OpenKey

Open-source, self-hosted, zero-knowledge password manager
Encrypt on the device. Sync ciphertext only. You keep the keys.

Android · macOS · Linux · Windows

  

More platforms and download options →

Features · Screenshots · Self-hosting · Encryption · Security

Desktop — macOS, Windows, Linux	Mobile — Android, iOS

OpenKey is a password manager built so the optional sync server cannot read your vault. Clients encrypt collection names, logins, cards, crypto wallets, secrets, and attachments on the device. The server stores opaque ciphertext, KDF parameters, and a wrapped vault key — never the master password.

The OpenKey app and protocol are open source under the MIT License. This repository contains the official Flutter app source, so you can inspect, build, and adapt the app yourself. Official releases are available from GitHub Releases and the download page.

Build from source

Build OpenKey from the repository root with Flutter. A server is not required to build or use a personal vault offline; configure a self-hosted server only if you want to sync between devices.

Clone the app repository:

git clone https://github.com/OpenSelfHosting/OpenKey.git

Change into the cloned project directory:

cd OpenKey

Requirements

• Flutter with the Dart SDK version allowed by pubspec.yaml (>=3.12.2 <4.0.0).
• The native toolchain for your target platform. Run flutter doctor -v to see what is installed and what is missing.
• For Android: Android Studio or the Android SDK command-line tools, Android SDK Platform 36, and accepted Android SDK licenses. OpenKey's minimum Android SDK is API 26. Accept licenses with flutter doctor --android-licenses.
• For Windows desktop: Windows and Visual Studio with the Desktop development with C++ workload.
• For Linux desktop: GTK 3 development files, CMake, Ninja, pkg-config, a C++ compiler, and the standard build tools (for Debian/Ubuntu, install build-essential and libgtk-3-dev).
• For macOS or iOS: macOS with Xcode installed and configured. iOS builds also require a valid signing team/device for device installation or distribution; the project deployment targets are macOS 10.15 and iOS 15.5.

Resolve dependencies

From the repository root:

flutter pub get

Flutter generates the app's localization and native plugin assets as part of the build. You do not need to run code generation separately for a standard build.

Run the app

List available simulators, emulators, and desktop targets:

flutter devices

Run the app on the target you selected from that list:

flutter run -d <device-id>

For example, start an Android emulator or connect a device with USB debugging enabled, then use its ID from flutter devices. Desktop targets can also be selected by their Flutter target name, such as linux, windows, or macos, when that platform is enabled in your Flutter installation.

Build a release

Build an Android APK for direct installation:

flutter build apk --release

For Google Play, configure release signing as described below, then build an Android App Bundle:

flutter build appbundle --release

Build the Windows desktop app (run this on Windows):

flutter build windows --release

Build the Linux desktop app (run this on Linux):

flutter build linux --release

Build the macOS desktop app (run this on macOS):

flutter build macos --release

Build the iOS app (run this on macOS with Xcode):

flutter build ios --release

Build outputs are written under build/ (Android APKs and app bundles are under build/app/outputs/). Desktop and iOS builds must be produced on their respective operating systems; cross-compiling between desktop platforms is not supported by these commands.

The Android release build uses a debug signing key unless you provide a release keystore. To create a Google Play-ready bundle, configure your upload keystore in android/key.properties (storeFile, storePassword, keyAlias, and keyPassword). Keep the keystore and key.properties private; never commit them. For iOS distribution, configure signing in Xcode before archiving or uploading the app.

Check the source

Run the static analyzer before submitting changes:

flutter analyze

Run the test suite:

flutter test

---

Features

One secure home for your passwords, payment details, and developer credentials.

Private by design Your vault stays yours Encrypt vault data on your device before it is synced. Use a personal vault offline, with no server required. When you sync, the server stores encrypted data—not your master password.	Passwords, passkeys & more Keep the details you rely on together Save logins, notes, recovery codes, custom fields, and file attachments. Use TOTP two-factor codes and passkeys on supported platforms. Store payment cards, crypto wallets, SSH keys, API tokens, and environment snippets.
Organized and easy to search Find the right item quickly Group items into collections and folders, then narrow results with tags and filters. Search across your vault and personalize collections with icons.	Autofill that fits your workflow Less typing, fewer interruptions Fill and save credentials with supported system autofill providers or the browser extension. Connect the extension to the unlocked desktop app through OpenKey's local bridge. Passkey creation and autofill depend on the platform and browser.
Sync on your terms Choose where your encrypted data goes Sync through an optional server that you host and control. With Pro, sync directly between nearby devices over your local network—without routing through the API.	Security and recovery controls Protect access and keep a way back in Set auto-lock and use biometric unlock; require biometrics for autofill where supported. Enable screenshot protection on supported platforms. Create an encrypted full-vault backup or import and export vault data.
Useful tools, built in Generate what you need, when you need it Create passwords, usernames, and email addresses, with password-strength feedback. Check credentials locally on your device.	Make OpenKey yours A comfortable setup across your devices Choose themes, colors, fonts, and your preferred language. Manage multiple vault accounts from the account switcher.

