Keys - Vibe Coders Vault

iOS Universel / Productivité

A vault for the credentials you keep accumulating.

You're building things with AI. Every other afternoon you're pasting in a fresh OpenRouter key, generating an Anthropic console token, copying an OpenAI project key into a .env file that's getting away from you. The screenshots folder has three keys in it. The Notes app has six. There's a Slack DM somewhere with a Stripe test key from last March.

Keys is for that.

Built for the credentials password managers were never designed for: API keys, SSH keys, OAuth tokens, certificates, connection strings, and the structured login/password pairs that pile up when you're shipping things alone or with a small team.

Everything is encrypted on-device with a key derived from your passphrase. Synced through your own iCloud account. Never seen by us, because we don't run a server that holds your data — there's nothing to compromise, nothing to subpoena, nothing to leak.


PASTE A MESS, GET A VAULT

Drop in your .env file, a config snippet, an exported secure note, a chunk of someone else's setup instructions. Keys' two-engine extractor finds the credentials and presents them as reviewable records.

A pattern matcher with around 80 vendor-specific rules (OpenAI, Anthropic, OpenRouter, GitHub, AWS, Stripe, Slack, Supabase, Replicate, ElevenLabs, and more) runs entirely on-device — no network, no API key required, secret values pulled verbatim from the source. An optional AI classifier using your own OpenRouter key adds the human-readable metadata: what to call the record, which provider, what kind of credential. The model never generates the secret value itself.


LIVENESS FOR THE KEYS THAT MATTER

Keys can validate stored credentials against their providers and flag the dead ones. Rotated a key in OpenAI last week and forgot which projects still reference it? Keys notices.


DESIGNED FOR HOW YOU ACTUALLY WORK

• First-class records for API keys, SSH key pairs, OAuth tokens, certificates, connection strings, and login/password
• Group records by app, environment (dev / staging / prod), and provider — the way you already think about them
• Markdown notes, attachments, revision history, tags
• Optional CLI for terminal workflows on macOS: keys get openai/prod from anywhere
• Optional SSH agent so stored SSH keys can sign without ever leaving the vault
• Encrypted .keysvault backups for clean migrations and offline archives


PRIVATE BY ARCHITECTURE

• End-to-end encrypted; only your passphrase decrypts your vault
• Sync through your iCloud, not a developer-operated server
• Face ID, Touch ID, or Optic ID unlock, hardware-backed
• App Sandbox; no analytics, no telemetry, no crash reporting, no third-party SDKs
• Native macOS and iOS — built in SwiftUI, not a wrapped browser

We can't read your data. We can't restore your data. We can't hand it to anyone. The architecture enforces it.

Lose your passphrase and the vault genuinely is unrecoverable — print your one-time recovery code at setup and store it somewhere physical. That's the trade-off security made of math always asks of you.


INDEPENDENT SOFTWARE

Keys is built by one person. No investors, no growth team, no telemetry pipeline, no decision tree that ends in selling your data. Just a vault that does its job.

What's not coming: ad tiers, "phone home" telemetry, any data path that requires you to trust the developer instead of the math.