Is there a portable version of KeePass?

Yes. The official KeePass 2.61.1 portable ZIP (2.8 MB) runs from any folder — a USB stick, a network share or your desktop — with no installation and no admin rights. It is published on the same official SourceForge page as the installer.

Does portable KeePass need admin rights?

No. You extract the ZIP and double-click KeePass.exe. Nothing is written outside its own folder in portable mode, which is why it works on locked-down work PCs.

How big is portable KeePass once extracted?

We unpacked the official KeePass 2.61.1 ZIP: it extracts to 5,235,256 bytes (about 5.0 MB) across 14 files. The program itself is a single 3.1 MB (3,265,880-byte) KeePass.exe.

Where does portable KeePass store its settings?

In a KeePass.config.xml file created next to KeePass.exe, per the official installation documentation. Your settings travel with the folder — copy the folder and everything comes along.

Does portable KeePass need .NET installed?

It needs the .NET Framework, which is part of Windows 11 and Windows 10, so on those systems it runs out of the box. On a bare system without .NET Framework it will not start.

Can I run portable KeePass from a cloud-synced folder instead of a USB stick?

Yes. Portable KeePass runs from any writable folder, including one synced by Dropbox, OneDrive or Syncthing. Keeping the database in a synced folder also gives you multi-device access — just let the sync finish before opening the file on a second machine.

Does portable KeePass leave traces on the host PC?

KeePass itself keeps its settings and database inside its own folder in portable mode, so the program leaves nothing behind by design. Windows, however, can keep its own traces of any program you run (recent-file lists, prefetch entries), so on a machine you do not control, assume the fact that you ran it may be visible — your passwords stay encrypted regardless.

Is portable KeePass safe on a USB stick?

Yes, with one caveat: the database is as safe as your master password, since anyone who finds the stick has the encrypted file. Use a strong passphrase, and keep a second copy of the .kdbx elsewhere in case the stick is lost. More in our safety analysis.

Home › KeePass portable

By Jack Turner, keepasspc.com · Updated 2026-07-14

KeePass portable download: run it from a USB stick, no install

The KeePass portable download is an official 2.8 MB ZIP file that runs from any folder — USB stick, cloud-synced directory or a locked-down work PC — without installation or admin rights. We downloaded, verified and unpacked the official 2.61.1 ZIP ourselves: here is exactly what is inside it and how to set it up.

Download KeePass 2.61.1 portable ZIP (2.8 MB)

SHA-256 we computed on 2026-07-09:

3952354db9b117e906f7cd4f9f5591065b95186472370da47f46f3e246fea864

Cross-check against the official KeePass integrity page. The link above resolves to the official SourceForge distribution — we never rehost files.

Set up portable KeePass in four steps

Download the official portable ZIP. Get KeePass-2.61.1.zip (2.8 MB) from the official SourceForge files — the button on this page resolves there.
Verify the checksum. In PowerShell run Get-FileHash .\KeePass-2.61.1.zip and compare with the SHA-256 on this page and the official integrity page.
Extract to your USB stick. Right-click the ZIP, choose Extract All, and pick a folder on the stick such as E:\KeePass. No installer runs; the files just land in the folder.
Run KeePass.exe and create or open your database. Double-click KeePass.exe. Store your .kdbx database in the same folder so everything travels together, and KeePass will write its KeePass.config.xml settings file next to the EXE.

Once it runs, daily use is identical to the installed version — the same entries, Auto-Type and generator our KeePass beginner tutorial walks through apply unchanged to the portable build.

