Placeholders KeePass supports various placeholders.

In many places in KeePass (auto-type, URL field, triggers, ...), placeholders can be used.

• Entry Field Placeholders
• Entry Field References
• Paths and Date/Time Placeholders
• Environment Variables
• Text Transformations
• Other Placeholders

KeePass uses the abbreviation "Spr" for "String placeholder replacement". An Spr-compiled field is a field where placeholders are replaced when performing an action with this field (like copying it to the clipboard, sending it using auto-type, etc.).

References in a field to (parts of) the field itself are unsupported. For example, the {URL:HOST} placeholder cannot be used in the URL field (but it can be used in the 'Override URL' field).

Entry Field Placeholders

Entry Field References

Fields of other entries can be inserted using Field References.

Paths and Date/Time Placeholders

Environment Variables

System environment variables are supported. The name of the variable must be enclosed in '%' characters. For example %TEMP% is replaced by the user's temporary path.

Text Transformations

• Upper or U:
  Upper-case.
• Lower or L:
  Lower-case.
  Example. Let the user name of an entry be 'Bob' and the URL 'https://example.com/?user={T-CONV:/{USERNAME}/L/}'. When running the URL, KeePass opens 'https://example.com/?user=bob'.
• Base64:
  The Base64 encoding of the UTF-8 representation of the text.
• Hex:
  The Hex encoding of the UTF-8 representation of the text.
• Uri:
  The URI-escaped representation of the text.
• Uri-Dec:
  The URI-unescaped representation of the text.
• Raw:
  Spr-compiles Text without encoding the result for the current context.
  Example. Let the user name of an entry be '+'. The auto-type sequence '{USERNAME}a' results in the text '+a', whereas the auto-type sequence '{T-CONV:/{USERNAME}/Raw/}a' results in the text 'A' (because this placeholder inserts '+' into the auto-type sequence without encoding it, and '+a' means to press Shift+A, which results in the text 'A').

Other Placeholders

• ID: Specifies an alphanumeric ID for the placeholder (see below).
• C or Count: Specifies the number of characters to pick from the string. When enough characters have been picked, the dialog closes automatically (i.e. you don't need to manually click [OK] anymore).
• Hide: If set to False, the picked characters in the dialog are shown as plain text by default, i.e. not hidden by asterisks. By default, KeePass uses the hiding setting of passwords in the main window.
• Conv: Specifies how to convert the picked characters. When this parameter is omitted, no conversion is performed, i.e. the selected characters are auto-typed directly. The option supports the following values:
  • D: Convert the picked characters to down arrow keypresses; e.g. '2', 'c' and 'C' are converted to 2 down arrow keypresses.
    
    A fixed number of down arrow keypresses can be added by specifying them using the Conv-Offset option. For example, if you specify Conv=D, Conv-Offset=1, then '2', 'c' and 'C' are converted to 3 down arrow keypresses.
    
    By using the Conv-Fmt option, you can specify the layout of comboboxes. By default, KeePass assumes a combobox containing values from 0 to 9 or from A to Z. If the combobox contains values 0-9A-Z (i.e. first all ten digits, immediately followed by all characters from A to Z), specify Conv=D, Conv-Fmt=0A. Similarly, if it contains values A-Z0-9, specify Conv=D, Conv-Fmt=A0. If digits start with 1 instead of 0 (i.e. the 0 appears after the 9), use 1A and A1 instead of 0A and A0. If the combobox contains values 0-9A-Za-z (i.e. case-sensitive characters), specify 0Aa. All combinations of '0', 'A', 'a' and '?' are supported. If 'A' and 'a' are not specified both, characters are treated as case-insensitive. '?' skips a combobox item.

• ~: When specifying '~' as name of the profile (i.e. when using the placeholder {NEWPASSWORD:/~/}), KeePass derives a profile from the current entry password. Not recommended, as the quality can degrade.
• #: When specifying '#' as name of the profile, you can specify two additional parameters: a pattern and an option.
  • R: Specifies whether to rearrange/permute the characters of the generated password randomly.
    The default value is 0.
    • 0: Do not rearrange.
    • 1: Rearrange.
  Examples:
  • {NEWPASSWORD:/#/H\2\-HH\-HH\-HH\-HH\-HH/}
    generates a MAC address.
  • {NEWPASSWORD:/#/uldA{17}/R=1/}
    generates an alphanumeric password of length 20 that contains at least one upper-case letter, at least one lower-case letter and at least one digit (at random positions).