---

Product screenshots

Google Play — Android

Vault	Passwords and 2FA	Cards	Password generator
Autofill	Import and export	Nearby sync	Self-hosting

Microsoft Store — Windows

Vault	Passwords and 2FA
Cards	Password generator
Import and export	Nearby sync
Self-hosting	Browser autofill — save and fill credentials

---

OpenKey projects

The ecosystem is modular: the official app works offline, and you can add only the services and tools you need.

Project	What it does	When to use it
OpenKey app	Official Flutter app for Android, macOS, Linux, and Windows.	Use it as your personal password manager; a server is optional.
OpenKey server	Self-hosted API for syncing encrypted vault data between devices.	Deploy it when you want server-based sync that you control.
OpenKey browser extension	Browser-based vault, autofill, and connection to the unlocked desktop app.	Use it for browser autofill, either standalone with a server or with the desktop app bridge.
OpenKey CLI	Terminal tools for password generation and vault items.	Use it in developer workflows with the desktop app bridge or a server session.
OpenKey documentation	Product guides and documentation.	Use it for setup instructions and feature guides.

How the pieces connect

The app, browser extension, and CLI can each sync with a server. The extension and CLI can also connect to an unlocked desktop app through its local bridge.

flowchart LR
  subgraph Clients
    App[Official app]
    Ext[Browser extension]
    CLI[CLI]
  end
  Server[Self-hosted server]
  App -->|ciphertext| Server
  Ext -->|standalone sync| Server
  Ext -.->|native bridge| App
  CLI -.->|native bridge| App
  CLI -->|session sync| Server

Loading

Nearby LAN sync (Pro) is peer-to-peer on the local network. It does not go through the API.

The product website is openkey.openselfhosting.com; the company website is openselfhosting.com. Official app releases are available from GitHub Releases and supported app stores. OpenKey Pro subscriptions are sold through app stores. See the Terms of Service and Privacy Policy for product and service details.

---

Self-host the sync server

The sync server is optional: personal vaults work offline, and the server is only needed for server-based sync between your devices. It stores encrypted vault data and never receives your master password or plaintext vault key.

Quick start with Docker

You need a machine with Docker Engine and the Docker Compose plugin. Clone the server repository:

git clone https://github.com/OpenSelfHosting/OpenKey_server.git

Change into the server directory:

cd OpenKey_server

Create the environment file from the provided example:

cp .env.example .env

Generate a unique signing secret and set it as JWT_SECRET in .env:

openssl rand -hex 32

Keep the generated secret private. The server rejects missing or placeholder secrets.

Start the API and PostgreSQL database:

docker compose up --build -d

Check that the API and database containers are running:

docker compose ps

Check that the API health endpoint responds:

curl http://localhost:8000/health

The local API is at http://localhost:8000; interactive API documentation is at /docs. The database data is kept in the Docker volume openkey_pgdata, so it survives a normal container restart. Keep separate database backups as well.

Connect OpenKey

In the app, open Settings → Data → Self-hosted server, enter the server's base URL, then register an account or sign in and sync.

• Use http://localhost:8000 only when the app and server are on the same machine.
• For another device on your network, use the server machine's reachable LAN address or hostname.
• For access over the internet, use your domain with HTTPS (for example, https://vault.example.com).
• Use the same server URL and account on each device you want to sync.

Production deployment

Do not expose the database or the API's raw port directly to the internet. Put the API behind a reverse proxy or load balancer that provides HTTPS, keep PostgreSQL on a private network, and use a unique JWT_SECRET of at least 32 characters. Set CORS_ORIGINS to the exact browser origins you need—never use *. Only enable TRUST_PROXY_HEADERS when the trusted proxy overwrites forwarded-address headers.

Review the server's .env.example and follow the complete server installation and production guide before exposing an instance publicly.

Nearby sync is separate: OpenKey Pro can sync directly between nearby devices over the local network; that peer-to-peer transfer does not go through this server.

