ericr.org

LinuxPass: the KeePass window I kept missing

A cross-platform Avalonia password manager that opens my existing .kdbx files and puts the classic KeePass layout back on the Linux desktop.

2 min read

Painted illustration of a glowing card-catalog cabinet in space with keys and index cards drifting out of an open drawer.

I've kept my passwords in a KeePass database for a very long time. On Windows, KeePass 2.x is a comfortable old chair: a menu bar, a toolbar, groups in a tree on the left, entries on the right, details at the bottom. It isn't pretty, but my hands know exactly where everything is.

On Linux I've mostly used KeePassXC, and it's excellent. But this week of passkey work (more on that in the next post) had me thinking about how a password manager and an authenticator could share one database. I wanted a codebase I understand end to end, in the language I use every day. So I started LinuxPass: a cross-platform Avalonia app on .NET 10, laid out like the KeePass I remember.

What it does today

It's deliberately modest so far, and everything it does, it does against my real database:

  • Opens and unlocks KeePass .kdbx files, and legacy .kdb files too, with a master password
  • Shows nested groups as a tree and the entries in a sortable list
  • Searches titles, usernames, URLs, and notes all at once
  • Edits username, password, URL, and notes in place, then saves back to the same file
  • Copies a password from the detail panel or a right-click menu
  • Has an A–Z index for jumping around a long entry list
  • Locks the database and clears the decrypted data out of the view model
  • Remembers the last database and window size, and asks for the master password on launch

The file format work is handled by KeePassLib.Standard, a .NET Standard build of the same library KeePass itself uses. That was a big reason to try this at all. I'm not reimplementing the KDBX crypto; I'm building a UI around a library that has read and written these files for years.

MVVM, the Avalonia way

The app is a straightforward Avalonia MVVM layout: a MainWindow with its MainViewModel, and a separate password prompt window. What surprised me is how easy the “classic desktop app” look is in Avalonia. A TreeView, a DataGrid, a GridSplitter or two, and a proper menu bar give you something that looks like it belongs to the late-2000s Windows era in the best way. It behaves the same on Windows and on my Linux desktop.

Where it's headed: talking to the browser

The part I'm most excited about is still a design doc. The KeePassXC-Browser extension talks to its desktop app over browser native messaging. If LinuxPass speaks that same protocol, I can reuse the existing extension instead of writing my own:

docs/PluginProtocol.md
KeePassXC-Browser extension
             │  Browser Native Messaging
             ▼
      linuxpass-proxy
             │  Unix-domain socket
             ▼
      LinuxPass desktop process
             │
       ┌─────┴─────┐
       ▼           ▼
 Active database  Browser/passkey services

The one rule I wrote in bold: the desktop process owns the open database. The small proxy the browser launches never opens the .kdbx itself. Two processes with the same file open is how you get stale reads, lock fights, and eventually lost entries.

A password manager is a strange project for a hobbyist, because the bar is “never lose anything, ever.” That's also why it's a good one. It forces the careful habits I want everywhere else.