Welcome

Password Safe

How many passwords and user names do you have to keep track of? Whether the answer is one or hundreds, Password Safe allows you to safely and easily create a secured and encrypted master password list. A single Master Password unlocks them all for your use.

Security starts with the user. Keeping written lists of passwords on scraps of paper, or in a text document on your desktop is unsafe and is easily viewed by prying eyes (both cyber-based and human). Using the same password over and over again across a wide spectrum of systems and web sites creates the nightmare scenario where once someone has figured out one password, they have figured out all your passwords and now have access to every part of your life (system, e-mail, retail, financial, work).

Password Safe allows you to manage your old passwords and to easily and quickly generate, store, organize, retrieve, and use complex new passwords, using password policies that you control. Once stored, your user names and passwords are just a few clicks away.

Using Password Safe you can organize your passwords using your own customizable references—for example, by user ID, category, web site, or location. You can choose to store all your passwords in a single encrypted master password list (an encrypted password database), or use multiple databases to further organize your passwords (work and home, for example). And with its intuitive interface you will be up and running in minutes.


About Password Safe

Password Safe and the Blowfish encryption algorithm it uses were originally developed and released to the public by Bruce Schneier and Counterpane Internet Security, Inc.

Password Safe is now an open source project hosted at sourceforge.net. The latest program updates, documentation, and news can be located at http://passwordsafe.sourceforge.net.

Password Safe is freely available and distributable under the restrictions set forth in the standard Open Source Initiative (OSI) "Artistic License." A copy of this license is included with the Password Safe installation package in the file named license.

Blowfish is a fast, free alternative to the DES and IDEA encryption algorithms. Details on the Blowfish algorithm, including speed comparisons and an extensive list of products that use Blowfish, are available at http://www.schneier.com/blowfish.html.

Please read the readme.txt, changelog.txt, and releasenotes.txt files in the installation package for the latest changes, bug fixes, and documentation addenda.

All other brand or product names are trademarks of their respective companies. No support or endorsement by these companies exists or is implied.


Creating a New Safe

Creating and Opening a Safe

Password Safe allows users to store all passwords in a single "safe," or password database or to create multiple databases for different purposes. Each database is independent of the program and can be moved and used on different systems, as long as the same version of Password Safe is installed. Databases are encrypted and the master password information is contained within the database.

If you are using Password Safe for the first time, you will be prompted to enter a master password that is used to encrypt and lock the contents of your new safe. Users are prompted for a location to store the database file when Save As is selected from the File Menu or when exiting the program.

Create a New Database

There are two ways that a new database can be created. By clicking Create New Database from the Safe Combination Entry dialog when the program is started, or from the File > New Database menu once Password Safe has been opened. Using either method causes the Safe Combination Set Up dialog to appear.

Note: By default, Password Safe connects to and displays a combination prompt for the database last used. To use a different database, either click Open Existing Database from the Safe Combination Entry dialog or Open Database from the File Menu.


Using Stored Passwords

Password Safe provides several mechanisms for using stored user names and passwords. Most require copying the user name or password to the clipboard and then pasting the information into the required input field. One function that automates the entering of user name and password into a web form is covered elsewhere in this manual. See Auto Type for more information.

  1. Open Password Safe
  2. Select the user name/password entry you wish to use
    User Name:
  • Select the user name icon from the tool bar
    or
  • Right-click and select Copy username to clipboard
    or
  • Use Ctrl + U
    and then Paste the user name into the desired field.
    Password:
  • Select the password icon from the tool bar
    or
  • Right-click and select Copy password to clipboard
    or
  • Double-click the selected entry
    or
  • Use Ctrl + C
    and then Paste the password into the desired field.
Note: User names and passwords can also be copied to clipboard through the choices located in the Edit menu, but let's be honest, that's far too much clicking.


Upgrading Password Safe 1.x

In order to accommodate enhanced features in the Password Safe program, there were structural changes that needed to be made to the Password Safe database and require conversion of databases between different Password Safe major versions (1.x and 2.x).

Upgrading Password Safe 1.x

Upgrading Password Safe version 1.x to 2.x merely consists of opening the database with the newly installed version. The conversion takes place on the fly and a backup copy of the version 1.x file is created the first time the coverted databases is saved.