The parameters for the OTP generation are stored as entry strings and can be edited conveniently using the 'OTP Generator Settings' dialog (which checks the entered values, shows a preview, etc.). Alternatively, you can edit the entry strings directly, as documented below.

{HMACOTP} – Generating HMAC-Based One-Time Passwords:
The {HMACOTP} placeholder generates an HMAC-based one-time password (HOTP) according to RFC 4226.

The shared secret and other parameters can be specified using the following entry string fields (which can be added/edited in the entry dialog on the 'Advanced' tab page):

• HmacOtp-Secret
  HmacOtp-Secret-Hex
  HmacOtp-Secret-Base32
  HmacOtp-Secret-Base64
  Exactly one of these fields must be present, and its value must be set to the shared secret in the corresponding encoding. In the first case ('HmacOtp-Secret'), the UTF-8 encoding of the value is used as shared secret.
• HmacOtp-Counter (automatic)
  This field stores the counter value in decimal representation. The default value is 0. When the {HMACOTP} placeholder is replaced (i.e. when generating a one-time password), KeePass updates the counter value automatically.

{TIMEOTP} – Generating Time-Based One-Time Passwords:
The {TIMEOTP} placeholder generates a time-based one-time password (TOTP) according to RFC 6238.

The shared secret and other parameters can be specified using the following entry string fields (which can be added/edited in the entry dialog on the 'Advanced' tab page):

• TimeOtp-Secret
  TimeOtp-Secret-Hex
  TimeOtp-Secret-Base32 (most common)
  TimeOtp-Secret-Base64
  Exactly one of these fields must be present, and its value must be set to the shared secret in the corresponding encoding. In the first case ('TimeOtp-Secret'), the UTF-8 encoding of the value is used as shared secret. Most services use the Base32 encoding.
• TimeOtp-Length (optional)
  Specifies the length of the generated one-time password. The default value is 6; the maximum is 8.
• TimeOtp-Period (optional)
  Specifies the time-step size in seconds. The default value is 30.
• TimeOtp-Algorithm (optional)
  Specifies the cryptographic algorithm used for the generation of the one-time password. The following algorithms are supported:
  • HMAC-SHA-1
  • HMAC-SHA-256
  • HMAC-SHA-512
  The default value is HMAC-SHA-1.

The date and the time of your system must be correct, otherwise the service/server may reject the generated OTP.

Usage example. Create a new entry and change its default auto-type sequence to {USERNAME}{TAB}{PASSWORD}{ENTER}{DELAY 3000}{HMACOTP}{ENTER}. Open the 'OTP Generator Settings' dialog, set the shared secret for HMAC-based OTPs to '12345678901234567890' and select the UTF-8 encoding. When performing auto-type, KeePass sends the user name, presses Tab, sends the password, presses Enter, waits 3 seconds, generates and sends a HMAC-based OTP and finally presses Enter again. The counter value for the OTP generation is updated automatically. With the shared secret above and initial counter value 0, the following OTPs are generated: 755224, 287082, 359152, 969429, 338314, ... (more generated OTPs can be found in the example in RFC 4226).

• M: Specifies the method for running/opening the executable/document.
  The default value is S.
  • S: Use the system shell (via ShellExecute). With this, executable files are executed and documents are opened using their associated applications. However, no standard input/output is supported.
  • C: Run an executable file (EXE or COM, via CreateProcess); documents are not supported. Standard input/output is supported.
• O: Specifies what to do with the standard output of the executed application.
  The default value is 1.
  • 0: Ignore the standard output. The placeholder is replaced by an empty string.
  • 1: Replace the placeholder by the standard output.
• W: Specifies whether to wait for the termination of the executed application.
  The default value is 1.
  • 0: Do not wait.
  • 1: Wait.
• WS: Specifies the window style. Not all applications support this option.
  The default value is N.
  • N: Normal.
  • H: Hidden.
  • Min: Minimized.
  • Max: Maximized.
• V: Specifies the verb (action to be performed), e.g. 'Open' or 'Print'. When using the verb 'RunAs', the application is executed with administrative rights (this may require a confirmation via the UAC dialog).

New-line characters at the end of the output are removed (analogous to '$(...)' and '`...`' shell command substitutions).

• {CMD:/Notepad.exe/W=0/}
  Runs Notepad and continues immediately.
• {CMD:/PowerShell.exe -Command "(Get-FileHash '%SYSTEMROOT%\Win.ini' -Algorithm SHA256).Hash"/M=C,WS=H/}
  The placeholder is replaced by the SHA-256 hash of Windows' Win.ini file.