Add Tag Feature

[Blih]

Expected Behavior

As introduced in Keepass 2.11 : http://keepass.info/news/n100703_2.11.html

Added entry tags (you can assign tags to entries in the entry editing window or by using the 'Selected Entries' context menu; to list all entries having a specific tag, choose the tag either in the 'Edit' main menu or in the 'Show Entries' toolbar drop-down button).

[chrismazanec]

I think better implementation would be a "gmail like" hierarchy tags, unfortunately not implemented by keepass:

https://sourceforge.net/p/keepass/feature-requests/1939/

Allow tag hierarchies. That is, each tag can have one (or probably more) parent tags, and then the user can browse Entries using a tags tree view. This makes it much easier to categorize Entries compared to the folder hierarchy where you have to decide what exact folder your Entry belongs to. In most cases an entry can be related to more than one folder/category but can only store it under a single folder. Using hierarchical tags you can just associate any related tags to your entry and find it by search or browsing.

[droidmonkey]

Not sure I am a fan of this feature. IMO its either tags or folders but not both. The user has WAYYY too many ways to store the entries in KeePass. To me, this adds complication for little gain. A better/deeper search is far more useful.

[marco-brandizi]

Tags+Folders can help to manage orthogonal classifications. For instance, I use "Home Accounts", "Work Accounts" as groups and "Production", "Test", "Dev" as tags. It shouldn't confuse the user to have both, if you can decide to use one only and ignore the other (might even be done with some preference flag).

By the way, I really appreciate that it doesn't destroy tags created by other apps :-)

[t4777sd]

I would utilize the feature in the same way @marco-brandizi utilizes it if it was available. However, since I am not developing or maintaining the keepass code, I can see how it might just add unnecessary complexity to the code / interface.

Since the only difference between tags and folders is that tags offers a one to many relationship (an entry can belong to multiple tags but only one folder). Is there really a use-case where a one-to-many categorization method is necessary?

[phoerious]

Actually, tags are many-to-many. One-to-many is what we already have with folders. I kind of agree with @droidmonkey on this one, but I'm not totally against tags.

[guihkx]

I wish this was added, I use tags for the Auto-Type feature in desktop programs, such as Steam. I don't like using the "Use entry title to match windows for global Auto-Type" because it creates too much conflicts for me. So to be honest, I don't even use tags for sorting...

[phoerious]

You can add custom window rules for entries.

[guihkx]

I don't know how I missed that. Thanks!

[rocketraman]

IMO its either tags or folders but not both.

Another use case for tags -- I add tags for every account that has my credit card info and address. In addition, one entry can have multiple tags, for each credit card and address I have (I have multiple of both). That way, if any of my credit cards or addresses ever changes, I can just filter by every account with that card/address and know which I have to change at a glance.

This simply can't be done with folders, and it requires a many-to-many capability.

I agree with @marco-brandizi that I appreciate KeepassXC doesn't destroy tags created by other Keepass programs!

[droidmonkey]

Oh nice use case!

[magkopian]

I also think that tags should have a place in KeePassXC. In my mind, I see groups as the equivalent of parent classes in OOP, while tags are more similar to interfaces. Groups should be used for describing a relationship between it and its children (e.g. amazon is an e-commerce website), and tags for defining a property of the entry (e.g. server-name provides ssh credentials).

Many entries which are completely unrelated to each other may provide SSH credentials, in which case an ssh tag would make perfect sense in my opinion. Since ssh doesn’t really define a relationship, but rather a property that many entries may share regardless to which group they belong.

Then it becomes possible to filter based on a tag, which allows the browsing of the same database group structure, while hiding or showing only the entries that have a specific tag.

[2011]

If this feature goes in (and I hope it does), please, PLEASE, don't forget the very best use case (in my opinion) - the ability to "save database as" only entries that have certain tags (or export them - that would be more work having to re-import them into a new database, but still a huge improvement over not having that capability).

