KVault

Screenshots

What it does

• Every item type Logins, secure notes, cards, identities and SSH keys, including custom fields, multiple URIs and password history.
• Full read and write Create, edit, trash, restore and delete permanently, and organize items into folders.
• One-time passwords Live TOTP codes with a countdown ring — bare base32 secrets, otpauth:// URIs and Steam Guard.
• Local cryptography The Bitwarden key schedule is implemented directly with OpenSSL and libargon2.
• Works offline The encrypted vault is cached on disk, so it stays readable and searchable with no network. Locking discards the keys.
• Generator Passwords with configurable character classes and minimums, or passphrases from the EFF long wordlist.

Getting started

Flatpak

Download kvault.flatpak from the latest release, then:

flatpak install --user kvault.flatpak
flatpak run io.github.timpalpant.kvault

Arch Linux

Download kvault-*.pkg.tar.zst from the latest release, then:

sudo pacman -U kvault-*.pkg.tar.zst

Debian / Ubuntu

Download kvault_*.deb from the latest release, then:

sudo apt install ./kvault_*.deb

Fedora / RPM-based distributions

Download kvault-*.rpm from the latest release, then:

sudo dnf install ./kvault-*.rpm

From source

git clone https://github.com/timpalpant/kvault.git
cd kvault
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release
cmake --build build
./build/bin/kvault

You will need Qt 6.8+, KDE Frameworks 6, qtkeychain, OpenSSL 3 and libargon2. The full list is in the README. extra-cmake-modules is deliberately not required.

How your vault stays yours

• The master password is never written to disk, and is wiped from memory as soon as the keys are derived from it.
• Key material lives in a buffer with a cleansing allocator, so growing or freeing it leaves no copies on the heap.
• The on-disk cache is the server's sync payload exactly as received — still encrypted. Locking discards the keys.
• Session tokens go to KWallet or the Secret Service, never to a file.
• No favicons are fetched: requesting one would tell a third party which sites are in your vault.
• Copied secrets are tagged so Klipper keeps them out of its history, and are cleared after a delay you choose.

The key schedule is pinned by tests against published vectors (RFC 4231, RFC 5869, RFC 6238, PBKDF2-SHA256 and Argon2id), so a regression fails the build rather than quietly producing an unreadable vault.

Contributing

Bug reports and patches are welcome — see issues and pull requests. KVault is free software under the GPL-3.0-or-later.