A password manager that reads and writes KDBX database files entirely in your browser. A multi-page application of single-purpose HTML pages — no native application install, no web server, and no network: just your KeePass database file viewed and edited in your browser tab's memory. This repo is the source for the whole thing: the crypto primitives, the KDBX parser, the browser app, and the tooling that builds each page into its own distributable HTML file. The app and every offline page use no external dependencies at all; the optional cloud connectors are the sole exception, and only to load the sign-in provider's own SDK — see Trust.
packages/ argon2, chacha20, kdbx: the cryptographic and file-format building blocks
pages/ the browser app itself (what actually ships)
tools/build/ the bundler and inliner that produce the distributables
- Local: download the latest files from Releases and open
index.htmlin any modern browser. Follow the links. Upload your KeePass database file and go. - Online: visit keepass-web.app — the exact same files, served by GitHub Pages, so you can use them without downloading first (handy on a machine that isn't yours). Every feature is identical to the download, the cloud-storage connectors included.
Refer to Reproducing a build to verify for yourself how these files are built.
The whole point of shipping as a multi-page application of un-minified HTML pages is that you don't have to take our word for anything. Read the source, watch the network tab, verify the release checksum. The app (0x67.html) and every offline page load nothing but their own inlined code — on those pages the network tab stays empty. A cloud connector is the one exception: it is inherently online, and to browse your files it loads the SDK of the very provider you chose to sign in to (e.g. Google's Picker from apis.google.com in the Drive connector) — never code from any party unrelated to that provider. Even then, your master password and every byte of decryption stay inside the embedded 0x67.html iframe, which loads no external code; the connector only ever handles the sign-in and your still-encrypted database. The design philosophy behind that approach and the org's overall rationale is written up in the org level. For how this repo's own pipeline enforces it, see Pipeline and Releases.
See Contributing for how to report a bug, propose a change, and build/test/lint locally. See each package's own README.md/SPEC.md (packages/argon2, packages/chacha20, packages/kdbx) for the algorithms implemented and why.
This project is MIT-licensed and entirely free — including the connectors that open your database from your own cloud storage provider — and open to everyone with no sponsorship gate. We don't provide storage; you connect to a provider you already have. GitHub Sponsors funds ongoing development and security audits; it is an invitation, never a paywall. See Licensing for how that works.