---

Browser extension

The open-source extension supports Chrome, Edge, Brave, Vivaldi, LibreWolf, and Firefox. Choose the workflow that fits your setup:

• Standalone vault: connect to your self-hosted server, unlock the extension with your account, and sync encrypted vault data.
• Desktop app bridge: connect to an unlocked OpenKey desktop app to fill and save without a separate extension unlock.

What you can do

• Autofill logins and payment cards, and capture new or updated logins.
• Use passkeys on supported sites and browsers.
• Browse and manage cards, crypto wallets, and developer secrets.
• In standalone mode, access synced attachments, shares, and organization features where available.

The desktop bridge focuses on filling and managing supported vault items through the unlocked app; server-dependent features such as shares and organization management remain in standalone mode.

Build and install

Install Node.js, then clone the extension repository:

git clone https://github.com/OpenSelfHosting/OpenKey_extension.git

Change into the extension project directory:

cd OpenKey_extension

Install the extension's dependencies:

npm install

Build the extension. The generated files are written to dist/:

npm run build

• Chrome, Edge, Brave, Vivaldi, and LibreWolf: open the browser's extensions page, enable Developer mode, choose Load unpacked, and select the generated dist/ directory.
• Firefox: open about:debugging → This Firefox → Load Temporary Add-on, then select dist/manifest.json. Temporary add-ons may need to be loaded again after Firefox restarts.

Chromium browsers require the extension ID to register the desktop bridge. Follow the platform-specific steps in the Browser extension guide, then choose Use desktop app in the extension.

Shortcut and permissions

Use Ctrl+Shift+L on Windows/Linux or ⌘⇧L on macOS to fill a login. If another extension uses the shortcut, change it in the browser's extension shortcut settings.

The extension requests access to websites so it can offer autofill, capture login updates, and handle passkeys. Review the browser's permission prompt and the extension guide before installing.

---

Command-line interface (CLI)

The open-source openkey CLI brings OpenKey into terminal workflows. Generate passwords offline, manage vault items through an unlocked app, or use an optional self-hosted server session. Node.js 20+ is required.

Install

Install the CLI globally:

npm install -g openkey-cli

Check that it is installed:

openkey --version

Use the unlocked app

Unlock OpenKey on this device first. Check the app bridge and current connection:

openkey status

Generate a 24-character password without symbols. Generation works offline and does not require an unlocked vault:

openkey gen -l 24 --no-symbols

List developer secrets saved in the connected vault. Keep the app unlocked:

openkey secret list

Add a secret directly to the unlocked app's Secrets section. This example reads the value from standard input rather than a command-line argument:

printf '%s' "$TOKEN" | openkey secret add --name "GitHub token" --kind apiToken --stdin

Scan this machine for developer secrets such as SSH keys, .env values, environment variables, and AWS credentials. Preview findings without saving:

openkey discover --dry-run

Save discovered secrets directly into the connected vault, grouped by device. Review the preview first and keep OpenKey unlocked:

openkey discover -y

Search vault items by a term:

openkey search api

Retrieve a specific field from a matching item:

openkey get "GitHub" --field username

Diagnose the CLI, app bridge, and server connection:

openkey doctor

Use a self-hosted server

Point the CLI at your server. Replace the example URL with your server's HTTPS URL:

openkey config set-server https://vault.example.com

Sign in to your server account. The master password is requested interactively:

openkey login --email you@example.com

Start a short-lived CLI session. The command prints shell instructions; eval applies them to the current shell:

eval "$(openkey unlock)"

Pull and push encrypted vault changes:

openkey sync

Lock the CLI session when you are finished:

eval "$(openkey lock)"

Never pass your master password as a command-line argument. For scripts, the CLI supports OPENKEY_PASSWORD; provide it through a secret manager rather than committing it to files.

Android with Termux

The CLI can connect to the unlocked Android app from Termux. In OpenKey, open Settings → Data → Termux / CLI and follow the displayed setup instructions. The bridge port and token are temporary and change after the vault is locked.

Prefer --stdin or file input for secret values instead of including them directly in commands, where they may be saved in shell history or visible to other local processes. list and search mask secret values; use get or copy when you need to reveal one. Clipboard copies clear automatically after 45 seconds by default.

See the CLI guide for all commands, configuration, shell completions, scripting, and platform-specific setup.

---

Security

Report vulnerabilities privately to security@openselfhosting.com — do not open a public issue for exploitable bugs. See SECURITY.md.

---

Contributing

Issues and pull requests for bugs, documentation, and improvements are welcome. Include focused tests with code changes. For security vulnerabilities, use the private reporting instructions in SECURITY.md instead of opening a public issue.

---

License

The OpenKey app and documentation in this repository are licensed under the MIT License. Vendored and third-party dependencies retain their respective licenses.