Can keykavach read my passwords?

No. Your master password and encryption keys are derived on your device and never transmitted to our servers. We only store encrypted data (ciphertext) that cannot be decrypted without your master password.

What happens if I forget my master password?

Because we have zero knowledge of your master password, we cannot reset it. During signup you receive a recovery code. Store it somewhere safe, it is the only way to regain access if you forget your master password.

Yes. The Free plan costs ₹0 with no card required and includes 10 encrypted records, one vault, and the password generator. Paid plans start at ₹49 per month, billed in INR through UPI, cards, or netbanking.

Is the password generator truly random?

Yes. It uses the Web Crypto API's cryptographically secure random number generator in your browser. No generated password is sent to our servers unless you explicitly save an encrypted copy to your vault.

Can I import passwords from another password manager?

Yes. You can import exports from other password managers, including 1Password, and every record is encrypted in your browser before it is uploaded. You can export your vault at any time, so you are never locked in.

Can I use keykavach on multiple devices?

Yes. Your encrypted vault is available in the web app and the desktop app on any device. Unlock it with your master password on each device, and review or revoke individual sessions anytime under Settings.

How is this different from other password managers?

Most password managers encrypt data on the server or in transit. keykavach encrypts every record in your browser before it leaves. Even a complete server breach would only expose unreadable ciphertext.

A vault that cannot read your passwords

Your passwords stay on your device.

Keykavach encrypts each record before it leaves your browser. Proprietary zero-knowledge security developed by Gupta Technologies.

AES-256-GCM

600k PBKDF2 iterations

Decryption never leaves your browser

local.decrypt()

browser only

What the server stores

AES-256-GCM · ciphertext envelope

x7K·mQ2·vP9·aL4·sR8

Unreadable without your key

Reveal is simulated locally. No value is sent anywhere.

Security is not a feature we bolted on. It is the only thing we build around.

Every record is encrypted with keys that never leave your device. We host ciphertext. You hold the keys.

01Generate

Strong passwords,
made on your device.

A real generator — not a screenshot. Tune length and character sets, watch the strength resolve, and copy the result. It never leaves this tab.

Client-side only

Every character is generated in your browser. Nothing is requested from, or sent to, our servers.

Live strength analysis

Entropy scoring updates as you type, with specific guidance on what to strengthen.

Copy that clears itself

One tap to the clipboard, with visual confirmation and an automatic timed wipe.

Password Generator

Create a secure password

Password Length: 16Strong

864

Character Sets

Lowercase

a-z

Uppercase

A-Z

Numbers

0-9

Symbols

!@#$

Available Characters:94 chars

Password Strength

Strong100%

WeakFairGoodStrong

Excellent! Your password is very secure.

This would take centuries to crack with current technology.

Generated passwords are created locally and never sent to our servers.

02Passkeys

Sign in with a passkey,
not a password.

Try it: trigger the passkey prompt. WebAuthn verifies you with your device's biometrics and signs the challenge in-place.

keykavach.app/signin

john.doe@example.com

Phishing-resistant by design

Passkeys are bound to keykavach's domain. A look-alike site cannot request or replay them.

Biometric stays on your device

Touch ID, Windows Hello, or your phone's screen lock verifies you locally. Only a signature reaches us.

Nothing reusable to steal

Our servers store a public key only. There is no shared secret to breach, phish, or reuse elsewhere.

03Share

Hand off a secret
without handing over trust.

Share a credential end-to-end encrypted, cap how long the link lives, and watch each view count down.

End-to-end encrypted

A share stores an encrypted snapshot of the record. Recipients decrypt it in their browser — we only ever hold ciphertext.

AES-256-GCM
Zero-knowledge
Encrypted snapshot

Control the window

Cap how many times a link opens and when it expires — then revoke it early the moment you change your mind.

1–10 view limit
Hour-based expiry
Revoke anytime

Know when it's opened

Every open increments the view counter, and an optional password keeps casual forwards from opening the link.

View counter
Optional password
Self-closing links

Share a credential

E2E encrypted

GitHub account

john.doe@example.com

3 views max

24h expiry

Password gated

Your share links

Tracked

GitHub account

1 of 3 views used

Expires in 21h

Wi-Fi password

3 of 3 views used — link closed

Expired

Staging .env file

Revoked before expiry

2d ago

// why

Security that holds even if we are breached

Zero-knowledge is not a feature we added, it is the architecture. Your data is encrypted before it ever reaches us, so a server compromise leaks ciphertext and nothing else.

Client-side Encryption

AES-256-GCM encryption with PBKDF2 key derivation happens entirely in your browser. We never see your plaintext data.

AES-256-GCM with 600,000 PBKDF2 iterations using SHA-256

Zero-Knowledge Architecture

Your master password never leaves your device. Authentication uses Argon2id hashes while encryption keys are derived locally.

Argon2id authentication + local PBKDF2 key derivation

Secure by Design

Built on modern web standards with TypeScript end-to-end. Every component follows security-first principles.

Next.js + tRPC + Prisma + TypeScript

// how

How It Works

Three steps to secure your digital life with zero-knowledge encryption

Sign Up & Create Master

Master password -> Argon2id hash for auth + PBKDF2 for encryption keys

Unlock Your Vault

Enter your master password to derive encryption keys locally and decrypt your vault. All cryptographic operations happen in your browser.

Local key derivation -> AES-GCM decryption -> plaintext in memory only

Store Credentials Securely

Add your passwords and sensitive data. Everything is encrypted before storage, the server only ever sees ciphertext.