Rolling Back Version 2.x *.DAT files to Version 1.x

Use the backup file created by Password Safe during the upgrade or convert your current database to the 1.x format (File > Export To and select Old (1.x) format...) .


A Word about Master Passwords

One of the most important keys to maintaining your security is selecting a strong master password for your Password Safe database. The database or "Safe" contains all your user names, passwords, and any additional annotations you may have added. Picking a spouse's name, a birthday, or some other easily guessable combination leaves your data vulnerable. While this may seem a bit like an oxymoron, it isn't: It is important that you pick a hard-to-guess master password that you can easily remember.

Password Safe has a built in check for what it considers to be weak master passwords. In general, a master password (like any password) should consist of mixed case characters with at least one number or special character (such as those found above the number keys on a keyboard). If a master password is entered that the program considers weak, it will prompt for verification. The user then has the option to accept the originally entered combination or to enter a new one.

To change your master password, please see Changing Master Passwords.

Note: There is no mechanism within the product to retrieve lost or forgotten safe passwords.
Any mechanism for retrieving lost passwords poses a security hole that can be exploited.


User Names and Passwords

User Names, Passwords, and Groups

There are five bits of information associated with each password entry:

  • Group: Organizational name for grouping multiple entries.
  • Title: A friendly name for a password entry
  • User name: The user name
  • Password: The password
  • Notes: Free-form general notes field.
Note: If you type a URL in the Notes field (starting with http:// or https:// or ftp://) then "Browse to URL" in the popup (right-click) menu for that entry will be enabled. Selecting it will invoke the default browser on that URL.

Only the title and password fields are required; all others are optional.

Creating a New User Name and Password Entry

  1. Open the database where you wish to place the new entry
  2. From the Edit menu, select Add Entry
  3. Enter information into the Edit/View Entry dialog fields as necessary
Note: If a Group name is selected and then a new entry added, that entry will have that Group name prefilled in the Edit/View Entry dialog. If a name of a new group is added to the Group field, that Group will be created.

Generating and Editing Passwords

If you wish, you can enter your own password into the password field manually, or you can have Password Safe generate a new one based on the current Password Policy.

  1. In the Edit/View Entry dialog click Generate
  2. Click Yes to accept the password or No to reject it
Notes:
  • To temporarily override the current password policy check Override Policy.
  • If your password or user name contains a diacritical character ("´", "`", "^", "¨" or "~" for instance) followed by a character that can be modified by it on your keyboard ("a" for instance), the password must be entered as "[~][space] [space][a]" (This applies to non-US keyboards only).

Editing Existing Entries

  1. Select the password entry to edit from the list
  2. Select Edit/View Entry from the Edit menu
Note: By default, passwords are obscured. To see the password associated with the Entry click Show Password.

Add a New Group

  1. Select Add Group from the Edit menu
  2. Enter the Group name

Edit a Group Name

  • Right-click on the group and select Rename Group from the drop down list
Note: Group names can be "nested," palcing a group name within/under another group name.


Setting a Password Policy

A password policy represents the rules that are used to create a password—the letters, letter cases, length, and any special characters that are required. Some institutions require only lower case characters while others will demand that an upper case character, number, and special character be used, as well as a specified minimum length. In general, it is a good idea to use the longest allowable length and the largest permitted mix of characters. Please verify the exact password requirements with the entities that require them.

The Password Policy dialog allows users to set the choice as a global password generation policy. This policy can be overridden temporarily and passwords manually edited at any time in the Edit/View Entry dialog.

Selecting Password Rules

Each item checked in the dialog forces Password Safe to include the specified characters in the passwords it generates. Each password will also be generated to the specified length (no shorter, no longer). The only exception to this is the Use hexadecimal digits only check box. When checked, passwords will include those characters that represent hexadecimal digits only. In order to enable this choice, all other check boxes must be cleared.


Changing Safe Passwords

Changing Master Passwords

To change a master password, first open up the database whose password you wish to change. Once opened, go to the Manage menu and select Change Safe Combination.


Auto Type

Auto Typeprovides a means for users to easily and quickly enter user name and password information. With a single click, the user name, and password are entered and the form submitted to the host for approval. By default, the formula followed by the automated keystrokes is as follows: the user name, followed by a tab key, followed by the password, another tab, and then the enter key (username TAB password TAB ENTER).

