standard ones, and the extra coverage is where the caveats are.

The plugin supports standard TOTP and standard HOTP, which covers essentially every service that offers an authenticator app, and it is compatible with Google Authenticator and andOTP, among others, because the interoperability is at the level of the secret and the algorithm rather than at the level of a specific app.

It also supports the proprietary Steam format and the Yandex format, and the README is honest about the limit of the second one. Yandex changed their closed source algorithm starting with version 3, and because there is no public information about it, it is no longer possible to generate Yandex codes after installing or migrating to Yandex.Key version 3 or higher. So the Yandex support is real, and it is bounded by a vendor's decision to change an undocumented algorithm, which is exactly the kind of dependency that a password manager should not have but sometimes does.

For the Steam case there is no such caveat, because the format is implemented in the plugin and does not depend on a server-side change.

The rest of the feature list is about the workflow rather than the cryptography: drag and drop of QR codes to add an OTP, an auto-type placeholder, a configurable hotkey to invoke the auto-type, a column to display the OTP or to indicate possible two factor usage, secure storage of the OTP secrets, auto-type or copy from the KeePass tray icon, and the ability to indicate entries where two factor authentication could be set up, which is the feature that needs the internet and is worth a separate look.

Getting a secret in, by drag and drop or by URI

The setup flow is entry specific, and the entry context menu is where you reach it. There are three ways to get a secret into the plugin.

The first is drag and drop: you drag the QR code image onto the QR picture in the setup form and the plugin parses it. The second is the screen capture button, which makes the plugin search the screen for an OTP QR code, which is the fastest path when the code is on a setup page in another window. The third is manual entry of the secret, sometimes called a seed.

There is a fourth, and it is the one that saves time for anyone who has done this before. A string in the otpauth format can be pasted in its entirety and the plugin will process it:

otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=Example

That format is the key URI format, the same one the authenticator apps use, so a string copied from anywhere can be pasted straight in.

The setup form also shows the current and the next one time password, and the README explains why: almost all sites require you to enter an OTP as part of the activation process, so the form has to be able to show you the code that is valid now and the one that will be valid in a moment, and you need both to type the second one when the first expires mid-setup.

The secrets are stored in the database, so they are covered by whatever protection the database itself has, which is the entire point of putting them there.

Copying and auto-typing, and the placeholder that makes it flow

Using a one time password is where the plugin earns its keep, and there are several ways to do it.

To copy the code, you can use the context menu of the entry, double-click the OTP shown in the optional KPOTP column, or use the KeePass tray icon. The double-click on the column is the fastest for a quick login, and the column exists precisely to make that possible.

Auto-Type has more paths, and one of them is the important one. You can auto-type from the context menu, which needs the Show additional auto-type menu commands option to be active. You can use a configurable placeholder, with the default placeholder being {KPOTP}, which means a KeePass entry can contain the sequence for the other field and the plugin substitutes the current code into it. And you can use a configurable hotkey that works both inside and outside KeePass, which is the path for when the target is a browser window that is not one of your entries.

The hotkey that works outside KeePass is worth pausing on, because it is the feature that removes the last friction. A code that has to be typed from a popup into a browser is a code that gets mistyped; a code that the plugin types into the focused window is not. The tray icon offers the same path for people who prefer a menu to a hotkey.

Auto-typing a one time password means the value never touches the clipboard and never lands in a window that might log keystrokes, which is a small but real difference from the copy and paste workflow.

The two factor directory, and the network request nobody expects

The feature that deserves a section of its own is the indication of possible two factor usage, because it is the one part of the plugin that talks to a third party.

During KeePass start, KeePassOTP downloads a list of sites supporting two factor authentication from the two factor authentication directory API, at the address api.2fa.directory with a version 3 path and a tfa.json file. That list is then compared with all the URLs defined in the database, and entries that match get a hint in the OTP column. Double-clicking that hint opens the corresponding website so you can set up two factor authentication for that account.

The privacy question is answered in the README, and the answer is a good one: neither your URLs nor any other information from your database is sent. The comparison happens locally, against a list that is downloaded and cached. So the plugin fetches a file from a third party at every start, and it does not tell that third party anything about you.

That is a meaningfully better design than a lookup service that receives your list of accounts, and it is worth understanding the difference before deciding whether to enable it. The feature is toggleable in the plugin's options, and the reason to turn it off is narrow: an air-gapped or privacy-constrained machine that should not make outbound requests on startup, or a user who does not want the entry list to carry a visible two factor hint.

The cost of the feature is a startup request to a service the project does not control. If that service is unavailable, the hint simply does not appear, and nothing about your database is at risk.

Packaging, translations and the build you do not have to do

The plugin is distributed as a packaged plugin file, and installing it is a download rather than a build.

The releases page hosts KeePassOTP.plgx, the packaged plugin, and the badge in the README links to the newest release of it directly. For updates, the project points at EarlyUpdateCheck, a separate plugin by the same author that can update the plugin and its translations automatically, with a wiki page on one click plugin updates. The download history is on the releases page, and the translations are also downloadable from a Translations folder in the repository.

The translation system is simple and worth knowing about if you want to contribute one. The plugin ships with English built in and accepts translation files placed in a folder called Translations inside the plugin folder. The naming convention is a plugin name, a language identifier and a language extension in that order, with the example KeePassOTP.de.language.xml, and the language identifier in the file name has to match the identifier of the KeePass language you select under View and then Change language. When a text is missing from a translation file it is backfilled with the English text, which means an incomplete translation degrades gracefully instead of showing empty labels.

The requirements are short: KeePass version 2.42 and the .NET framework version 4.0.

The source tree is a Visual Studio solution, KeePassOTP.sln, with the code under src/, a proto/ directory, a plgxcreate.cmd script and a plgxexclude.txt that control what goes into the packaged plugin, a version.info file, and a translationcopy.cmd helper. The create and exclude files are the interesting part for anyone building from source, because they are what keeps the packaging honest, and the fact that the plugin is published as a prebuilt package is the reason most users never have to think about them.

Editorial conclusion

KeePassOTP fits a KeePass user who wants their one time password seeds next to the passwords they already store, because the plugin supports the standard algorithms, the setup by drag and drop and the auto-type paths, and it works entirely from the local database. It is the wrong tool if you need the Yandex codes that Yandex.Key version 3 introduced, since the closed algorithm change makes them impossible to generate, and the wrong tool if you want a plugin that never touches the network, because the two factor directory feature downloads a list at every start unless you turn it off. Before you install, download the packaged plugin file from the releases page rather than building it, check the release notes for the display race condition fixed in 1.10.2, and decide whether you want the directory feature enabled given that it contacts a third party service every time KeePass starts.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. Releases
5. Rookiestyle/KeePassOTP on GitHub