Open-source alternatives to Keyguard App

KeePassDX is an Android password manager that opens, edits, and stores encrypted credential databases using the open KeePass 2.x file format. It keeps all password data stored locally on the device without requiring cloud sync or internet access, and supports multiple symmetric-key encryption algorithms including AES, Twofish, and ChaCha20 with Argon2 key derivation. The app unlocks the credential database by delegating authentication to the platform's biometric API, allowing users to bypass the master password entry using fingerprint or face recognition. It generates one-time passwords local

This project is a reactive, offline-first NoSQL database engine designed for JavaScript applications. It provides a robust framework for managing application state by synchronizing data across browsers, mobile devices, and server-side runtimes. By treating local storage as the primary source of truth, it enables applications to remain functional without network connectivity, automatically reconciling changes with remote backends once a connection is restored. The database distinguishes itself through a modular architecture that supports cross-environment synchronization and high-performance d

This project is a JavaScript library and SDK used to integrate web and mobile applications with cloud services. It serves as a bridge to backend providers for user authentication, binary object storage, and real-time data synchronization. The library provides a unified interface for managing cloud identity and access, executing queries and mutations against GraphQL endpoints, and consuming REST APIs with secure request signing. It also includes tools for accessing machine learning services for natural language processing and computer vision. Broad capability areas include offline-first data

Secretive is an SSH key manager that utilizes hardware-backed security modules to generate and store non-exportable private keys. It integrates with secure enclaves to ensure that sensitive cryptographic material remains within the hardware and cannot be exported from the device. The system implements a biometric authentication workflow, requiring fingerprint or wearable verification before a private key is released for signing operations. It also provides the ability to bridge signing requests to external hardware tokens for systems that lack a built-in secure enclave. The project includes

Buttercup is a cross-platform password manager and encrypted credential store designed to protect passwords and secrets across multiple operating systems. It functions as a secure vault for storing sensitive credentials, utilizing encryption for all data stored on local or remote devices. The application distinguishes itself through a provider-agnostic cloud synchronization model, which allows encrypted vault files to be synchronized between a local filesystem and various external cloud storage providers. The system maintains data security via client-side encryption and ensures data integrit

Books is double-entry accounting software designed for recording business transactions and managing a general ledger. It functions as an invoicing and billing platform to track accounts payable and receivable, and as a financial reporting tool for generating balance sheets and profit and loss statements. The application is built as an offline-first bookkeeping system that stores data locally during internet outages and synchronizes changes once connectivity is restored. It also includes a retail point of sale system to process immediate sales and record inventory movements. The software cove

KeeWeb is a web-based password manager and vault that allows users to open and edit encrypted databases through a browser interface. It functions as a cross-platform tool for managing password vaults using the KeePass database format. The application provides a self-hosted password vault that can be deployed as a single HTML file or via Docker. It integrates with remote storage providers using OAuth to synchronize encrypted database files across multiple devices. The system includes capabilities for secure credential generation, two-factor authentication management through time-based one-tim

Aegis is a mobile application designed to manage and store multi-factor authentication tokens. It functions as a local-first credential vault that generates time-based and counter-based one-time passwords to verify user identity across various online services. The application secures sensitive authentication data by employing authenticated symmetric encryption and hardware-backed key storage to protect credentials at rest. Access to the stored tokens is gated by system-level biometric authentication or password verification, ensuring that only authorized users can retrieve the generated secur

This project provides a comprehensive, self-hosted platform for zero-knowledge credential management and enterprise secrets orchestration. It functions as a secure vault that ensures all encryption and decryption processes occur exclusively on the client side, preventing the server from ever accessing plaintext data. By combining identity federation with robust access controls, the system enables organizations to centralize the management of passwords, passkeys, and sensitive infrastructure credentials. The platform distinguishes itself through its focus on both human-centric security and aut

This project is a cross-platform credential management suite designed to store sensitive information in encrypted local databases. It functions as a secure desktop application that provides a unified environment for organizing secrets, generating passwords, and managing multi-factor authentication tokens. By utilizing industry-standard file formats, the application ensures that stored credentials remain secure and interoperable across different operating systems. The software distinguishes itself through deep integration with hardware-backed security and system-level services. It supports phy

ssh2 is a JavaScript implementation of the SSH2 protocol for Node.js, providing the core components necessary to create secure clients and servers. It enables the establishment of authenticated sessions for remote server automation and secure communication. The project distinguishes itself by providing a complete suite of tools for identity management, including utilities for generating and parsing cryptographic key pairs and integrating with external authentication agents. It also functions as a tunneling proxy capable of routing TCP, HTTP, X11, and SOCKSv5 network traffic through encrypted

Fabric is a command-line interface and framework designed to integrate artificial intelligence reasoning into shell-based workflows. It functions as an orchestration tool that connects local data pipelines to remote artificial intelligence services, allowing users to automate content analysis and complex reasoning tasks directly from the terminal. The project distinguishes itself through a modular architecture that treats prompt patterns as version-controlled, reusable logic stored on the local filesystem. By utilizing standard input and output streams, it enables users to chain these analyti

Flux is a Kubernetes GitOps delivery tool used to automate application deployments by synchronizing cluster state with configurations stored in Git, OCI, or Helm repositories. It functions as a set of controllers that monitor desired state in external sources and continuously reconcile the live cluster to match those definitions. The system distinguishes itself through a multi-cluster management plane that coordinates application delivery across fleets of remote clusters from a central hub. It provides a dedicated mechanism for automated image updates, which scans container registries for new

