# Desktop Applications

<figure><img src="https://4290574019-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LO5CAzpxoaEquZJBpYz%2Fuploads%2Fw8H4mwi4TqpBPtFUZooi%2FDesktop%20Applications.jpg?alt=media&#x26;token=98a27840-8aec-49f2-8dff-6b48bd289ffc" alt=""><figcaption></figcaption></figure>

## Overview

Keeper offers users two different desktop vaults.  The [Keeper Web Vault](#keeper-web-vault) in the web browser, and the native [Keeper Desktop](#keeper-desktop) application for Windows, Mac and Linux.

### **Benefits of Keeper Desktop App vs. Web Vault**

The Keeper Desktop App has several benefits compared to the Keeper Web Vault such as:

* Ability to Autofill and auto-type passwords into native apps using [KeeperFill for Apps](https://docs.keeper.io/user-guides/keeperfill-for-apps) feature
* Ability to automatically import existing passwords without additional component installation
* Automatically migrate from existing LastPass vaults
* Secure biometric login using Touch ID on compatible MacBook Pro computers
* Secure biometric login using Windows Hello
* Windows Hello for Business, including biometrics and smart card capabilities
* Increased performance
* Offline access using biometrics or master password (if permitted by Keeper Admin)

## Keeper Desktop Deployment

Keeper Desktop is a cross-platform native desktop application for Windows, MacOS and Linux. Several installer files are provided at the links below. For additional details on each package, see the [Additional Deployment Details](#additional-deployment-details) section below.

### Installer Options

* **Windows AppInstaller (64 and 32-bit, supports Windows Hello)**\
  **Auto-Updates: Yes**\
  [Install Link](https://www.keepersecurity.com/desktop_electron/packages/KeeperPasswordManager.appinstaller)\
  \
  Command-line deployment:

  ```
  Add-AppxPackage -AppInstallerFile .\KeeperPasswordManager.appinstaller
  ```

* **Microsoft Store Version (64 and 32-bit, supports Windows Hello)**\
  **Auto-Updates: Yes**\
  [Microsoft Store Link](https://apps.microsoft.com/detail/keeper-password-manager/9N040SRQ0S8C?hl=en-us\&gl=US)<br>

  Command-line deployment:

  <pre data-overflow="wrap"><code>winget install 9N040SRQ0S8C --accept-package-agreements --accept-source-agreements
  </code></pre>

* **Windows 11 MSIX Installer:**\
  **Auto-Updates: No**\
  [MSIX Installer Link](https://www.keepersecurity.com/desktop_electron/packages/KeeperPasswordManager.msixbundle)\
  \
  Command-line deployment:

  ```
  Add-AppxPackage -Path .\KeeperPasswordManager.msixbundle
  ```

* **Windows 11 MSI Installer:**\
  **Auto-Updates: No**\
  **Windows Hello: No**\
  [MSI Installer Link](https://www.keepersecurity.com/desktop_electron/Win32/KeeperSetup32.msi)<br>

  Command-line deployment:

  ```
  msiexec.exe /i KeeperSetup32.msi /qn
  ```

* **Mac OS .dmg**\
  [Install Link (.dmg)](https://www.keepersecurity.com/desktop_electron/Darwin/KeeperSetup.dmg)<br>

* **Mac App Store**\
  [Mac App Store Link](https://apps.apple.com/us/app/keeper-password-manager/id414781829?mt=12)<br>

* **Linux Fedora, Red Hat, CentOS, Debian, Ubuntu and Linux Mint**\
  **Auto-Updates: Yes**\
  [Download Page Link](https://www.keepersecurity.com/download.html)<br>

* **Snap Store for Linux:**\
  <https://snapcraft.io/keepersecurity><br>

* **Password Importer Standalone (Windows 11):**\
  **Auto-Updates: No**\
  [Install Link](https://keepersecurity.com/pwd_importer/win32/Win32/keeperimport.exe) (32-bit .exe)\
  [Install Link](https://keepersecurity.com/pwd_importer/win32/x64/keeperimport.exe) (64-bit .exe)\
  \
  **NOTE:** The Password Importer may need to be allowed by your endpoint security product, since it is designed to extract passwords from your Chrome and Edge browsers.<br>