Most, though not all, web forms will operate with the Auto Type feature. For those that don't, it is possible to tailor the autotype behaviour as described in the Customizing Auto Type section below.

Using Auto Type

  1. Place cursor in the form's user name field
  2. Maximize or open Password Safe
  3. Select a password entry
  4. Ctrl -T or right-click and select Perform Auto Type to initiate.

Customizing Auto Type

For web sites that do not have the username field followed by the password field followed by the login button, you can modify the behaviour by adding "autotype:" in an entry's Notes field, followed by a string that specifies the desired behavior as follows:

  • \u is replaced by the username associated with the entry.
  • \p is replaced by the password associated with the entry.
  • \t is replaced by the Tab key, in effect skipping a field.
  • \n is replaced by the enter key, in effect pressing a button.
  • \\ is replaced by the backslash (\) key.
  • \dNNN sets the delay between characters to NNN milliseconds, instead of 10 (the default).
  • All other text is typed as-is.

Example: The following can be used where the bank account number (12345) must be entered before the user and password:

autotype:12345\t\u\t\p\t\n


Backing Up and Restoring Databases

Password Safe provides mechanisms for backing up and restoring password databases.

Make Backup

Safely create a copy of the current password database.

  1. Click Make Backup
  2. Select a location for the backup file
  3. Click Save

Note: It is strongly recommended that you make frequent backups of your password databases. This will help safeguard password lists against system crashes or corrupted files. The backup is encrypted using the same master password as the current database being backed up.

Restore from Backup

Restore a backed up password database file.

  1. Click Restore from Backup
  2. Navigate to the backup location and select the file to restore
  3. Click Open
    A password prompt will be displayed.
  4. Enter the database password and click OK
Notes: The restored database is not "saved" as a standard Password Safe database until you have selected Save or Save As from the file menu. You will be prompted to "Save" the database and give it a name if you have not saved it prior to exiting.


Importing Entries

Password Safe allows you to import password information from text files. These files may be generated by other applications, exported from a spreadsheet, or even written by hand using Notepad or similar text editor.

Text Format

Text files used to import password entries must consist of one or more password entries. Each field within an entry is separated by a field separator and each entry may consist of one or more lines.

  • Group and Title Field
    Groups and Titles are separated by periods. For example Finance.BangForBuckBank (Group.Title). If there is no associated group (a top level entry), then the Title should contain no periods.
  • User Field
    The name of the user associated with this entry. To use the default name specified in Options... this field should be blank.
  • Password Field
    The actual password.
  • Notes Field
    If the Note is more than a single word, it must be enclosed between double quotes ("test note"). A note may span more than a single line, as long as it is terminated with a double quote.

Import Text Settings Dialog

The field separator used in the text file being imported and a default group name to import the new entries into can be configured prior to the actual importation of a text file.

  1. File > Import From....
  2. Select Plain Text...
  3. Set import settings and parameters for the text file being imported
  4. If a Notes field multi-line delimiter character has been used, either in a previous Export or using a text editor, enter it here so that, during the Import process, the Notes field will be split into multiple lines by replacing this character by a newline.
  5. Click OK
  6. Select the text file to import.
Note: At the end of the import process, a small dialog box appears showing how may entries were added, and how many (if any) were unsuccessfully parsed.


Exporting Entries

Password Safe allows you to export password information to text files. These files may then be modified by other applications.

You will first be asked to enter the master password or safe combination to confirm that you may export the database into a clear text unencrypted file.

You will then be asked to supply the name of the new file and to confirm overwriting a file of the same name if it already exists in the directory you specify.

The Notes field

Password entries will be exported with a tab character between fields i.e. between the Group.Title, Username, Password and the Notes fields. The "Group.Title" is considered a single field. Any field containing a blank will be output inside double quotation characters. Only the Notes field can contain multiple line entries. The normal processing is to place each Notes line, if more than one, on a separate line in the exported text field. However, this makes it difficult to sort or to use when comparing two different export files. In order to overcome this, should you need to, you may specify a delimiter to be used to separate the multiple lines when exporting them. If you are going to import the file into Password Safe at a later date and still have a delimiter character, then it must be specified on the import or all the Notes lines will appear as one single line in the resulting database.

If a Notes field multi-line delimiter character is required, enter it here so that, during the Export process, multiple lines in Notes field will be exported as a single line using this character between each of the original lines.

