Your passwords, in one encrypted file on your own PC.
A small password vault for Windows. No account, no cloud, no tracking. Free for personal use.
v1.7.1 · Windows 10 (2004) or later · x64 · MSIX installer
Signed with a self-signed certificate: you check the file and trust the certificate once. Install guide
Built by Biswajit Panday
I wanted my passwords, cards and notes encrypted, without trusting a cloud service. So Keyra keeps everything in one file that never leaves your PC.
Logins, cards, bank accounts, secure notes and identities, all in one encrypted vault. A sidebar with types, your own categories and favourites. Rows show a short summary like "Visa ···· 1111 · exp 08/28"; never more than the last 4 digits.
Passwords, card numbers, CVVs, PINs, IBANs and ID numbers are masked by default. A shown value hides again after 20 seconds, when you pick another item, when the window loses focus, or when the vault locks.
Finds reused, weak and old passwords, and cards, passports, ID cards and driver licences that expire soon. Problems first, each with a tip on how to fix it. It never shows a password or a number.
Locks after 5 minutes idle, on minimize, when Windows locks, on sleep and on exit. Copied values stay out of Windows clipboard history and cloud clipboard, and are cleared after 30 seconds. Both are yours to change.
CSV exports from Chrome, Edge, Firefox, Bitwarden, KeePass, KeePassXC, LastPass and Proton Pass. Keyra shows how to export from the app you pick, previews what will be added (never a password), then deletes the plaintext CSV.
Deleted items wait in Trash for 30 days, where you can restore them. Each login also keeps its last 5 passwords, with show, copy and restore.
Off by default. Turn it on and Windows Hello unlocks Keyra while it runs; the master password is still needed after every start and at least every 14 days. Chosen items ask for Windows Hello again before a secret is shown, copied or changed.
Keyra's windows are left out of screenshots, recordings and screen sharing. On by default, and always on while locked. Optionally blur the list rows you are not pointing at.
Backups are the encrypted file only; there is no plaintext export. Keyra reminds you after 30 days without a backup. A restore keeps a copy of the current vault first.
Keyra makes three shares for the people you trust. Any two of them open a read-only snapshot of the items you choose; one share alone opens nothing. Built from standard parts (HKDF and AES-GCM), no home-made math.
Your master password goes through Argon2id to make the key. AES-256-GCM seals the whole vault into one file, with a new nonce on every save. The header is authenticated too, so a single changed byte makes the file refuse to open. A failed unlock never creates a new vault and never overwrites the old one.
Read the details: security · threat model · vault format · privacy
A security tool should say where it stops. Keyra can't protect you from malware on an unlocked PC or from a weak master password; the threat model lists each case.
I set the specs and the rules, I build with Claude Code, and I review every step. The checks are automatic, so the assistant can't skip them.
Every change maps to a numbered requirement. When behaviour changes, the spec changes before the code.
A security constitution the AI assistant must follow: no home-made crypto, no plaintext on disk, never log a secret, fail closed, no network calls.
A read-only security-reviewer agent checks every milestone against the spec and the rules before I commit.
A Stop hook runs the build and the tests whenever code changed, and blocks the assistant from finishing if they fail.
One example: a fake Windows Hello in the tests showed that the lock screen never started the Hello prompt by itself. I fixed it and shipped 1.7.1.
Two layers: a WPF app on top of a core library with no UI. The app never touches the crypto, the file format or JSON directly; only the core does. Argon2id comes from NSec (libsodium), AES-256-GCM and HKDF from .NET itself.
Free for personal use. Windows 10/11, x64.
PolyForm Noncommercial license · free for personal and non-profit use; business use needs a paid license.