If you miss
Trezor Password Manager (I used it a lot), you can still use your Trezor as a second authentication factor (with or without a master password) in KeePass through this
plugin. In short, your Trezor will function as a key file.
When you set up a database to open with a Trezor, it becomes associated with the device's current recovery phrase at the time of encryption. This means if you have more than one Trezor device (T1, TT, TS3 and TS5), as long as you restore your second device with the same seed phrase as your primary device, you can also use it as a backup device to access the database configured with Trezor.
You can configure an existing or new database to open as a Trezor key file, as you prefer.
I tested this plugin last year without any issues. On the plugin's github, there's a GIF in the readme showing how it works:
https://github.com/elebree/KeePass2Trezor
Your database will work the same way as a database using any key file. with the only difference being that you need a trezor device to access the database. As long as you have access to the seed phrase used on the Trezor device to encrypt the .kbdx database with the Trezor, you can restore access using any Trezor device.
The plugin appears to be open source, with some contributions and an organized structure (I'm not an expert at reviewing code, so feel free to share your opinion). It appears to have good long-term support, as soon as Trezor Safe 5 was released, it didn't take a few months for the plugin to add support for it as well.
To name the main disadvantages:1. It's a third-party plugin, even though it's open source, the maintainer can drop support at any time, as it doesn't depend on KeePass (this can be good or bad, depending on your perspective). However, like any other plugin, you need to have a file placed in a specific folder dedicated to Keepass plugins for it to work, so you'll still have access.
2. You need to trust the plugin and rely on its developers. Third-party plugins put many people off because of the degree of trust required.
3. Unfortunately, it only works with
KeePass 2 (the traditional version of Keepass), so your database will be tied to it. It can't be used with Keepass mobile versions like KeepassDX, Keepassium, Strongbox etc. or any other version of Keepass, only Keepass 2.
I currently don't use it because it can only be used with Keepass2, even though I also use Keepass on mobile. It would be great if KeepassXC and other Keepass implementations had similar support, and even better if it were compatible with existing Keepass implementations.