  1. If required, tick that you want to put all separate lines in the Notes field onto one line and enter the character to be used as the delimiter. Since the whole Notes field is enclosed between double quotation marks, this character is prohibited from being selected as themulti-line delimiter.
  2. Click OK


Command Line Arguments

Invoking PasswordSafe with no arguments will cause the application to prompt you for the combination of the last database that was opened, or for the combination of a new databse if noe was opened on the user's machine. It is, however, possible to modify this by invoking PasswordSafe as follows:

  • pwsafe database
    This will open the specified database file, instead of the last one opened.
  • pwsafe -r database
    This will open the database in read-only mode.
  • pwsafe -e filename
    This will prompt the user for a passphrase, and encrypt the file with a key derived from the passphrase. Note: The file can be any file. The encrypted file will have the same name as the original file, with ".PSF" appended to it.
  • pwsafe -d filename
    This will prompt the user for a passphrase, and decrypt the file with a key derived from the passphrase. Note: This will work only on files that were encrypted by invoking pwsafe with the '-e' option (see above).


File Menu

The File Menu contains options related to managing and creating new password safe databases.

New Database

Create a new blank password safe.

Open Database

Open an existing password safe.

Recently Used Files

This section of the file menu may list from one to four recently opened database files. This section will be blank if this is the first time Password Safe has been used.

Save

Save any changes to the current safe. If no changes have been made since the previous save, this choice will be greyed-out.

Save As

Save a copy of the current safe under a new name or location.

Export To

Export the contents of the current database to an external file. See here for more information on exporting the database to a text file.

Import From

Import the contents of a previously exported or correctly formatted text file or a KeePass password database into the current database. See here for more information on importing text files.

Merge Database

Merge a Password Safe database or backup file (.bak) into the current database.

Exit

Closes the Password Safe program.


Edit Menu

Through the Edit Menu users can add, edit, use and organize user names and passwords.

Add Entry

Add a new user name and password.
See User Names, Passwords, and Groups for more information.

Edit/View Entry

Edit the selected user name and password.
See User Names, Passwords, and Groups for more information.

Delete Entry

Delete the selected user name and entry.

Rename Entry

Rename the selected entry.

Find Entry

Find an entry containing user specified search text.

Add Group

Create a new password group (e.g., Banking Passwords).

Copy Password to Clipboard

Copy the current selection's password to the clipboard.

Copy User Name to Clipboard

Copy current selection's user name to the clipboard.

Clear Clipboard

Clear the clipboard's memory (erases the contents of anything that has been stored there, such as a password or user id)

Perform Auto Type

Automatically input user name and password into the selected input field.
See Using Auto Type for more information.


View Menu

The View Menu controls the available display formats. Users can switch between Classic and New Toolbar Icons as well as how their user names and passwords are organized: either as a single list (Flattened List Mode) or organized by category (Nested Tree Mode).

Switching Between Menu Icon Views

  1. Go the the View menu
  2. Select Classic Toolbar or New Toolbar

Switching Between Nested Tree and Flattened List Modes

  1. Go the the View menu
  2. Select Nested Tree Mode or Flattened List Mode


Manage Menu

The Manage Menu is where all of Password Safe's options and settings are controlled.

Change Safe Password

Selecting this option brings up the Change Safe Password dialog.
See Changing Master Passwords for more information.

Make Backup

Safely create a copy of the current password database.
See Backing Up and Restoring Databases for more information.

Restore from Backup

Restore a backed up password database file.
See Backing Up and Restoring Databases for more information.

Options...

Selecting Options... brings up a special tabbed dialog where many of Password Safe's default settings are stored and can be edited. To learn more about a specific tab select it below:


Help Menu

The Help Menu provides access to miscellaneous resources on and about Password Safe.

Get Help (F1)

Open this help file.

Visit Password Safe Website...

Open the Password Safe project page in a browser.

About Password Safe

Display program version and copyright.


Menu Toolbar

There are two different views available for toolbar icons: new and classic. Each of the icons visible on the toolbar provide pop up tips. Simply hover your mouse pointer over the icon and a small tip will appear. For convenience, this topic provides a quick reference for each of the icons.

