VaultKeep is a local-first password manager for Windows. It stores your logins, 2FA codes, notes, and generates strong passwords — everything encrypted on your own machine with a master password that never leaves your device.
Why Local-First?
Most password managers sync your vault through a cloud service, which means you are trusting a third party with the keys to your accounts. VaultKeep takes the opposite approach: the database and all cryptographic keys stay in the Electron main process on your machine. There is no cloud, no account, and nothing to leak.
Security Model
Your master password is derived through Argon2id — memory-hard and parallel-resistant — into a key that encrypts every record with AES-256-GCM, giving both confidentiality and authenticated integrity. The raw password is never stored; the vault uses an encrypted sentinel to verify it on unlock.
The renderer UI talks to the backend only through a typed window.vaultkeep IPC bridge with contextIsolation enabled — the database and crypto code never ship to the renderer, so a compromised UI cannot reach the encryption keys.
React 19 UI ←→ preload IPC bridge ←→ Main Process
├── Argon2id (key derivation)
├── AES-256-GCM (encryption)
└── better-sqlite3 (encrypted DB)Key Features
- Logins, notes & favorites — organize everything by type, tag, or filter to favorites.
- 2FA codes — live TOTP codes for any account with a copy button.
- Password generator — strong passwords with adjustable length and character sets.
- Compact rows — an ultra-compact list view that packs more items on screen.
- Search — instant, keyboard-navigable search across your vault.
- CSV import/export — move your data in and out without a cloud.
- Auto-lock — locks after inactivity; your keys are cleared from memory on lock.
- Site favicons — automatic per-site icons pulled at import time.
- Overview stats — counts, per-type breakdowns, and a usage chart.
- Update checks — an in-app notification bell plus native OS alerts when a new version is out.
Tech Stack
Install
VaultKeep 1.0.3 ships as a Windows installer (NSIS). Download the installer and run it — no accounts, no sign-ups, no cloud:
Windows x64 · NSIS installer · ~114 MB
Because the installer is signed with a self-signed certificate, Windows may show a SmartScreen prompt — click More info → Run anyway to proceed. Your first run asks you to create a master password, and that password is the only way to open your vault. Keep it safe — there is no recovery.
Open Source
VaultKeep is open source. Source code on GitHub. Feature requests and issues are welcome.