KeyKeyKey — Your Passwords, Your Cloud, Your Rules

KeyKeyKey is a cross-platform credential manager built on a single principle: you should own your secrets. No proprietary cloud. No subscription lock-in. No trust required in a third-party server. Just strong encryption, open code, and the storage provider you already use.

What is it?

KeyKeyKey stores your passwords, credit cards, secure notes, and 2FA codes — all encrypted with military-grade cryptography — and syncs them across every device you own using your own cloud storage.

One app. Five platforms. Zero servers we control.

Platform	Technology
iOS & Android	React Native (Expo)
macOS, Windows & Linux	Tauri (Rust + React)
Chrome, Firefox & Safari	Browser Extension (Manifest V3)

Why KeyKeyKey?

Bring Your Own Cloud (BYOC)

Most password managers force you onto their servers. KeyKeyKey flips the model: pick the storage you already pay for — WebDAV, Google Drive, Dropbox, or OneDrive — and your encrypted vault syncs there. Your data never touches infrastructure you don't control.

Envelope Encryption

Your master password never leaves your device. Here's what happens under the hood:

1. Your Master Password is run through Argon2id (the gold standard in key derivation) to produce a Key Encryption Key (KEK).
2. A random Data Encryption Key (DEK) is generated and encrypted by the KEK.
3. Every vault item is encrypted with the DEK using XChaCha20-Poly1305 — the same cipher used by WireGuard and Cloudflare.
4. A Recovery Key provides an alternate path to unwrap the DEK if you forget your master password.

The crypto stack uses @noble/ciphers and @noble/hashes — audited, pure-TypeScript libraries with no native binary dependencies.

Biometric Unlock

After your first master password entry, KeyKeyKey caches the DEK in your device's secure enclave (iOS Keychain, Android Keystore, macOS Keychain, Windows Credential Manager). From then on, unlock with Face ID, fingerprint, or Touch ID in under 200ms.

Autofill Everywhere

• Mobile: Native iOS AutoFill Credential Provider and Android Autofill Framework — KeyKeyKey appears in the system autofill prompt inside any app or browser.
• Browser Extension: Content scripts detect login forms, inject a discreet autofill icon, and fill credentials with a single click. It even offers to save new passwords after you sign up.
• Desktop: Global keyboard shortcuts for quick credential search and autofill.

Built-in Authenticator (TOTP)

No need for a separate 2FA app. KeyKeyKey generates time-based one-time passwords (RFC 6238) right alongside your credentials. Scan a QR code, and your 2FA codes live next to the passwords they protect — encrypted at rest and computed on-demand.

Password Generator

Generate strong passwords or memorable passphrases with real-time entropy estimation:

• Random passwords: 8–128 characters, configurable character classes, ambiguous character exclusion.
• Passphrases: 3–10 words from the EFF large wordlist (~12.9 bits of entropy per word), customizable separators.
• Visual strength meter so you know exactly how strong your password is before you use it.

Easy Migration

Import from what you already use:

Source	Supported
Chrome	Yes
Firefox	Yes
1Password	Yes
Bitwarden	Yes
iCloud / Apple Passwords	Yes

Auto-detection reads your CSV headers and picks the right parser. TOTP seeds, folders, favorites, and notes are all preserved. And if you ever want to leave, a standards-compliant CSV export has you covered.

Password History

Changed a password and need the old one back? KeyKeyKey automatically keeps the last 20 passwords for each credential, timestamped, encrypted, and never included in exports or search results.

Architecture at a Glance

packages/core        — Crypto, data models, sync adapters, Zustand store
packages/ui          — Shared UI tokens and components
apps/mobile          — Expo (React Native) for iOS & Android
apps/desktop         — Tauri (Rust + React) for macOS, Windows & Linux
apps/extension       — Manifest V3 browser extension

One TypeScript core shared across all five platforms. Cryptography, state management, and sync logic are written once and tested with property-based fuzzing, IETF test vectors, and enforced 100% coverage on all crypto modules.

Security by Design

• Audited cryptography — @noble/ciphers and @noble/hashes, pure TypeScript, no hidden native code.
• Zero-knowledge architecture — We never see your master password or your data. There is no "we."
• SAST — Semgrep covers OWASP Top 10 on every pull request.
• License compliance — No GPL, LGPL, AGPL, or other copyleft dependencies.
• Auto-lock — Configurable timeout locks the vault and clears all sensitive data from memory.

Open Source

KeyKeyKey is open source. Audit the code, verify the crypto, build it yourself. Security through transparency, not obscurity.

github

---

Your passwords belong to you. KeyKeyKey just keeps them safe.