Welcome to OpenKey
Most password managers ask you to trust a cloud you do not control. OpenKey takes the other path: your vault stays encrypted on the device, an optional sync server stores ciphertext only, and master passwords never leave the client.
Ciphertext only
Clients encrypt vault data before anything leaves the device. The sync API — when you use one — stores opaque blobs. Collection names, entry payloads, attachments, organization names, and share data stay ciphertext at rest. Compromising the database yields salts, KDF parameters, wrapped keys, and blobs — not readable logins.
What ships today
| Piece | Role |
|---|---|
| App | Everyday vault on Android, iOS, macOS, Linux, and Windows — logins, cards, crypto wallets, developer secrets, organizations, and sharing |
| Server | FastAPI + PostgreSQL zero-knowledge sync API you can self-host |
| Extension | MV3 autofill and passkeys for Chrome and Firefox |
| CLI | Offline password generation, local secret discovery, and optional sync |
You can also sync a vault across devices on the same Wi‑Fi with Nearby (Pro) — no server required for that LAN path. Server sync and Nearby both move ciphertext only (last-write-wins by revision).
Get started
- Quick start — run the stack locally
- Using the app — vault workflows on phone and desktop
- Security — zero-knowledge model and threat boundaries
- Server setup — install and link your own sync host
New here? Start with What is a password manager? and Best password managers. Practical how-tos live in Autofill passwords, Import passwords from Chrome, and Strong password generator.
Also on the blog: zero-knowledge sync, Nearby without a server, self-hosting, self-hosted password manager, what are passkeys, two-factor authentication, passkeys & autofill, and the developer CLI. Code lives under OpenSelfHosting on GitHub.