Local Password & Token Manager
English · 简体中文 · Download · Product · Security
Keep passwords, tokens, and keys in a local encrypted vault, and decide which applications and tools may use them.
KeptNear is an open-source, local-first password and token manager. Your data
lives in a user-controlled encrypted .pswvault directory. You choose where
that vault is stored and whether an untrusted file provider such as iCloud
Drive, Dropbox, Syncthing, or WebDAV transports its encrypted files.
The native macOS app is the human control plane. KeptNear is also being built for local applications, CLI tools, and MCP hosts that need to use a selected credential without receiving the rest of the vault or placing raw secrets in ordinary Agent conversations and tool output.
Native macOS vault workspace using synthetic fixture data.
- Your vault stays yours. KeptNear requires no account and operates no hosted vault or sync service.
- File sync remains a transport. External providers can copy encrypted vault files, but they never become KeptNear's trust boundary.
- Passwords and developer credentials belong together. Logins, secure notes, cards, software licenses, API tokens, keys, certificates, and custom fields share one extensible encrypted model.
- Machine access is explicit. The planned end-user flow pairs each local Consumer and scopes access to selected secret fields and approved operations.
- The daily experience is native. The first client is a SwiftUI macOS app backed by a reusable Rust core.
- The boundaries are inspectable. Vault format, architecture, security assumptions, logging, packaging, and release gates are documented in public.
Warning
KeptNear is experimental pre-alpha software and has not received an external security audit. This release remains unaudited. Do not use it to store production passwords, tokens, keys, or other credentials.
An unsigned Apple Silicon DMG is published as an experimental GitHub pre-release for macOS 13 or newer. It is not signed with an Apple Developer ID and is not notarized, so macOS cannot verify the publisher identity and may block the first launch.
The source and unsigned preview are published through bounded maintainer
accepted-risk records AR-001 and AR-002. Those records permit transparent
experimental evaluation; they do not make KeptNear audited, production-ready,
or suitable for important credentials.
Current release:
v0.1.0-prealpha.2.
The agreed next product milestone is v0.2.0-alpha.1.
Human
└─ macOS App ────────────────┐
├─ encrypted .pswvault
Local application or tool │
└─ MCP / CLI ─ Local Broker ┘
├─ pairing
├─ field-scoped authorization
├─ user approval and grants
└─ secret-free local audit
The portable vault contains encrypted credential data. Device trust, application pairing, grants, approvals, and audit state stay device-local and are not copied with the vault. MCP and CLI expose approved operations rather than a generic raw-secret retrieval command.
Source-build Apps & Tools control surface. End-user machine access remains a developer preview.
Read the Product Overview for the complete product model and Architecture for implementation boundaries.
Source implementation, bundled components, and released user workflows are deliberately reported as different states.
- Create, open, unlock, lock, recover, back up, restore, and file-sync local encrypted vaults.
- Create and manage logins, secure notes, cards, software licenses, API tokens, API keys, SSH keys, certificates, and custom credentials.
- Search, favorites, tags, password generation, TOTP, password health, managed clipboard clearing, auto-lock, import/export, and explicit conflict resolution.
- Use English, Simplified Chinese, or Japanese in the native macOS interface.
- A device-local Broker with encrypted trust state, paired Consumer identity, field-scoped authorization, approvals, grants, global pause, and secret-free audit.
- A six-tool MCP adapter and typed
keptnearCLI over the authenticatedkeptnear.broker/1.0protocol. - Brokered HTTPS and direct child-process compatibility operations that avoid returning raw credentials through normal machine results.
These machine interfaces require a compatible Broker process and remain a source-level developer preview.
The Apple Silicon package includes the App, Broker, MCP adapter, CLI, FFI
library, and a closed protocol manifest. Copying KeptNear.app to Applications
does not install or activate a long-running Broker service or complete the
pairing, approval, restart, upgrade, and uninstall lifecycle.
- End-user MCP or CLI machine credential access is not a released product capability.
- No signed or notarized binary is available.
- No hosted vault, KeptNear account, telemetry upload, automatic update, or provider sync service is operated by KeptNear.
- No release profile recommends production-secret use.
See Capability Status for evidence behind each label.
The current binary preview supports Apple Silicon (arm64) only on
macOS 13 or newer.
-
Download the DMG and checksum from v0.1.0-prealpha.2.
-
From the download directory, verify the image:
shasum -a 256 -c KeptNear-0.1.0-prealpha.2-macos-arm64.dmg.sha256
-
Open the DMG and drag
KeptNear.appto Applications. -
Review the unsigned installation guide before opening it. Never disable Gatekeeper globally for KeptNear.
The published DMG SHA-256 is:
b926247539f2c3ad8d2ebcf6f5d60f04bbe60db3081b180b45a1d0a149fe35b0
The product direction is fixed, while compatibility and delivery maturity remain pre-1.0. The planned sequence has no promised dates:
| Milestone | Closure target |
|---|---|
v0.2.0-alpha.1 |
Refine the native macOS password and token workflow and public product experience. |
v0.3.0-alpha.1 |
Add high-fidelity KeePassXC migration with preview, loss reporting, and fresh local identities. |
v0.4.0-beta.1 |
Activate a supported end-user Broker, MCP, CLI, pairing, approval, and uninstall lifecycle. |
v0.9.0-rc.1 |
Freeze compatibility surfaces, validate upgrades and recovery, and complete signed/notarized distribution. |
v1.0.0 |
Make a stable vault-format, protocol, migration, and core-behavior compatibility commitment. |
The first complete product is macOS-first, but the category and Rust data model are platform-neutral. Windows can be added later without changing the product identity. iOS, browser extensions, passkeys, teams, sharing, and a hosted KeptNear service are outside the first-version scope.
The repository pins the reviewed Rust toolchain. Build and test from the repository root:
scripts/check.sh
scripts/build-macos.shBuild and launch a local macOS app bundle:
script/build_and_run.shVerify that candidate public source excludes local Agent context, real vaults, exports, credentials, and build artifacts:
script/verify_public_source_tree.sh
script/verify_repository_secrets.shMachine interfaces are developer previews. Read Local CLI Usage and Local MCP Host Setup before running them.
apps/macos/ Native SwiftUI macOS client
crates/psw-core/ Encrypted vault model and workflows
crates/psw-ffi/ C ABI used by the macOS app
crates/psw-broker/ Device-local authorization boundary
crates/keptnear-client/ Shared Broker authentication client
crates/keptnear-mcp/ Local stdio MCP adapter
crates/psw-cli/ Vault diagnostics and Broker-connected CLI
docs/ Product, architecture, security, and release documents
fixtures/ Sanitized vault and import fixtures
script/, scripts/ Build, packaging, and verification gates
Start with:
Use and operations:
- Build and Verification
- macOS Alpha Packaging
- macOS Service Activation Feasibility
- Encrypted Backup and Recovery
- Local File Sync
- Import and Export Formats
- Diagnostics
- Logging Policy
- Local CLI Usage
- Local MCP Host Setup
Trust and release evidence:
Reproducible bug reports and focused feature requests are welcome through GitHub Issues on a best-effort basis. External pull requests are not currently accepted. See CONTRIBUTING.md.
Report security issues privately to
Chase Chou <chasechou007@gmail.com> according to SECURITY.md.
Copyright (C) 2026 Chase Chou.
KeptNear is licensed under the GNU General Public License, Version 3 only
(GPL-3.0-only). See LICENSE.