Plaintext -> AES-256-GCM + random IV + salt -> ciphertext storage

Sign Up & Create Master

Master password -> Argon2id hash for auth + PBKDF2 for encryption keys

Unlock Your Vault

Enter your master password to derive encryption keys locally and decrypt your vault. All cryptographic operations happen in your browser.

Local key derivation -> AES-GCM decryption -> plaintext in memory only

Store Credentials Securely

Add your passwords and sensitive data. Everything is encrypted before storage, the server only ever sees ciphertext.

Plaintext -> AES-256-GCM + random IV + salt -> ciphertext storage

Zero-knowledge security

Your data is encrypted before it leaves your device

Free

For first-time users trying keykavach

Key Features

AES-256-GCM encryption

Zero-knowledge architecture

Two-factor authentication

Password records(10)

Vaults(1)

Secure share links

Starter

₹49/month

For a single user getting organized

Key Features

AES-256-GCM encryption

Zero-knowledge architecture

Two-factor authentication

Password records(500)

Vaults(5)

Secure share links(5)

Key Features

AES-256-GCM encryption

Zero-knowledge architecture

Two-factor authentication

Password records(Unlimited)

Vaults(10)

Secure share links(Unlimited)

Family

₹249/month

For households sharing passwords and documents

Key Features

AES-256-GCM encryption

Zero-knowledge architecture

Two-factor authentication

Password records(Unlimited)

Vaults(20)

Secure share links(Unlimited)

Team

₹349/month

For organizations that need control and audit

Key Features

AES-256-GCM encryption

Zero-knowledge architecture

Two-factor authentication

Password records(Unlimited)

Vaults(Unlimited)

Secure share links(Unlimited)

New, and built to be checked

Don't take our word for it. Verify it.

A password manager should earn trust with things you can inspect, not quotes. Here is what we promise and how to check each one.

We only receive ciphertext
Each record is sealed with AES-256-GCM and a fresh IV in your browser before any request is sent.
Open DevTools, save a record, and inspect the request body. You will see encrypted fields, never your password.
600,000 PBKDF2 iterations
Your master password is stretched with PBKDF2-HMAC-SHA256 at the iteration count OWASP recommends.
A stolen database gives an attacker salted ciphertext that is slow and expensive to brute-force.
Leave whenever you want
Export your whole vault at any time, on every plan including Free. No lock-in and no exit fee.
Export and import are included on the Free plan, not held back as a paid upgrade.
Priced in rupees
Plans start at ₹0 and paid tiers from ₹49 a month, billed through UPI, cards, or netbanking with GST invoices.
No dollar conversion, no forex markup, and no international card required.

Want the full cryptographic design? Read how it works or see how we compare to Bitwarden.

Start protecting your passwords

Your passwords are only as safe as the system holding them.

keykavach encrypts everything in your browser before it reaches our servers. We mathematically cannot read your data, even if compelled.

Setup in 2 minutes

AES-256 encryption

Free forever plan

Works everywhere

Zero-knowledge architecture

AES-256 encryption

Client-side only

Export anytime

Questions, answered directly

The common questions we get from people evaluating a zero-knowledge vault.

Your passwords stay on your device.Your passwords stayon your device.

Strong passwords,made on your device.

Client-side only

Live strength analysis

Copy that clears itself

Password Generator

Lowercase

Uppercase

Numbers

Symbols

Sign in with a passkey,not a password.

Phishing-resistant by design

Biometric stays on your device

Nothing reusable to steal

Hand off a secretwithout handing over trust.

End-to-end encrypted

Control the window

Know when it's opened

Share a credential

Your share links

Security that holds even if we are breachedSecurity that holds even if we are breached

Client-side Encryption

Zero-Knowledge Architecture

Secure by Design

How It WorksHow It Works

Sign Up & Create Master

Unlock Your Vault

Store Credentials Securely

Sign Up & Create Master

Unlock Your Vault

Store Credentials Securely

Key Features

Key Features

Key Features

Key Features

Key Features

Don't take our word for it. Verify it.

We only receive ciphertext

600,000 PBKDF2 iterations

Leave whenever you want

Priced in rupees

Your passwords are only as safe as the system holding them.

Questions, answered directlyQuestions, answered directly

Can keykavach read my passwords?

What happens if I forget my master password?

Is keykavach free?

Is the password generator truly random?

Can I import passwords from another password manager?

Can I use keykavach on multiple devices?

How is this different from other password managers?

Strong passwords,made on your device.

Client-side only

Live strength analysis

Copy that clears itself

Password Generator

Lowercase

Uppercase

Numbers

Symbols

Sign in with a passkey,not a password.

Phishing-resistant by design

Biometric stays on your device

Nothing reusable to steal

Hand off a secretwithout handing over trust.

End-to-end encrypted

Control the window

Know when it's opened

Share a credential

Your share links

Don't take our word for it. Verify it.

We only receive ciphertext

600,000 PBKDF2 iterations

Leave whenever you want

Priced in rupees

Security that holds even if we are breachedSecurity that holds even if we are breached

Client-side Encryption

Zero-Knowledge Architecture

Secure by Design

How It WorksHow It Works

Sign Up & Create Master

Your passwords stay on your device.

Strong passwords,
made on your device.

Sign in with a passkey,
not a password.

Hand off a secret
without handing over trust.

Security that holds even if we are breached

How It Works

Questions, answered directly

Strong passwords,
made on your device.

Sign in with a passkey,
not a password.

Hand off a secret
without handing over trust.

Security that holds even if we are breached

How It Works