What is actually inside the portable ZIP

We unpacked the official KeePass-2.61.1.zip: it extracts to 5,235,256 bytes (5.0 MB) in exactly 14 files:

KeePass.exe (3,265,880 bytes — the entire program)
KeePass.chm (offline help file)
KeePassLibN.x64.dll / .x32.dll / .a64.dll (native crypto libraries — x64, x86 and ARM64)
KeePass.XmlSerializers.dll
ShInstUtil.exe (shell-association helper, unused in portable mode)
License.txt (GPL v2+)
Languages/, Plugins/, XSL/ (empty folders for translations, plugins, export styles)

Two details worth knowing from that inventory. First, the whole program is the single KeePass.exe — everything else is help, native crypto acceleration and empty extension folders. Second, the presence of KeePassLibN.a64.dll means the portable build carries a native ARM64 library, so it runs natively on Windows-on-ARM laptops — a detail most download pages never mention.

Portable vs installer: when portable is the right call

Portable KeePass is the right choice when you cannot or do not want to install software: work machines without admin rights, shared computers, or a vault you want to physically carry. The trade-offs are no Start-menu entry, no .kdbx file association (you open the database from within KeePass), and updates mean extracting a new ZIP over the old folder. For your own PC, the installer version is more convenient; the programs are otherwise identical byte-for-byte in function — same features, same database format, same author.

One more practical note from our unpacking: the ZIP contains empty Plugins and Languages folders, so plugins and translations you add also travel with the stick — drop the plugin DLL into that folder and it loads on any machine you plug into, no per-PC setup.

How do you update and sync a portable install?

Updating is manual by design: when a new KeePass version ships, download the new official ZIP, verify its checksum, and extract it over your existing folder. Your database and KeePass.config.xml are untouched because the ZIP contains neither — it only replaces program files. We re-measure and republish checksums here on each release, so this page's hash always matches the current official ZIP.

Syncing works the same as any KeePass setup: the .kdbx database is just a file. Keep it beside the EXE if you want a fully self-contained stick, or point KeePass at a copy in a synced folder if the same vault must follow you across machines — the trade-offs of each approach are covered in our KeePass vs Bitwarden comparison. And if you regularly use macOS or Linux machines too, KeePassXC opens the identical database file natively on all three platforms.

Whichever way you carry it, the security caveats of removable media are worth two minutes of your time — our KeePass safety analysis explains what the encryption does and does not protect when a stick is lost.

Portable KeePass FAQ

Is there a portable version of KeePass?: Yes. The official KeePass 2.61.1 portable ZIP (2.8 MB) runs from any folder — a USB stick, a network share or your desktop — with no installation and no admin rights. It is published on the same official SourceForge page as the installer.
Does portable KeePass need admin rights?: No. You extract the ZIP and double-click KeePass.exe. Nothing is written outside its own folder in portable mode, which is why it works on locked-down work PCs.
How big is portable KeePass once extracted?: We unpacked the official KeePass 2.61.1 ZIP: it extracts to 5,235,256 bytes (about 5.0 MB) across 14 files. The program itself is a single 3.1 MB (3,265,880-byte) KeePass.exe.
Where does portable KeePass store its settings?: In a KeePass.config.xml file created next to KeePass.exe, per the official installation documentation. Your settings travel with the folder — copy the folder and everything comes along.
Does portable KeePass need .NET installed?: It needs the .NET Framework, which is part of Windows 11 and Windows 10, so on those systems it runs out of the box. On a bare system without .NET Framework it will not start.
Can I run portable KeePass from a cloud-synced folder instead of a USB stick?: Yes. Portable KeePass runs from any writable folder, including one synced by Dropbox, OneDrive or Syncthing. Keeping the database in a synced folder also gives you multi-device access — just let the sync finish before opening the file on a second machine.
Does portable KeePass leave traces on the host PC?: KeePass itself keeps its settings and database inside its own folder in portable mode, so the program leaves nothing behind by design. Windows, however, can keep its own traces of any program you run (recent-file lists, prefetch entries), so on a machine you do not control, assume the fact that you ran it may be visible — your passwords stay encrypted regardless.
Is portable KeePass safe on a USB stick?: Yes, with one caveat: the database is as safe as your master password, since anyone who finds the stick has the encrypted file. Use a strong passphrase, and keep a second copy of the .kdbx elsewhere in case the stick is lost. More in our safety analysis.