TinyBase is a reactive data store and in-memory relational database designed for client-side state persistence. It serves as a local-first sync engine that merges distributed state using conflict-free replicated data types and logical clocks to ensure deterministic data convergence. The project features a schema validation library that converts external definitions from tools like Zod, Yup, and TypeBox into type-safe store definitions. It provides an infrastructure for real-time collaborative editing, utilizing synchronization with Automerge, Yjs, and PartyKit to maintain consistent state acr

This project is a Git credential helper that automates the storage and retrieval of authentication secrets for remote repository operations. It functions as an OAuth token manager and an operating system vault storage interface to ensure authentication secrets are encrypted at rest. The tool acts as a cross-platform authentication broker, enabling the sharing of secure credentials between a host operating system and a Linux subsystem. It also serves as an enterprise proxy gateway, routing authentication traffic through corporate proxy servers to reach restricted repository endpoints. The sys

Allinssl is a multi-platform certificate manager and ACME automator designed to handle the full lifecycle of security certificates. It provides a web-based management interface to orchestrate the issuance, renewal, and deployment of certificates across various servers and cloud environments. The system distinguishes itself through an orchestration engine that pushes certificates to diverse targets, including web application firewalls, server control panels, and remote hosts. It automates domain ownership verification using DNS challenges across multiple providers and employs an event-driven w

Colanode is a local-first collaboration platform designed for shared documents, chat, and databases. It provides a self-hosted suite for team collaboration and knowledge management, allowing users to maintain full control over their data and privacy on their own infrastructure. The platform is distinguished by a synchronization engine that uses WebSockets for real-time data broadcasting and a local-first approach to ensure work continues offline. It incorporates AI-powered retrieval through vector-based semantic search, enabling users to find information based on meaning across documents and

This project is a password management backend designed to store and synchronize encrypted credentials across multiple devices and client applications. It serves as a secure central server that enables the management of secret vaults and password data. The system supports self-hosted secret storage, allowing users to run a private vault on their own hardware to maintain control over their data. It facilitates cross-platform credential syncing to keep passwords updated in real time across various operating systems. The backend is built with a REST-based API gateway, token-based session managem

Semaphore is a centralized web-based platform designed for the orchestration and execution of Ansible automation. It provides a unified control plane to manage infrastructure operations, allowing teams to organize inventories, environment variables, and playbooks into reusable templates. The platform supports multi-tenant governance by isolating resources into projects, ensuring clear separation between different teams and infrastructure segments. The system distinguishes itself through a distributed task runner architecture that offloads automation workloads to independent nodes, enabling sc

FingerprintPay is an Android biometric payment bridge and credential manager that replaces manual password entry with biometric verification for checkout processes in compatible mobile applications. It functions as a tool to authorize payment transactions and automate credential entry through fingerprint verification. The system utilizes hardware-backed security to decrypt stored payment credentials and map biometric identities to encrypted data blobs stored within the device hardware security module. The project covers mobile payment security and automated credential entry by combining hard

Epicenter is a local-first knowledge management system and data orchestrator designed to structure information generated by large language models into validated schemas. It functions as a storage architecture that persists application data in human-readable files and databases to ensure user ownership and portability. The system distinguishes itself by projecting language model outputs into structured, schema-validated tables and utilizing conflict-free replicated data types to synchronize application state across multiple devices without a central server. This allows for offline access and c

Electric is a Postgres data synchronization engine and replication proxy designed to enable local-first software. It replicates data from Postgres databases to client-side stores in real time using logical replication, allowing applications to maintain a local embedded database for offline access and low-latency updates. The system distinguishes itself by using shapes to filter and authorize specific subsets of database rows and columns before streaming them to clients or edge workers. It further supports multi-user collaboration by integrating a conflict-free replicated data type framework t

GitBucket is a self-hosted Git platform and version control hosting service that provides a web interface for managing repositories, issues, and pull requests. Built with a Scala-based manager, it functions as a GitHub API compatible server, allowing it to integrate with external tools that rely on that specific industry schema. The platform distinguishes itself by integrating a Maven repository host for storing and retrieving Java build artifacts alongside source code. It also features a plugin architecture that enables the addition of custom logic and new functionality to the core system.

Dotenv-vault is a centralized platform for managing, synchronizing, and injecting encrypted environment variables across development, staging, and production environments. It functions as a secure vault that converts local configuration files into encrypted payloads, ensuring that sensitive credentials remain protected during version control and distribution. The platform distinguishes itself through its ability to maintain consistent configuration states across local machines and remote cloud infrastructure. It utilizes environment-specific key management and symmetric-key encryption to auth

Hoodie is a data synchronization framework and offline-first JavaScript backend designed to keep client-side data stores in sync with a remote backend. It provides a local-first persistence layer that allows applications to remain functional while offline by abstracting the client-side database. The system features a NoSQL backend interface that enables interaction with remote data stores without requiring custom server-side boilerplate code. This is supported by a modular driver system of pluggable backend adapters that connect the synchronization layer to various remote database providers.

This project is a knowledge base and collection of static resources for password manager development. It provides a centralized repository of data and rules used to identify website credential behaviors and password complexity requirements. The resource set includes a mapping of native application identifiers to web domains to facilitate credential sharing and a registry of website quirks to handle non-standard authentication flows. It also contains a system for grouping affiliated domains that share credentials to improve the accuracy of account suggestions. The project covers a broad range

andOTP is an open-source multi-factor authentication client for Android. It functions as a time-based and HMAC-based one-time password authenticator for managing two-factor authentication tokens. The application serves as an encrypted vault for authentication secrets, utilizing hardware keystores, passwords, or PINs to secure the account database. It is specifically designed to support automated backups by exporting account databases via system broadcasts for integration with external automation tools. The software covers the management of authentication tokens through QR code scanning and t