Switching Between Menu Icon Views

  1. Go the the View menu
  2. Select Classic Toolbar or New Toolbar

Icon List

Classic | New | Description
 |  | Creates a new safe to input passwords.
 |  | Opens a dialog to open and switch to another safe.
 |  | Saves any changes made to the current safe.
 |  | Copies the selected entry's password to the Clipboard.
 |  | Copies the selected entry's user name to the Clipboard.
 |  | Erases the Clipboard memory.
 |  | Adds a new user ID and password entry to the open safe.
 |  | Opens the currently selected password entry for editing.
 |  | Deletes the currently selected safe entry.
 |  | Opens this help file.


Credits

Program Credits

Grateful thanks to Bruce Schneier for creating the blowfish algorithm and for releasing Password Safe to the public; and to SourceForge.net for hosting us and supporting the Open Source community.

The links that follow lead to various pages on the SourceForge web site related to the Password Safe project.

Please feel free to visit us! You're invited.

Password Safe Project Page: Information and news about Password Safe as well as announcements about project status and new releases.

Development Team: Just some of the folks that have helped develop and keep Password Safe going.

Password Safe Forum: A forum for questions, support, and problems.

Password Safe News: RSS feeds available for this project.

Password Safe's low volume (roughly one message every month or so) spam free announcement and user mailing list page.
Come take a look and subscribe!


Display Tab

Functions within the Display Tab control how the Password Safe GUI and password items are displayed.

Always keep Password Safe on top

If checked, maximized Password Safe will always be the top most window displayed in the montior, regardless of what other window may have focus.

Show password in dislay list

If checked, passwords will be displayed in a colomun next to their associated user name when viewed in Flattened List Mode.
This option is strongly discouraged in environments where passers-by can view the montior.

Show password by default in edit mode

If checked, passwords that would normally be obscured in the Edit/View Entry dialog will be displayed in plain text.

Put Icon in System Tray

If checked, Password Safe will minimize to the the System Tray area. If unchecked, the program will minimize to the task bar.

Recent Passwordsafe Databases

These controls allow you to configure how many recently opened databases are displayed in the File menu, for easy access. Note that you need to exit and restart Password Safe for changes in this control to take effect.


Misc Tab

Various miscellaneous program defaults are stored in the Misc Tab.

Confirm deletion of items

When checked, a user prompt requesting confirmation will be displayed every time a user tries to delete a password entry.

Save database immediately after edit or add

When checked, Password Safe saves all changes made to a password entry immediately, without waiting for the user to use Save or Save As and without confirmation.

Escape key closes application

When checked, Esc can be used to close Password Safe when the program is maximized. Note that if the System Tray is enabled (via the Put Icon in System Tray option), then Esc just closes the main window, which can be re-opened by double-clicking on the icon in the System Tray.

Hot Key

When checked, pressing the keys in the sequence to the right will restore PasswordSafe from the system tray, if minimized, or bring it to thefront, if obscured by other applications. The sequence may be changed when the option is checked.

Double click on entry

This allows you to define what action PasswordSafe will take when you double-click on an entry. The default is to copy the entry's password to the clipboard.


Security Tab

The Security Tab provides access to user controlled security settings. Ease of use and program security are affected by the options listed here, but the underlying encrypted password database is not.

Clear clipboard upon minimize or exit

When checked, the program clears clipboard contents of any stored data (such as a password) when the interface is minimized or closed. This prevents anyone else or any other program from reading the contents of the clipboard.

Lock password database on minimized

When checked, locks the password database when the program is minimized. When maximized again for use, a password is required to access the program.

Confirm password database save on exit

Checking this choice causes Password Safe to request user confirmation of any unsaved changes when the program is minimized. Password Safe will continue to request user confirmation of unsaved changes when the program is exited.

Confirm item copy to clipboard

When checked, a prompt is displayed requesting user confirmation every time a password is copied from the database to the clipboard.

Lock password database on workstation lock

Checking this causes the password database to lock when the workstation is locked, preventing unauthorized access by users that may have access to the workstation.

Lock password database after....

Checking this option and setting a time causes Password Safe to lock the password database due to non-use after a set interval.


Username Tab

Many will argue that security rests in the password and that user names need not be cryptic or hard. This tab allows users to set a default user name that will used automatically every time a new password entry is generated. This string will be inserted into the user name field by default, but can be edited. To enable this feature, check Use a default user name and enter a default user name in the field provided.