Skip to content
elba.works

Guides/Compared with…

Elba vs KeePass attachments — password manager or sealed folder

KeePass can store file attachments inside its encrypted database, and people reach for that when they need somewhere safe for a passport scan. It works, up to a point. The point is roughly where the files stop being small.

At a glance

Elba compared with KeePass attachments
 ElbaKeePass attachments
Built forFiles and foldersPasswords, with attachments as an extra
Practical file sizeLarge files fineSmall — the whole DB rewrites on save
Browse files normallyYesNo — one entry at a time
Install requiredNoYes (or a portable build)
CipherAES-256-GCMAES-256 / ChaCha20
Key derivationPBKDF2, 600,000 iterationsArgon2 (recommended) or AES-KDF
Sync friendlinessPer-fileSingle database file — conflict-prone
PriceOne-time, falling yearlyFree

Why people try it

You already trust KeePass with your passwords. It is encrypted, you open it daily, and it has an attachment field. Putting the passport scan in there feels like the tidy answer, and for one or two small documents it genuinely is.

Where it stops working

KeePass rewrites the whole database on save. Attach forty megabytes of scans and every password change rewrites forty megabytes. Sync that database across devices and conflicts become likely, with the ugly failure mode that a conflict can cost you passwords, not just files.

There is also the retrieval experience: you cannot browse attachments. You open the entry, export the file to disk, view it, then remember to delete the exported copy. That is the same leftover-plaintext problem archives have.

The concentration argument

The stronger reason to separate them is blast radius. Your password database is the single most valuable file you own. Adding documents increases how often you open it, how often you sync it, and how many copies exist. Keeping the vault small and boring is a security posture in itself.

When KeePass attachments are the better choice

A handful of small files that logically belong to a credential — a recovery-code text file next to the account it belongs to, a licence key, a 2FA backup. Keeping those with the entry is genuinely more useful than filing them elsewhere. Do that, and keep the big documents somewhere else.

Argon2 versus PBKDF2, briefly

KeePass can use Argon2, which resists GPU and ASIC attacks better than PBKDF2 for the same wall-clock cost. That is a genuine point in KeePass's favour and we are not going to argue otherwise. Elba uses PBKDF2 at 600,000 iterations because WebCrypto exposes it natively in every browser without shipping a WASM implementation we would then be asking you to trust. With a genuinely strong passphrase, both are far past the point where brute force is the realistic attack.

A practical division that works

Keep the password database small: credentials, recovery codes, licence keys, the odd short text file. Keep an Elba folder for documents: scans, contracts, medical letters, manuscripts, photographs.

Record the Elba passphrase as an entry in KeePass. That gives you one thing to remember — the KeePass master password — while keeping the two blast radii separate. If you prefer, invert it: keep the KeePass master password written on paper in a safe, which is a perfectly respectable answer that a great many security professionals actually use.

Sync behaviour, in detail

A KeePass database is one file. Two devices editing it while offline produce a genuine conflict, and merging is a manual, error-prone job. Adding attachments makes the file bigger, which makes partial or interrupted syncs more likely.

Elba seals files individually, so the conflict surface is a single document rather than the whole vault. That is not sync engineering on Cryptomator's level, but it does mean a bad sync costs you one file's worth of trouble rather than every password you own.

Who Elba is for

Use KeePass for secrets. Use Elba for documents. The division is not a marketing line — it follows from how each format handles size, sync, and browsing.

Questions people actually ask

Can KeePass store files securely?
Yes — attachments are encrypted with the same database key. The limits are practical, not cryptographic: database size, sync conflicts, and awkward retrieval.
How big can a KeePass attachment be?
There is no hard cap, but because the whole database is rewritten on every save, anything beyond a few megabytes total becomes uncomfortable.
Is Argon2 better than PBKDF2?
For equal cost, Argon2 resists specialised hardware better. Both are adequate behind a strong passphrase; neither rescues a weak one.
Should I keep passwords in Elba?
You can seal a password file, but a dedicated manager gives you generation, autofill, and breach checks. Use the right tool for each.
Can Elba open a .kdbx file?
No. Elba treats it as an opaque file like any other.
Is KeePass free?
Yes, KeePass and its main forks are free and open source.

Quick answers

Take the island

Elba is one HTML file. It runs locally in a Chromium browser, seals a folder with AES-256-GCM, never phones home, and becomes open source on 1 January 2030.

  1. €49MMXXVI· now ·
  2. €39MMXXVII2027
  3. €29MMXXVIII2028
  4. €19MMXXIX2029
  5. FreeMMXXX2030

the price falls each year · free to all 1 jan 2030

Take the island — €49
pay once · no account · nothing leaves

Compare Elba with other tools

All guides

Related guides