>

Manage Passwords in the Terminal with keepassxc-cli

Create an encrypted password vault, add entries, generate strong passwords, and look up secrets — all from the command line with the KeePassXC format.

LinuxkeepassxcpasswordclisecurityLow risk
Run keepassxc-cli generate -L 20 vault.kdbx, add entries with keepassxc-cli add vault.kdbx "Site", and read one back with keepassxc-cli show -a password vault.kdbx "Site".

01Command

Command
$ keepassxc-cli generate -L 20 words.kdbx && keepassxc-cli add words.kdbx "Gitee" && keepassxc-cli show -a password words.kdbx "Gitee"

02What it does

keepassxc-cli is the headless companion to the KeePassXC password manager: it reads and writes the same encrypted .kdbx database (AES-256) that the desktop app and phone clients open. generate creates a random strong password, add stores an entry, and show -a password prints just the secret — handy inside scripts or when SSHing into a box with no GUI. The database only opens with your master passphrase, so everything stays local and nothing syncs to a cloud you don't control.

03Risk

RiskLow risk
Requirementskeepassxc (sudo apt install keepassxc / sudo dnf install keepassxc)
!Warning: There is no password recovery: if you forget the master passphrase the vault is permanently unreadable — and avoid passing secrets as command arguments in shared-shell history; prefer interactive prompts where offered.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • keepassxc-cli(1) — Linux manual page
    Arch Linux · community · 2026-09-17
    Evidence: Documents keepassxc-cli subcommands: create/init a database, generate for random passwords, add entries, show with -a to print a specific attribute.
  • KeePassXC — README
    KeePassXC Team (GitHub) · vendor-doc · 2026-09-17
    Evidence: Official KeePassXC readme: local encrypted .kdbx databases (AES-256), cross-platform, with keepassxc-cli as the command-line interface.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17