I use keepassdx on my phone (same database format), and I don't want my entire password database on my phone (adds risk for no useful reason) - I only want the entries I am likely to need in that database. I would like to mark the entries in keepassxc on my desktop that I need on my phone (using say a "phone" tag), and then create a database with just those entries.

Likewise, suppose I want to share a subset of my passwords with the hypothetical "Alice" (always used in crypto examples). These could be things like VPN passwords, for example. If I have to change one of those passwords, it would save a lot of time updating her copy of those passwords to be able to select entries with an "Alice" tag, and then save just that subset into a new database, rather than having to copy the entire database, and then having to go through and delete all of the entries that I don't want Alice to have.

Thank you for your consideration.

[droidmonkey]

@2011 That is exactly the use case of KeeShare which we have integrated into v2.4.0. This is a far more robust solution that is automatic instead of manual. See #2109.

Tags can be used to sort/filter an export, sure, but certainly not the primary use case of this feature.

[2011]

That is a wonderful extension (and one that I wasn't aware of - I guess I haven't paid much attention to the extensions :) ). I will certainly start using that to share passwords with other desktops running keepassxc.

However, that won't solve the problem of keeping my phone in sync (unless you come out with an android version :) ). While keepassdx (which I am currently using on android) shares the same database format, their feature set is still a bit behind what you offer (there is no import capability yet, so it is much easier to create the database that I want on my desktop machine, and then move it to my phone).

[droidmonkey]

Use KeePass2Android, we work with them on feature parity. I use Google Drive to keep my database synced, works flawlessly.

[2011]

@droidmonkey I didn't know that you worked with them. When I chose a password manager for Android, I searched in the F-Droid depository, which KeePass2Android is not in. I had no problem finding a request to add it, but the reason it hasn't been included yet still remains uncertain to me - it appears to be some combination of Xamarin previously being closed source, no one with enough familiarity with Xamarin at F-Droid to actually build it, and the inclusion of proprietary file syncing features.

Will still consider changing to KeePass2Android, but would be more motivated to do it if it were in F-Droid. :)

[fnoon]

Just to add a use case: I'm considering adopting KeePassXC, and one way I use 1Password is to assign a "billpay" tag to each entry I routinely use to pay periodic bills. That way it's easy to go down the list, open URL's, etc. It looks like I can do something similar with the Find "notes: billpay" function, but the results list isn't as "sticky" as a group list, so I don't know whether that would prove too finicky to use this way.

[droidmonkey]

The search is very flexible and easy to use. This is a feature we want to add, just need to find time.

[rwat1]

I'm considering adopting KeePassXC, it has everything I ever wanted built-in, like TOPT, Favicons, Argon2, WebAutotype by URL, all built-in. Just need tags, that would be perfect.

For example, I tagged all my entries that have TOTP, so I can easily just "Display all tags with TOTP tag" and just Scan QR codes, and bam, done.

[droidmonkey]

In the meantime, you can use advanced search by entering the following sequence: attr:otp

[heurbar]

Another example supporting use of tags.

I have a folder for credit cards and bank accounts. In that folder are the folders for each credit card or bank company. In the company folder are entries for PIN, account number, additional info, login. Adding a tag for PIN, Acct, Info, Login makes it easier to see which entry is for Login, PIN or account number. Also, it becomes easier to just filter for entries with 'Login' tag.

I also use 'Login' tag for web site entries that require login information.

[DaveMiddleton]

Recently switched to KeePassXC from KeePass.

Here's another use case for tags Some websites require two factor authentication (2FA) either using U2F, FIDO2 , Phone, Authenticator, DUO, VIP Apps etc. As I moved countries and phone numbers, I had to change the 2FA's on some websites that are still using phones before I may lock myself out. Identifying which entries use 2FA by phone as a tag in KeePass was a very helpful feature.

