Sunday, September 15, 2013

Introducing BrowsePass, a KeePass on the web

Update: There is now a Chrome app. If you use the app, you do not need to carry out steps 5 to 7 below.

Update: Please file bugs and feature requests at the project's page.

This post was initially intended to be named "How to have your own open source XXX" where XXX is your favorite commercial online password manager. Then I realized that would have been too deceiving because I don't know jack about them. I have never used them. How can you trust a closed source password management software?

In contrast, BrowsePass is a GPL licensed JavaScript application (and library) to open KeePass password databases in (modern) browsers. It is great when you're on the move and don't bring KeePass with you or cannot install it on your machine but you need to access a password in your vault.

Setting up BrowsePass is as easy as uploading all the files to your web hosting provider. I would recommend you to use MyDrive because it offers WebDAV, and serves files with sane MIME type instead of forcing you to download them. You can use MyDrive as your HTTPS web host, as well as the remote storage for KeePass.

BrowsePass can read a dropped in local database file as well as a remote database file. In the second case, cross origin policy might prevent the loading of remote file, unless the remote server has enabled Cross Origin Resource Sharing (CORS).

In summary, here're the steps to set BrowsePass up for read, with KeePass for write.

  1. Register an account with MyDrive.
  2. Create a database with KeePass.
  3. Upload your database to MyDrive. Let's say you have uploaded it as personal.kdbx.
  4. In KeePass, open URL https://webdav.mydrive.ch/personal.kdbx. From now on, whenever you save, your file on MyDrive will be updated.
  5. Download latest version of BrowsePass.
  6. Unpack and upload all the files to MyDrive.
  7. Browse to https://webdav.mydrive.ch/browsepass.html.
  8. You can either drag and drop a local KeePass database file to the second box, or type in an URL to your database in the first box. The URL can be either relative such as personal.kdbx or an absolute one such as https://webdav.mydrive.ch/personal.kdbx.

Here are some mandatory screenshots. I hope you'll like it.

12 comments:

  1. Hey! Nice one. Wish I could find the time to integrate this into Kwallet.

    ReplyDelete
  2. Nice!
    In the best of worlds it would be possible to load the password database from a dropbox url and a keyfile from the local computer.

    ReplyDelete
  3. Will this be made available online at some point? Or will people always have to find their own hosting solutions?

    ReplyDelete
  4. I'm trying to use this but always get the error: "Cannot open KeePass database: XML data is not valid" What gives?

    ReplyDelete
  5. Hey @Steven Glick, it is best that people find their own host. I can put this up online but would you trust ME, or MY hosting provider?

    @Anonymous: if you can pass me a simple test, I'd be glad to look into fixing it. Btw, please make sure you use latest version of Chrome or Firefox.

    ReplyDelete
  6. Nam anyway you can help me out going crazy can't get the db to connect using a chromebook and mydrive i still see the x icon on the lock

    ReplyDelete
  7. Can you add support for key files, thats the only thing that this is missing from being perfect.

    ReplyDelete
  8. Hi, nice work. I was getting error, "start bytes do not match" (kdbx.js). By commenting out the assert statement, page and kdbx loaded and could view no problems. Any comment why it now works/what problem this might indicate? thanks

    ReplyDelete
  9. i did everything according to the instruction you put up above. but when i go to https://webdav.mydrive.ch/browsepass.html from chrome and hit enter nothing in the browser shows up its blank. i dont what i did wrong. but if i try from firefox after hitting enter a pop up shows up asking for mydrive credentials. after inputting credentials it logs in to mydrive and the browser shows the same image like you put above with two box for kdbx location and keepass masterpassword. i got all excited but after inputting the kdbx database on the top box as you say like https://webdav.mydrive.ch/mypassdatabase.kdbx and also tried mypassdatabase.kdbx alone and the 2nd box with my master keepass password. but when i hit the load button nothing happens. what did i do wrong. please help me. i spent all day setting up very carefully according to your instruction. help or atlest put up some support or nobody going to use it.

    ReplyDelete
  10. @Damon "start bytes do not match" indicates the decryption process fails. It is usually caused by wrong password. I would be very interested to see a test case. Please file a bug at https://bitbucket.org/namn/browsepass/issues if you have time.

    @ashim bug reports are very welcome at https://bitbucket.org/namn/browsepass/issues. There is also a Chrome app. You don't need to go through the setup process anymore.

    ReplyDelete
  11. My comment isn't showing up, for some reason!
    Basically, The link https://webdav.mydrive.ch/browsepass.html.is bringing up a user name and password field. If I enter my credentials, it gives an error.

    I'd appreciate the help!

    ReplyDelete
  12. Why do you even need a hosting provider? I can load it right off my flashdrive where I keep the kdbx file.

    ReplyDelete