ChiPass Ships First Release Since KeePassXC AI Split

ChiPass, a fork of the password manager KeePassXC built to stay free of AI-generated code, shipped release 2026.09.0 on Sept. 11, its first numbered version since splitting off five months earlier. The release is a port to the Qt 6 toolkit, according to the project's Codeberg repository, and reached the Arch Linux package repositories the same day as build 2026.09.0-6, per Arch's package page.

Why the fork exists

The split traces to a KeePassXC policy on generative AI that maintainer Janek Bevendorff published on Nov. 9, 2025. The post, "About KeePassXC's Code Quality Control," says that if the majority of a code submission is produced by an AI agent, the pull request will disclose that fact, and that all submissions, regardless of how they were drafted, go through the same review process the project's five maintainers already run. The policy permits AI-drafted pull requests for "simple and focused tasks" such as boilerplate or minor bug fixes, and explicitly rules out AI involvement in complex work like cryptographic components. Linuxiac reported the team's position days later in blunter terms: "There are no AI features inside KeePassXC and there never will be."

The policy followed a GitHub discussion opened Nov. 7, 2025 by a contributor posting as alsternerd, titled "Just because it's everywhere, generative LLMs are not the solution for security software." The post argued that AI-generated code can obscure attack vectors in ways ordinary review is not built to catch, and that a security tool should hold AI-assisted submissions to a higher bar than human-written ones, not an equal one.

From KeePassχ to ChiPass

A group describing itself as engineers with open-source and information-security backgrounds forked KeePassXC at version 2.7.10, the last release before the policy took effect, and published the result in April 2026 under the name KeePassχ, according to New In Linux, which reported the launch on April 14. One developer, using the name Catherine, announced it on Mastodon with a line that doubled as the project's thesis: a password manager "doesn't need 300 regular contributors armed with 14 LLMs; it just needs to do its job, be stable, and be ported to Qt 6 already." The Codeberg organization was later renamed from keepasschi to ChiPass.

ChiPass on Codeberg	Value
Stars	431
Forks	27
Commits	4,853
Repository size	314 MiB

What actually shipped

Reaction on Lobsters, where the release was posted Sept. 11, was measured rather than triumphant. One commenter said the Qt 6 port made the app "feel so much nicer and more responsive" and follow the system's accent color; another, using the handle nortti, said that for now "it's pretty much a straight port," not yet a codebase that has diverged in substance from the KeePassXC it left. ChiPass is licensed GPL-2.0-only or GPL-3.0-only, the same terms KeePassXC itself uses, and users of the KeePassXC browser extension have to repoint its native-messaging configuration at a ChiPass-proxy binary to keep using it.

The host picked a side too

Codeberg, the nonprofit git host where ChiPass lives, adopted its own platform-wide restriction on what it calls "LLM-extrusions," unreviewed repositories of mostly AI-generated code, in a members' vote on July 23, 2026 that passed 358 to 144, a 71 percent majority. The measure does not bar developers from using AI tools; it targets repositories nobody has meaningfully reviewed or claimed ownership of, the kind that maintainers said were draining shared CI/CD infrastructure. Whether ChiPass draws more contributors now that its host enforces the same standard the fork was built around, or whether it stays what nortti described, a straight port with a different name, is the open question neither KeePassXC's policy nor ChiPass's Codeberg page has settled. GitHub's own decision to keep drafting Copilot pull requests in-house, detailed in its recent token-cost disclosure, sits at the opposite end of that argument, treating AI-authored code as a cost to optimize rather than a trust problem to fence off; the undisclosed RubyGems campaign attributed to OpenAI's agents is the failure mode ChiPass's founders say they are trying to avoid.