There's a couple of dozens of these. All have same passphrase, and there's a slight difference between two successive ones. I keep them in case one day I notice I deleted/edited something I shouldn't have.
So is a group of very similar .kdb files with same passphrase easier to "crack" than just one?
Let us assume that the attacker knows that the passphrase for all the database files are the same. What you have in mind is a two time pad attack, when we have multiple ciphertexts encrypted with the same key.
Fortunately, modern ciphers such as AES which is used by KeePass are designed to be resistant against such attacks. AES is even used to encrypt HTTP packets through SSL/TLS. Each time you browse a website securely, thousands of these packets are encrypted using the same session key, then transmitted. Attackers can easily sniff these packets and they know that all of these packets are all encrypted using the same key, however they are still unable to crack it. This shows that such ciphers are resistant against such attacks.
One example of a cipher that is weak against such an attack is the famous one time pad. Hence the name, you are not supposed to reuse the pad. However, there is no such restriction when dealing with modern ciphers.
it's probably fine, but make sure to regularly delete really old files.
There was a vulnerability in an earlier version of KeePass, which was since patched, but that stored data in an insecure way. This could lead to the passwords up to that version being compromised, while deleting the older ones would have no effect.
KeePass encrypts the passwords, but has some cryptographically weak way of storing the passwords. For example, lets say it does not use randomized encryption. This means that an information leak exists: the attacker could see when accounts were added or removed, by looking at the difference between files (assuming the order of the passwords remains the same).
The KeePass wikipedia page only says that AES or TwoFish can be used as cyphers. These can be considered secure, but the bigger question for the above is how they are used. There are many more potential cryptographic vulnerabilities that could exist (just look at the problems we saw in recent years with SSL/TLS). However, those are likely to be theoretical in nature, and likely to affect both the case where you only have one file, and the case where you have multiple. Thus, unless you're storing extremely sensitive passwords, keeping a few backup files probably doesn't hurt.
Let's assume that Keepass is not 100% secure (a safe assumption since nothing is 100% secure). If an attacker has one copy of your Keepass database, that's all he has to work with.
The earlier copy. Presumably, this will not be easier, but you do not know that.
Now if the attacker also knows when you signed up for Ashley Madison (or Gawker or any other site that has been hacked), the hacker may be able to find the Keepass file created just before and the one just after you signed up, identify the difference, and will have a good idea of the plain text of the difference. That is likely to make breaking the encryption substantially less hard (hopefully still hard enough, but it can still help the attacker a lot).
Not the answer you're looking for? Browse other questions tagged keepass or ask your own question.
Storing KeePass database in cloud. How safe?
Where to save Keepass' file?
Why doesn't KeePass use two factor / one time password generation to protect the database?