* **Password Importer Standalone (macOS):**\
  **Auto-Updates: No**\
  [Install Link](https://keepersecurity.com/pwd_importer/Darwin/KeeperImport.zip)

## **Additional Deployment Details**

### **Microsoft Windows App Installer Distribution**

* **Installer:** [Install Link](https://www.keepersecurity.com/desktop_electron/packages/KeeperPasswordManager.appinstaller)
* **Supported Platforms**: Windows 10, Windows 11
* **Supported Architectures**: x64, ia32
* **Install Location**: %programfiles%\WindowsApps\KeeperPasswordManager\_\*
* **Data Location:** %localappdata%\Packages\KeeperSecurityInc.KeeperPasswordManager\_xxx
* **Auto-Updates**: Yes
* **Windows Hello**: Yes

The appinstaller is just a lightweight wrapper around the msixbundle that enables auto-update functionality, which is checked on app launch. Due to including the auto-update feature, the appinstaller requires Windows 10 version 1803 and newer.&#x20;

Users download a small appinstaller file that automatically fetches the msixbundle from:\
<https://keepersecurity.com/desktop_electron/packages/KeeperPasswordManager.msixbundle>. \
It otherwise behaves the same as the MSIX install.

The appinstaller can be deployed with PowerShell like this:

```
Add-AppxPackage -AppInstallerFile .\KeeperPasswordManager.appinstaller
```

The contents of the `KeeperPasswordManager.appinstaller` file is below:

{% code overflow="wrap" %}

```
<?xml version="1.0" encoding="utf-8"?>
<AppInstaller xmlns="http://schemas.microsoft.com/appx/appinstaller/2017/2" Version="16.6.0.0"
    Uri="https://keepersecurity.com/desktop_electron/packages/KeeperPasswordManager.appinstaller">
    <MainBundle Name="KeeperSecurityInc.KeeperPasswordManager"
        Publisher="CN=Keeper Security Inc., O=Keeper Security Inc., L=Chicago, S=Illinois, C=US" Version="16.6.0.0"
        Uri="https://keepersecurity.com/desktop_electron/packages/KeeperPasswordManager.msixbundle" />
    <UpdateSettings>
        <OnLaunch HoursBetweenUpdateChecks="0" />
    </UpdateSettings>
</AppInstaller>
```

{% endcode %}

***

### **Microsoft Windows .MSIX Distributions**

* **Install Link:** [MSIX Installer Link](https://www.keepersecurity.com/desktop_electron/packages/KeeperPasswordManager.msixbundle)
* **Supported Platforms**: Windows 10, Windows 11
* **Supported Architectures**: x64, ia32
* **Install Location**: %programfiles%\WindowsApps\KeeperPasswordManager\_\*
* **Data Location**: %appdata%\Keeper Password Manager\IndexedDB
* **Auto-Updates**: No
* **Windows Hello**: Yes

The msixbundle file is an appx bundle containing multiple architectures, currently x86 and x86\_64 are supported. The asset requires at least Windows 10 version 1703 to install, and installs to C:\Program Files\WindowsApps with a package identity which enables additional features such as Windows Hello. The installed app is owned by TrustedInstaller.

Command-line deployment:

```
Add-AppxPackage -Path .\KeeperPasswordManager.msixbundle
```

***

### **Microsoft Windows .MSI Distributions**

* **Install Link:** [MSI Installer Link](https://www.keepersecurity.com/desktop_electron/Win32/KeeperSetup32.msi)
* **Supported Platforms**: Windows 10, Windows 11
* **Supported Architectures**: x64, ia32
* **Install Location**: %programfiles%\keeperpasswordmanager
* **Data Location**: %appdata%\Keeper Password Manager\IndexedDB
* **Auto-Updates**: No
* **Windows Hello**: No

The MSI installer does not auto-update. This is to satisfy enterprise administrators who require complete control over application updates.

