Skip to content
Keyper Keyper Docs

Keyper

A self-hosted credential manager for API keys, passwords, and secrets. Values are encrypted in your browser, and they are stored in a database you own.
Open the web app Get started GitHub
The Keyper dashboard showing saved credentials grouped into cards, with a search field, category and type filters, a tag list, and a vault status panel reading Vault Unlocked.

A demo vault with an unlocked session. Secret values stay hidden until you reveal them.

How it works

Section titled “How it works”

Three things separate Keyper from a hosted password manager.

Encrypted before it leaves the browser

Secret values are encrypted with AES-GCM on your device. Your master passphrase unwraps the key that decrypts them, and it never travels to the database. Titles, usernames, URLs, notes, and tags are stored as regular text so that search and sorting work.

Your database, not mine

Point Keyper at your own Supabase project, a Neon Postgres database, or a local SQLite file. You pick which one in the app’s settings. There is no Keyper server in the middle holding your rows.

Two locks, not one

Signing in decides whether the database returns your rows at all. Unlocking the vault decides whether you can read them. On Supabase those are separate accounts, with the separation enforced by the database.

Run it where you want

Section titled “Run it where you want”

The same app ships four ways. All of them talk to the database you configured.

  • Hosted web appUse app.keyper.icu and point it at your own database.
  • Installable PWAInstall from the browser for an app window and an icon.
  • DockerAn nginx image you can run on your own hardware or NAS.
  • DesktopWindows installer, Linux AppImage, and .deb packages.

Start reading

Section titled “Start reading”
Overview What Keyper is, how the app is put together, and which credential types it handles.
Install and run Desktop downloads, the npm CLI, and running the Docker image yourself.
Security model What the two locks protect, what is encrypted, and what is deliberately not.
Cryptography Key derivation with Argon2id or PBKDF2, and AES-GCM for credential values.
Self-hosting Standing the app up on your own infrastructure, including Docker and nginx.
Troubleshooting Connection failures, unlock problems, and the fixes for the common ones.