Password Management

Organize your Secrets

There are several options available to manage passowrds. Kubuntu Focus computers come with a couple of these pre-installed, but there are several others that you can find across the web.

• KDE Wallet
• KeePassXC
• Password Recovery
• Other Solutions
• Troubleshooting
• Revisions
• Disclaimer

Manage passwords efficiently with KeePassXC.

Please read the disclaimer before proceeding. We review and update guided solutions regularly. If you have suggestions or requests, please write support@kfocus.org.

KDE Wallet

KDE Wallet is the default password manager on Kubuntu systems. It stores passwords completely encrypted and unlocks upon login. All KDE applications integrate with this password manager, and it stores Wi-Fi passwords, file manager passwords, and other system passwords. It also integrates well with Google Chrome and other browsers.

By default, the KDE Wallet master password is the same as your user password. For this reason, if you ever change your user password, your KDE Wallet password will no longer unlock automatically upon login. You can fix this by making sure the passwords match again:

• Open System Settings > KDE Wallet
• Under the tab Wallet Preferences, enable [x] Enable the KDE Wallet Subsystem.
• Under the tab Wallet Preferences, optionally enable [x] Use KWallet for Secret Service interface.
• Under the tab Wallet Preferences, do not check any other boxes.
• Click on the bottom-right button [ Launch Wallet Manager ].
• When the Wallet Manager app appears, click on the top-right button labeled Change Password...
• When prompted, set your new password to match the password of your user account
• Logout and back in to test the change

Some apps that handle passwords and logins use libsecret. This can be provided by KDE Wallet, KeePassXC, or GNOME Keyring. KDE Wallet is enabled by default and should work for most, as discussed here. You can also use KeePassXC for libsecret, as described below. We suggest you avoid installing GNOME Keyring if you can.

KeePassXC

KeePassXC is a cross-platform, sync-able, decentralized password management solution. It has plugins for Chrome (and other Chromium-based browsers), Firefox, and Android clients. For these reasons, we highly recommend it, and feel it's a compelling alternative to commercial services like LastPass and 1Password.

To use KeePassXC to manage web passwords, install its browser extension. For Firefox, use Menu > Add-Ons and themes, with Chrome, use Menu > Extensions > Visit Chrome Web Store. Then in KeePassXC, enable browser password integration by clicking on Settings (Gear Icon) > Browser and select your browser, like [x] Firefox, and click OK. If you are using the Firefox snap, see the Browsers Guided Solution for additional adjustments you will need to make. The 24.04 Kubuntu Focus Suites replaces the default Snap with the official Firefox packages from Mozilla.

To enable KeePassXC's secret service integration, for apps such as VSCode Settings Sync and Fortinet Client, follow the steps below:

• To store your secrets in KeePassXC, open or create a database and add a group called secret-service.
• Go to Tools > Settings > Secret-Service-Integration and check the Enable KeePassXC Freedesktop.org Secret Service Integration. Then click [ Ok ].
• Go to Tools > Settings > Secret-Service-Integration, click the General tab, and then in the Exposed Database Groups table, click the small pencil icon next to the database you want to host the secrets. This will show the Database Settings dialog, which has a Secret Service Integration section. Select Secret Service Integration and then check the Expose entries under this group radio option. Select the secret-service group you created earlier, and click [ Ok ].
• Optional: To test libsecret integration, install libsecret-tools (sudo apt install libsecret-tools), which provides the secret-tool utility. Then, while the database is unlocked in KeePassXC, test storing a credential by entering the following into a terminal: secret-tool store --label='Created from cli' account test. Enter your desired password when prompted. KeePassXC should show then show a new credential under the secret-service group.

Some forum posts recommend installing Gnome Keyring; however, this can interfere with the KWallet subsystem. For this reason, we strongly recommend you try to use KWallet or KeePassXC instead. Additional information on KeePassXC's libsecret capability is shown here and in this AskUbuntu post.

KeePassXC's database file can be stored on a cloud drive such as Dropbox, Google Drive, OneDrive, ownCloud, Nextcloud, or similar. This is useful for synchronizing across multiple devices. To learn more, visit the KeePassXC website documentation.

Sometimes, a database file can conflict when shared on a cloud drive. This can happen if you change passwords on two devices, but the sync is disabled or delayed. When this occurs with Dropbox, the offending file is kept with a name like foo-conflicted.pas. To resolve this issue, you can merge databases:

• In KeePassXC, use Database > Save Database Backup... to backup your current database.
• Use Database > Merge from Database and read-in the conflicted file.
• Once you have confirmed a merge (see below),we recommend you rename or delete the conflicted file so you don't accidentally merge it again later.

To compare changes between databases, like those before or after a merge, you can follow this procedure:

• In KeePassXC, use Database > Export > CSV File the databases you wish to compare.
• Read the output into a spreadsheet and sort all rows but the first.
• Export the sorted spreadsheet back to CSV files.
• Use kdiff3 or meld to compare the CSV files.
• IMPORTANT: When you are done comparing the files, DELETE THEM to prevent password theft!

The KeePassXC team released a security audit which we also encourage you to review. You can learn more from the official KeePassXC website.

Disclaimer

We try hard to provide a useful solution validated by professionals. However, we cannot anticipate every situation, and therefore cannot guarantee this procedure will work for your needs. Always backup your data and test the solution to determine the correct procedure for you.

THIS SOLUTION IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOLUTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.