The MSI installer is 32-bit, and it has the best compatibility with older versions of Windows.

The MSI installer does not support Windows Hello.

The MSI can be silently installed from an elevated command prompt (otherwise it will silently fail at the unanswered Windows UAC prompt that never happens because it's a silent install) in this way:

```
msiexec.exe /i KeeperSetup32.msi /qn
```

The MSI installer does not allow selecting the installation location to mitigate a security weakness whereby an administrator can install the application in a location, such as `C:\` where non-privileged users have access to modify or replace the binary. Instead, the MSI installer always installs to `%programfiles%`.

The Keeper .MSI installer utilizes Microsoft Msiexec.  Standard switches are documented here:\
<https://docs.microsoft.com/en-us/windows/desktop/msi/standard-installer-command-line-options>

***

### Windows Store

* **Install Link:** [Microsoft Store Link](https://apps.microsoft.com/detail/keeper-password-manager/9N040SRQ0S8C?hl=en-us\&gl=US)
* **Supported Platforms**: Windows 10, Windows 11
* **Supported Architectures**: x64, ia32
* **Install Location**: %programfiles%\WindowsApps\KeeperPasswordManager\_\*
* **Auto-Updates**: Yes (via Microsoft Store)
* **Windows Hello**: Yes

The Windows Store build is almost identical to the normal msixbundle, but has a different app identity which is assigned by the Microsoft Store. Updates are managed by the Microsoft Store, and the app is also installed to `C:\Program Files\WindowsApps` and is owned by TrustedInstaller.

The desktop app is able to be installed silently from the Microsoft Store using Microsoft's package manager `winget`:

```
winget install 9N040SRQ0S8C --accept-package-agreements
```

***

### **Intune**

Businesses may push the Microsoft Store app to Intune using an Intune Connector setup to use the Microsoft Store For Business ([businessstore.microsoft.com](http://businessstore.microsoft.com/)), which is different than the consumer Microsoft Store ([apps.microsoft.com](http://apps.microsoft.com/)), which some companies block. Companies are given the option to publish two different types of apps, an "offline" (which wont update automatically via the store) and an "online" (should update via the store) version. The “online” version will update the app in Company Portal as well, so every time a user installs it from Company Portal, it’s the newest version.

***

## **Keeper Desktop for Mac**

**Minimum Requirements:**

Mac OS 10.10+ with Intel or Apple M1 ARM-based processor, 64-bit. 512MB RAM. Keeper Desktop for Mac contains a universal installer which is optimized for both chipsets.

**Auto-Updates**: Yes

**Download Link:**

* [Keeper for Mac](https://keepersecurity.com/desktop_electron/Darwin/KeeperSetup.dmg) (.dmg)
* [Mac App Store](https://apps.apple.com/us/app/keeper-password-manager/id414781829?mt=12)

***

## **Keeper Desktop for Linux**

#### **Minimum Requirements:**

Fedora 28 or above\
Ubuntu LTS releases 16.04 or above \
Red Hat Enterprise Linux 7.0 or above \
CentOS version 7.3 and above \
Debian 8 and above\
Hardware: 512MB RAM

**Auto-Updates**: No

#### Download Links:

* Snap Store: <https://snapcraft.io/keepersecurity>
* Keeper for Linux - [Fedora, Red Hat and CentOS](https://keepersecurity.com/download.html)
* Keeper for Linux - [Debian, Ubuntu and Linux Mint](https://keepersecurity.com/download.html)

## Checksum / Hash

For file verification, Keeper Desktop SHA1 hashes are computed based on the most recent version and can be retrieved at the below URL:\
<https://keepersecurity.com/desktop_electron/SHASUM256.txt>

## Enterprise Configuration

Keeper supports Enterprise Configuration settings to control the end-user experience.

