A strong passphrase should be good enough to deter dictionary attacks, even if your kdbx file is leaked. And even then the ciphers used to encrypt the kdbx fil

A strong passphrase should be good enough to deter dictionary attacks, even if your kdbx file is leaked. And even then the ciphers used to encrypt the kdbx file are highly configurable, you can future-proof the key derivation function as much as your hardware can reasonably afford to unlock the file. Besides using a keyfile for daily use is impractical. For correct usage, you'd have to keep it in a separate drive from your kdbx (in a USB flash perhaps), as you very well mentioned. But then in the menu you'd have to go to the directory the keyfile is stored in every single time you want to unlock your database if am not mistaken about how the feature works on KeepassXC.