Keygrain — Keygrain

Your master secret never leaves your device. No vault, no server-side secrets.

Keygrain derives unique passwords deterministically from your master secret, email, and site name. No password database is needed — the same inputs always produce the same output.

HOW IT WORKS:
Your master secret is strengthened with Argon2id (64 MiB, 3 iterations), then combined with your email and site name using HMAC-SHA256. Same inputs = same password, every time.

FEATURES:
• Deterministic — same inputs, same password, on every device
• TOTP — derive or import 2FA codes
• SSH keys — derive Ed25519 keys deterministically
• Crypto wallets — BIP-85 mnemonic derivation
• Encrypted sync — AES-256-GCM encryption before transmission
• Autofill — Ctrl+Shift+K or context menu
• Per-site customization — length, symbols, counter rotation
• Works offline — no internet needed for derivation
• Auto-lock and PIN lock
• Import from other password managers via CSV export
• Self-hostable sync server (Docker)

PRIVACY:
• Master secret never stored or transmitted
• No analytics, no tracking, no telemetry
• Self-hostable
• Open source