### Configuration Options

<table><thead><tr><th>Key</th><th width="150">Type</th><th>Description</th></tr></thead><tbody><tr><td>DomainName</td><td>String</td><td>Enterprise SSO Domain to pre-populate on app launch.</td></tr><tr><td>Region</td><td>String</td><td>Region identifier where your Keeper tenant is hosted. Must be one of ("us", "eu", "au", "usg")</td></tr><tr><td>HideCreateAccount</td><td>Boolean</td><td>Hides the Create Account button from the start page</td></tr><tr><td>UseDefaultBrowserForSSO</td><td>Boolean</td><td>Routes the user to their default web browser for SSO authentication instead of using a popup window.</td></tr></tbody></table>

### macOS User Defaults

Keeper Desktop can be configured using standard macOS `NSUserDefaults` objects using the `com.keepersecurity.passwordmanager` domain. If your MDM solution is able to push macOS user defaults, you can use this method for enforcing configuration settings. Note the capital letter on the key value.

**Testing the Config**

You can test the configuration on the local machine using the below commands:

```
defaults write com.keepersecurity.passwordmanager <key> <value>
```

For example:

```
defaults write com.keepersecurity.passwordmanager \
    DomainName mycompany.co.uk

defaults write com.keepersecurity.passwordmanager \
    Region eu
    
defaults write com.keepersecurity.passwordmanager \
    HideCreateAccount -bool true
    
defaults write com.keepersecurity.passwordmanager \
    UseDefaultBrowserForSSO -bool true
```

### macOS - Information Property List File

Keeper Desktop's mac app bundle has an Information Property List File, `Info.plist`, which contains key-value pairs that identify and configure a bundle.&#x20;

**Finding the App Bundle ID and App Version**

The following keys in Information Property List file contains the values for the App Bundle ID and App Version:

`CFBundleIdentifier: App Bundle ID`

`CFBundleShortVersionString: App Version`&#x20;

To find the values of the above keys, you need to access the Information Property List File, `Info.plist`, and find the corresponding values.&#x20;

Location of `Info.plist` after mounting DMG file:

```
<app_name>.app/Contents/Info.plist file
```

Alternatively, you can run the `defaults read` command:

```
defaults read /Applications/<app_name>.app/Contents/Info.plist <key>
```

For the Keeper Desktop App, running the following commands would give you the App Bundle ID and Version:

{% code overflow="wrap" %}

```
defaults read /Applications/Keeper\ Password\ Manager.app/Contents/Info.plist CFBundleIdentifier
com.keepersecurity.passwordmanager

defaults read /Applications/Keeper\ Password\ Manager.app/Contents/Info.plist CFBundleShortVersionString
16.8.9
```

{% endcode %}

### JSON Configuration File

All Windows, macOS and Linux end-user installations can be configured by using a UTF-8 encoded JSON file placed in the user's home folder under "`.keeper/desktop.config.json`". Note the identifiers are using camel case for JSON defaults with a lowercase on the first letter.

**Example File**

{% code overflow="wrap" %}

```json
{ "domainName": "MyCompany.com", "region": "us", "hideCreateAccount" : true, "useDefaultBrowserForSSO" : true }
```

{% endcode %}

**macOS End Users**

Alternatively, for macOS end-users, Keeper Desktop can be configured using the standard macOS `NSUserDefaults`. Visit the following [section](#macos-user-defaults) for more information.&#x20;

{% hint style="warning" %}
**The desktop.config.json file must be UTF-8 encoded.**

From your text editor, in File > Save As...

* In the "Save as type" drop-down, select **All Files.**
* In the "Encoding" drop-down, select **UTF-8.**
* Ensure the name of the file is **desktop.config.json**
  {% endhint %}

## Domain Routing Rules

Note that Keeper can automatically route your users to the proper enterprise tenant, SSO provider and data center based on the email domain that they type into the Keeper login form. If you are using SSO, make sure that the "Just In Time Provisioning" option is enabled in the SSO configuration. Also, ensure that your domain is [reserved](https://docs.keeper.io/en/enterprise-guide/domain-reservation), which means that typing anything @ yourcompany.com will get routed to the proper region.

If the routing of user to the proper region and SSO is not working correctly for you, please open a support ticket.