Attribute as an alternative On the other hand, the same use case can be realized if you use an attribute in KeePassXC and the search command e.g. attr:"2FA-Phone".

[marco-brandizi]

@DaveMiddleton, just a note: tags can be emulated in several ways, two are attributes and special formatting in the entry title (eg, "Sample Entry [[examples]]"). The thing is tags are part of the KeePass protocol and, as such, they're standardised and portable when implemented. So, if you assigned tags in one app, you have reasonable hopes to see them properly managed in other KeePass-compatible apps (eg, filtering by clicking on tag name buttons).

[DaveMiddleton]

@marco-brandizi you are correct; the database file still contains the tags, but they cannot be accessed through KeePassXC. My point was to strengthen the use case for tags, while using a work-around until it will be released for KeePassXC.

[rwat1]

I spent the last 3 years organizing my entries into TAGS. Now they completely don't work in KeePassXC.

@DaveMiddleton I also do the same tagging for 2FA. It's super helpful when switching phones.

[Snake883]

I like how KeeWeb does tags and folders.

[OscardR]

Another use case: I have a script which is a key piece of our IT infrastructure that fully relies on tags to retrieve secrets from a .kdbx file that already has tagged entries.

I can't maintain this DB with KeePassXC since it doesn't even allow to see these tags. While this feature is not implemented I must use an alternative tool.

[kh4on]

OMG, Issue created Apr 17, 2017 4 years no tags.

Explain how you can control the password database without tags?

If you have 10 passwords, then of course the tags are not needed. But at 10,000 passwords, without tags it is simply impossible to control the base.

[chevdor]

@kh4on This may be worth a reminder... keepassxc is an open source project developed by volunteers. I am glad to hear you decided to help with this issue, it surely will be much faster with your help. You can find a PR here: https://github.com/keepassxreboot/keepassxc/pull/6487 where you can follow the progress on this very topic and help with testing, feedback, ideas, reviewing the code, helping with the doc.

[rwat1]

@kh4on This may be worth a reminder... keepassxc is an open source project developed by volunteers. I am glad to hear you decided to help with this issue, it surely will be much faster with your help. You can find a PR here: #6487 where you can follow the progress on this very topic and help with testing, feedback, ideas, reviewing the code, helping with the doc.

Genuine question, how do I learn to become a programmer to help out with this project? I have an epidemiology background so no clue where to star or learn what.

[droidmonkey]

https://www.google.com/search?q=learn+cpp+free

[tunbridgep]

I know CPP from uni (not very standards complient, though), but not much about security or contributing to open source. I would like to help with this feature if possible.

Would that be viable? I know some projects have a very high-bar for code quality, and since this is security focused, it must be even higher.

I do Java in my day job

--

Anyway, to actually add something to this discussion:

Another possible use case, similar to the 2FA one above, would be to have tags for recovery emails. That way, when closing an email account, we can know which entries used it as their "forgot password" email, and we can go in and change it.

Because email addresses are stored in my database, though, it might be more useful just adding a custom attribute with a reference to the email entry. I would have to search on it manually, but means less duplication overall.

[droidmonkey]

This is already being worked

[seconddayout]

ETA? —given that it's "already being worked on"

[xvallspl]

ETA when life allows it. I will update the PR as soon as I have enough time to finish debugging the issue I run into last weekend.

@kh4on This may be worth a reminder... keepassxc is an open source project developed by volunteers. I am glad to hear you decided to help with this issue, it surely will be much faster with your help. You can find a PR here: https://github.com/keepassxreboot/keepassxc/pull/6487 where you can follow the progress on this very topic and help with testing, feedback, ideas, reviewing the code, helping with the doc.

[rwat1]

@xvallspl Thank you for your hard work on it. This is the biggest barrier for me adopting KeePassXC since I have so many tags from KeePass (e.g., this entry has 2FA) that I can't switch over fully until it has a tagging system in place. I really appreciate your hard work, thank you!