Skip to content

Import of Keepass v2 XML unhides protected fields and merges them into "Additional Options" #16897

@dbareis

Description

@dbareis

Steps To Reproduce

Import V2 XML exported by Keepass (Windows)

Expected Result

All hidden (protected) data remains protected and all custom fields remain as custom fields. No data lost or transformed.

Actual Result

Some Keepass custom fields (one of them "<Key>SAFE UN-LOCKING instructions<Key>") are not imported as custom fields but are appended to the notes and placed into "Additional Options".

I'm not sure if all of these were previously protected (and now imported as clear text aka unhidden), but all instances I have noticed were protected fields ("<Value ProtectInMemory="True">") .

It appends the key name followed by ":", space, fullstop, newline then the custom field's contents, no separation or any other attempt to make these easy to spot (not even blank lines).

On the website (& "Android app but not the w11 app) the "Additional Options" has a superfluous (and incorrect given the above issues) "Note" label.

Screenshots or Videos

No response

Additional Context

No response

Operating System

Windows

Operating System Version

11

Installation method

Direct Download (from bitwarden.com)

Build Version

Version 2025.9.0 SDK 'main (ab3c7db)' Shell 36.8.1 Renderer 136.0.7103.177 Node 22.18.0 Architecture x64

Issue Tracking Info

  • I understand that work is tracked outside of GitHub. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions