KDBX Security Compatibility

KeePassGO supports the following KDBX security workflows today:

open and save password-only vaults
open and save key-file-only vaults
open and save composite password-plus-key-file vaults
select the active master-key mode in the product UI for create, open, and unlock flows
change an existing session to a new master-key mode before saving
preserve the original opened vault's KDBX format version during save
preserve the original opened vault's cipher selection during save
preserve the original opened vault's KDF selection during save
choose the cipher family for new vault creation
choose the KDF family for new vault creation
change the cipher family and KDF family for an existing unlocked session before the next save

What "preserve" means:

if a vault is opened through a managed session and then saved, KeePassGO reuses the opened vault's KDBX header configuration instead of replacing it with default header settings
this applies to local and WebDAV-backed vault sessions

Current explicit limitations:

KeePassGO currently exposes major cipher/KDF family choices, not every low-level tuning parameter from KeePass
advanced KDF tuning such as custom Argon2 memory/parallelism and AES-KDF round-count editing is not yet a product-facing control
unsupported or unknown header fields outside the preserved header structures are not guaranteed to round-trip if they are not represented by the underlying library

Practical expectation:

existing KeePass/KeePass2Android-compatible vaults keep their major format, cipher, and KDF family when edited and saved through KeePassGO
KeePassGO now lets a user select the major cipher/KDF family, while still avoiding a full low-level database-header editor