As of version 19.1.1, the Windows client offers two new options for encrypting databases: the encryption mode AES / GCM and the key derivation function (KDF) Argon2id. New databases use AES-GCM by default. Both increase security – but they have consequences if you also want to open the database with the mobile apps or with older program versions.
Where to find the options
New database: When you create a database, the Security Settings window opens after you choose the protection method. There, under Algorithm / Mode, you choose between AES / GCM (recommended for new databases) and AES / CBC (older method, provided for compatibility), and under KDF algorithm between PBKDF2-HMAC-SHA1 and Argon2id.
Existing database: Open Database → Properties → General tab and click Change next to "Protected by". After confirming the current protection (Current protection window), you reach the same Security Settings.
Default values: PBKDF2 with 600,000 iterations; Argon2id with 65,536 KB of memory, 3 iterations (time cost), and parallelism 4.
What to consider with mobile apps and older versions
AES-GCM: Databases encrypted with AES-GCM cannot be opened with Password Depot 19.1.0 or earlier. Make sure that a newer version is installed on all devices that use the database.
Mobile apps (Android/iOS): The mobile apps will only be able to open databases using Argon2id or AES-GCM once they have caught up via app updates. If the database is also needed on a smartphone or tablet (e.g. via cloud synchronization), choose PBKDF2-HMAC-SHA1 and AES / CBC until then.
Existing databases remain readable: AES/CBC and PBKDF2 remain fully supported. Your existing databases are not converted automatically when you update to version 19.1.1 – a conversion only happens manually via the path described above, and it can be reverted there as well.
Recommendation
Database used exclusively on the Windows PC (version 19.1.1 or later): AES / GCM + Argon2id.
Database also used on mobile devices or with older versions: keep AES / CBC + PBKDF2 for now and switch only after the corresponding app updates.
Note: Before converting, check on which devices the database is opened. A database that has already been converted to AES-GCM can only be opened on a device with an older version again once you set it back to AES/CBC on the Windows client (or the device has been updated).
Related topics: