Kearsarge Vault
Never rotate a key because you forgot it.
A password manager and secrets vault for people who build things. Every API key, env secret, login and signing key, encrypted on your device and kept with the context you need to use it again.
In testing on Google Play. On the web now. No account, no ads, works offline.
The value you can't get back
You set a secret once — an API key, a webhook token, a database password — and paste it into a hosting dashboard that will never show it to you again. Three months later you need it for a new environment, cannot get it back, and rotate a key that was fine. Kearsarge Vault keeps the value, and the context around it: which app it belongs to, where it came from, where it is deployed, and when it expires.
Secrets keep their context
Group API keys and env variables by app and environment. Record where each one came from — issued by a provider, or generated by you — where it is deployed, and when it expires, with a reminder before it does. Copy the value, or the whole NAME=value line, and paste it straight into a hosting dashboard or a .env file. Push secrets to GitHub Actions and Vercel without leaving the vault.
Passwords and 2FA, too
Logins with as many URLs as you need, one-time codes for two-factor sign-in, and every previous password kept when you change one. A password generator with length and character controls, a random key generator at 128, 256 or 512 bits, and signing keys alongside the rest.
Encrypted before it goes anywhere
Your vault is encrypted on your device with AES-256-GCM, under a key derived from your master password with Argon2id. The master password never leaves the device. There is no Kearsarge Vault server and no account; the app collects no data and shares none. Sync and backup are optional and go to your own Google Drive, as an encrypted file we cannot read and neither can Google. Everything works offline.
Your data is never locked in
The vault file format is documented and open. Export an encrypted copy at any time and open it with a command-line tool, without the app. The Drive backup folder carries a small program that decrypts a backup offline with your master password or a recovery code. Unlock with your master password, fingerprint or passkey, and keep printed recovery codes for the day you forget it.