01
Find it in a moment.
Search names, services, environments and tags. Secret values stay out of search.
Ctrl + FYour keys.Your machine.Your control.
API keys, tokens and passwords — in one encrypted vault on your computer. A focused desktop app. A powerful CLI. No unnecessary cloud.
Windows & LinuxLocal. On your terms.
Real application. Fictional data only.Click the screenshot for a closer look ↗
LESS SEARCHING. MORE CREATING.
Everything in its place.
Finally.
You shouldn’t have to remember which file holds which key. Find the right credential, understand what it does, and get back to building.
02
Context for every key.
Purpose, service, username, host and tags. A key becomes more than a string without a story.
api production03
Copy. Carry on.
Copied secrets clear from your clipboard after the configured time, provided the clipboard still holds that secret.
Automatic clipboard clearingA CLEANER START
From scattered files.
To a single vault.
Bring existing credentials over from documents, configuration files and environment variables. Review the suggestions first. Then decide what to import.
- Preview before every import
- Secret values stay concealed
- Source files stay unchanged
.env.docx.json.yaml.csv+ more
Windows also supports importing from Credential Manager.
FOR YOU. AND YOUR CODING AGENTS.
The right key. Right there.
Without the copy-paste.
Let tools find a credential by name and use it where it’s needed. Keep keys out of your conversations with coding agents.
Your agents know where to look.Integration with Claude Code and Codex adds instructions for discovering and using credentials from your vault.
Claude Code + CodexSECURITY STARTS WITH ARCHITECTURE
Privacy starts
locally.
One encrypted file. A key protected on your computer. No cloud account standing between you and your own data.
AES-256-GCM
Vault contents and metadata use authenticated encryption. On Windows, the key is protected by DPAPI for your Windows user account.
No telemetry.
The app has no network code, analytics or update checks. It works fully offline. If you want file sync, your own sync tool handles it.
Recovery in your hands.
Export a recovery file protected with a passphrase. Use it to move your key to another computer, or between Windows and Linux.
Understand how your vault is protected
On Linux, the key is stored in an owner-only file; full-disk encryption is recommended. App lock protects the window, rather than adding another encryption layer: the CLI and local processes running under your account can still access the vault. Keep your recovery file and its passphrase separately.
YOUR NEXT, CLEANER WORKFLOW
Keep your keys.
Take back control.
The desktop app and CLI, together. A home for official releases is ready; installation packages will be added later.
Actively in development. Screenshots show development version 1.8.0 with demo data. Downloads are not yet available on this page.
A FEW MORE ANSWERS
Clear from the start.
Your credentials deserve clear answers, without the fine print.
Do I need an account or internet access?
No. LocalKeyVault works locally, without signing in or connecting to the internet. You need internet access to download the app. If you place the encrypted file in a synced folder, your separate sync tool handles synchronization.
Can I use the same vault on another computer?
Yes. Transfer the encrypted vault.enc file and import your recovery file on the new computer using its passphrase. Copying the vault file alone is not enough because its key is protected locally. You can also move between Windows and Linux.
What if I forget my app lock password?
The window lock password can be reset using your recovery file and its passphrase. There is no central account that can recover your key for you. Export the recovery file straight away and keep it somewhere safe.
Does this replace a team secrets manager?
LocalKeyVault is a personal, local tool for your desktop, terminal and coding agents. It does not provide centralized team access management. Local processes running under your user account are part of its trust model.