Importing from KeePass

The file is opened in your browser and never reaches the server: what is uploaded is already encrypted, like any other entry. Only KeePass .kdbx files are supported.

1. In Entries, press Import.
2. Choose the .kdbx file, type the Password of the .kdbx file, and pick the Destination collection.
3. Under What else to bring, decide on TOTP seeds and on Groups as collections, nested. Both start off.
4. Press Read the file.
5. Review the list: entries are grouped by folder, and you can untick any of them, or use Select all and Select none.
6. Read the summary and press Import. Do not close the tab while it says it is encrypting and uploading.

What comes in and what does not

• Entries you untick are not imported.
• Folders become collections only if you ticked it; a collection with the same name is reused.
• One-time code seeds only if you ticked it, and unreadable ones never.
• Attachments are not imported: there is no place for them yet.
• Custom fields come in with a custom: prefix, and they are treated as secret.
• Entries with only a URL come in as bookmarks; empty entries are skipped.

Importing one-time code seeds puts the password and its second factor in the same place: whoever opens the entry has both. Nested collections also share access downwards — see Collections and sharing.

When it finishes, the .kdbx file is still on your disk. Delete it if you no longer need it.

Exporting a copy

Security → Export a copy writes one encrypted file with everything the person exporting can open right now. It is read-only: nothing you do with the copy comes back to this vault, and nothing here reaches the copy afterwards. It is offered to owners and admins, because it exists as an external backup of the account rather than as a copy each person takes home. That is where the tool is, not a boundary: anyone who can open a collection can copy what they read, here or anywhere else. What limits reading is grants and keys, as everywhere in this product.

Opening one back is not available yet, in any of the apps. The file is a copy you keep somewhere safe, not a way to move a vault or to put entries back — so do not delete anything counting on loading it again.

1. With the vault unlocked, open Security and find Export a copy.
2. Under What opens the file, pick Your master password — nothing more to remember — or A passphrase for this file, and type it twice. A passphrase file can be handed to someone who does not have your master password, and it keeps working if you change that password later.
3. Under What goes in, leave every collection ticked to take the whole vault, or press Select none and tick only the ones you want.
4. Press Download the file. It is encrypted in this browser before it reaches your disk.

• It holds the entries you can open right now: names, secrets, URLs and one-time code seeds.
• Collection names are readable inside the file once it is opened, not from outside it.
• A collection nested in another takes that parent along as a keyring — the child's key is wrapped with the parent's — but none of the parent's entries.
• Your account, your permissions, the history of each entry and your sends are not in it.
• Nothing you could not already open goes in. Exporting does not widen what you can read.

The file is a copy, not an access. Whoever holds it and the secret that opens it reads everything in it, and revoking a grant, removing a device or deleting an entry afterwards does not reach it — nothing can. If you chose a passphrase, losing the passphrase loses the file: nobody, not an administrator and not Musubi, can open it or reset it.