Add Databases

To create a new database, proceed as follows:

  • Open the Home section by clicking on Home.
  • Click New database.
  • Name the new database. 
  • Choose the storage location from the drop-down menu. By default, Local system is pre-selected. Use + New to add a further storage location, if it is not yet listed in the drop-down menu:
    • Internet Server (FTP / WebDAV / HTTP)
    • Dropbox
    • Google Drive
    • Microsoft OneDrive
    • Microsoft OneDrive for Business
    • Box Cloud
    • HiDrive Cloud
  • Click on Next >, to proceed with the creation of the database. 
  • Protection Method: Choose a master password, a master password and a key file or only a key file.
    • When choosing an authentication method that uses a master password, enter a desired master password or generate one with the master password generator by clicking the star symbol. Re-enter the master password. Its quality will be displayed below. Enter a hint for your master password, if desired. Additionally, you can check if your master password is found in Pwned databases, which contain credentials that are known to have been breached.
    • When choosing an authentication method that uses a key file, you can either search for an existing key file by clicking the folder symbol or generate a new key file by clicking the star symbol.
  • Security Settings: After choosing the authentication method, the window Security Settings opens. Here you can define the encryption algorithm as well as the key derivation function (KDF) and its parameters.

    Under Algorithm / Mode, you can choose from the following options via the drop-down menu:

    • AES / GCM (recommended for new databases): AES in Galois/Counter Mode is a modern encryption method that provides both data confidentiality and integrity in a single step. New databases use AES-GCM by default.
    • AES / CBC (deprecated algorithm): AES in Cipher Block Chaining Mode is the older encryption method used in earlier versions of Password Depot. This option is available for compatibility with existing databases.

    NOTE: Databases encrypted with AES-GCM cannot be opened with Password Depot 19.1.0 or earlier. Make sure that all devices on which this database is to be used have a newer version of Password Depot installed.

    A key derivation function (KDF) is a technical protection mechanism that derives the actual encryption key for your database from your master password. This process is intentionally designed to be computationally expensive so that attackers cannot quickly try out master passwords in an automated manner – an approach known as a brute-force attack. The more demanding the key derivation, the better your database is protected against such attacks.

    Under KDF algorithm, you can choose from the following options via the drop-down menu:

    • PBKDF2-HMAC-SHA1: An established and widely used algorithm for key derivation. If this option is selected, the following field appears:
      • Iterations: Indicates how often the calculation is performed to derive the key. The higher the value, the longer the calculation takes – both for you when opening the database and for potential attackers. The default value is 600,000 iterations, which is also the currently recommended minimum.
    • Argon2id: A modern algorithm that is today considered the industry standard for key derivation. In addition to computational effort, it also requires working memory, which makes attacks with specialized hardware such as GPUs significantly harder. If this option is selected, the following fields appear:
      • Memory (KB): Defines how much working memory is used for the calculation. A higher value improves protection against brute-force attacks using specialized hardware. The default is 65,536 KB; recommended is 65,536 KB (64 MB) or higher.
      • Iterations (time cost): Defines how often the calculation is performed. The higher the value, the longer the calculation takes – both for you when opening the database and for potential attackers. The default value is 3, which corresponds to the recommended minimum.
      • Parallelism: Specifies the number of parallel lanes (threads) used for the calculation. Lanes are independent computation paths that can be processed simultaneously; the value typically corresponds to the number of available CPU cores. The default value is 4, which is a typical value.

    Click the Benchmark button to the right of the drop-down menu to test how long the key derivation takes on your device with the currently selected parameters. The measured duration is then displayed in seconds, along with an assessment of whether the chosen parameters offer a good balance between security and usability or whether an adjustment would be advisable. This way, you can optimally tune the settings to your device and your requirements.

    Use the Back, Next, and Cancel buttons at the bottom of the window to return to the previous step, proceed with the chosen settings, or cancel the process.

  • Lastly, you are able to enter any Comments or Decryption hints to the database description which may help you remember your master password if it may have been forgotten. 
  • Click on Finish to finalize the creation of the database. 

WARNING: If you forget your master password and have not entered a hint that might help you, there is no way to access your database!

NOTE: In general, we do not recommend using only a key file for authentication. If you only use a key file to authenticate, always be sure to keep it in a secure location. Otherwise, anyone who has access to your key file will have access to your database.