Search - KeePass
Author: Dominik Reichl

| # Search Details about the search functions of KeePass.

- Search Mode 'Simple Expression'
  - Example: Multiple terms
  - Example: Terms with spaces
  - Example: Exclusions (2.x)
- Search Mode 'Regular Expression'
  - Example: Exact term
  - Example: Short passwords
  - Example: Multiple tags (OR, exact)
- Search Mode 'XPath Expression' (2.x)
  - Example: Icon
  - Example: Expired in specific year
  - Example: Custom string field
  - Example: Attached PDF files
  - Example: Background color
  - Example: Multiple tags (AND, exact)
  - Example: History entry count
  - Example: Group notes
- Search Profiles (2.x)
- Quick Search Box

## Search Mode 'Simple Expression'

In this mode, KeePass searches the specified terms in the selected fields. For an entry to match, all terms must match.

- Multiple terms.
  In order to search for multiple terms, separate the terms using spaces. If you want to search for a term containing spaces, enclose the term in double quotes (`"..."`).
- Exclusions (2.x).
  In order to find entries that do not contain a certain term, prepend a minus sign to the term.

An entry matches if the specified terms can be found as substrings. If you want to find exact matches instead, use a regular expression (see the example 'Exact term').

Examples.

Multiple terms
Find what: | `Michael Home`
Options: | ☑ Title
Finds every entry whose title contains both the term 'Michael' and the term 'Home' (in any order).

Terms with spaces
Find what: | `Michael "Web Server"`
Options: | ☑ Title
Finds every entry whose title contains both the term 'Michael' and the term 'Web Server'.

Exclusions (2.x)
Find what: | `Michael -Home`
Options: | ☑ Title
Finds every entry whose title contains the term 'Michael', but not the term 'Home'.

## Search Mode 'Regular Expression'

In this mode, KeePass searches for matches of a regular expression in the selected fields.

Information about regular expressions and tools can be found here:

- Microsoft: Regular Expression Language - Quick Reference
- Wikipedia: Regular expression
- Regex101: Build, test and debug regex

Examples.

Exact term
Find what: | `^Michael$`
Options: | ☑ User name
Finds every entry whose user name is 'Michael' (exactly, i.e. 'Michael' is not only a substring of the entry's user name).

Short passwords
Find what: | `^.{1,10}$`
Options: | ☑ Password
Finds every entry whose password has a length between 1 and 10 (inclusive).
If you want to find weak passwords instead, use the 'Password Quality' command in the 'Find' menu.

Multiple tags (OR, exact)
Find what: | `^(Home|Private)$`
Options: | ☑ Tags
Finds every entry that has the tag 'Home' or the tag 'Private' (or both).

## Search Mode 'XPath Expression' (2.x)

In this mode, a KeePass 2.x XML DOM of the current database is created in memory and the specified XPath expression is used to find entries.

In order to see your database in the KeePass 2.x XML format, you can export it (via 'File' → 'Export') to a 'KeePass XML (2.x)' file.

Information about XPath expressions can be found here:

- W3C: XML Path Language (XPath) 2.0
- Microsoft: XPath Reference
- Microsoft: XPath Examples
- Wikipedia: XPath

If you want to find and replace data using XPath and regular expressions, see the XML Replace feature.

Examples.

Icon
Find what: | `//Entry[(IconID = '3') and not(CustomIconUUID)]`
Finds every entry that has a icon.

Expired in specific year
Find what: | `//Entry/Times[(Expires = 'True') and starts-with(ExpiryTime, '2022-')]/..`
Finds every entry that has expired in 2022.

Custom string field
Find what: | `//Entry/String[(Key = 'Telephone') and contains(Value, '12345')]/..`
Options: | ☑ Other strings
Finds every entry that has a custom string field named 'Telephone' whose value contains '12345'.

Attached PDF files
Find what: | `//Entry/Binary/Key[(string-length(.) >= 4) and (substring(., string-length(.) - 3) = '.pdf')]/../..`
Finds every entry that has a file attachment whose name ends with '.pdf'.
If you want to find large entries instead, use the 'Large Entries' command in the 'Find' menu.

Background color
Find what: | `//Entry[BackgroundColor = '#CCFFCC']`
Finds every entry that has a light green background color.
The standard background colors are light red (`#FFCCCC`), light green (`#CCFFCC`), light blue (`#99CCFF`) and light yellow (`#FFFF99`).

Multiple tags (AND, exact)
Find what: | `//Entry[contains(concat(';', Tags, ';'), ';Home;') and contains(concat(';', Tags, ';'), ';Private;')]`
Options: | ☑ Tags
Finds every entry that has both the tag 'Home' and the tag 'Private'.
In contrast to this, searching with the simple expression '`Home Private`' also finds entries that have 'Home' and 'Private' as substrings in the tags.

History entry count
Find what: | `//Entry[count(History/Entry) >= 4]`
Options: | ☑ History
Finds every entry that has at least 4 history entries.

Group notes
Find what: | `//Group[contains(Notes, 'Private')]/Entry`
Finds every entry whose (direct) parent group contains the word 'Private' in the notes (of the group, not of the entry). If there are multiple such groups, the entries of all these groups are found.

## Search Profiles (2.x)

KeePass can save search parameters as a search profile. This can be useful when you are regularly performing similar searches.

Creating a profile.
In order to save the current search parameters specified in the 'Find' dialog, click the profile creation button. KeePass then shows a dialog where you can enter a name for the new profile.

Overwriting a profile.
Overwriting an existing profile works the same as creating a profile, except that you select an existing profile name in the name dialog.

Using a profile.
There are two ways to load a profile and perform a search with it:

- Open the 'Find' dialog (via the menu 'Find' or ``Ctrl`+`F``), click on the 'Profile' combo box and select the desired profile; this causes KeePass to load the profile. If necessary, adjust the search parameters. Finally, click the 'Find' button.
- In the menu of the main window, click 'Find' → 'Search Profiles'. In this menu, all profiles are listed. For each profile, there are commands to directly perform a search with the profile (commands 'Find ...') and commands to show the profile in the 'Find' dialog (commands 'Open ...').

Deleting a profile.
In order to delete a profile, select it in the 'Find' dialog and click the profile deletion button.

## Quick Search Box

The quick search box in the toolbar of the main window supports simple expression and regular expression searches.

In order to indicate that the search string is a regular expression, enclose it in '`//`'. For example, '`//A{6}//`' finds all entries containing the string 'AAAAAA'. Note that this special syntax does not work in the 'Find' dialog; in this dialog, you need to select the regular expression mode and specify the regular expression as-is, i.e. without enclosing it in '`//`'.

Options.
The 'Find' dialog and the quick search box are independent; options/parameters in the 'Find' dialog do not affect quick searches. Options for quick searches can be found in the options dialog (menu 'Tools' → 'Options' → tab 'Interface').