OpenKey

Self-hosted password manager. Ciphertext only on the server.

We picked the build that fits your machine — one click and you’re in.

Download Get started

Why OpenKey

Ciphertext only
Argon2id on device. The server never sees your master password or vault key.
Security model
Self-host or Nearby
Sync through your Docker API — or pair devices on LAN with QR, no server required.
Nearby guide
Autofill & passkeys
System Autofill plus a browser extension with fill shortcut and WebAuthn.
Browser extension
Teams still zero-knowledge
Orgs and shares encrypt with keys the server cannot unwrap.
Sharing & orgs

Runs where you do

Android
iOS
macOS
Windows
Linux
Chrome / Firefox
Docker server
CLI

How sync stays zero-knowledge

Derive keys from email + master password with Argon2id
Send only an auth hash to log in
Encrypt names, entries, and attachments before upload
Server stores opaque ciphertext — never the vault key

Start on your own infrastructure

Download the app, point it at your server, or pair Nearby for LAN-only sync.

Download Get started Read the threat model