There isn't an automated update server. KeePass can't auto-update. The web server has a text file on it that contains the version number of the latest release.

There isn't an automated update server. KeePass can't auto-update. The web server has a text file on it that contains the version number of the latest release. KeePass (optionally) checks that file to see if a new version is available and displays a notification to the user. Downloads and installation of new versions has to be done manually by the user. The binaries are hosted on SourceForge and other mirror sites, and in my cursory checking those are serving the file over HTTPS. The binaries are digitally signed. So any possible attack against KeePass would as most cause the notification dialog to appear saying there's a new version. anyway, the author found a solution by signing the text file that the update checker looks at. IMO, that's a superior solution to HTTPS. He's posted a statement on the KeePass website. http://keepass.info/help/kb/sec_issues.html#updsig http://keepass.info/help/kb/sec_issues.html#updsig