hmalvee/EnigmaKeep

Offline, zero-knowledge password manager. Your vault stays on your device — no accounts, no cloud sync, no telemetry.

Maintainer: HM Alvee Hasan (@hmalvee)
Homepage: enigmakeep.com
Repository: github.com/hmalvee/EnigmaKeep
License: MIT

• Offline-first — no servers; nothing leaves the browser
• AES-256-GCM vault encryption with PBKDF2 (600k iterations)
• Opaque binary vault files (.dat) — high-entropy ciphertext only; no plaintext metadata banners
• Encrypted file manager — folders, upload, preview, and edit inside the vault
• Biometric unlock via WebAuthn / platform authenticators
• 12-word BIP39 recovery phrase with derived recovery key
• Built-in TOTP authenticator, secure notes, categories
• Password generator and strength meter
• Import / export for common password managers (CSV / JSON)
• PWA install for desktop and mobile
• Local encrypted snapshots for recovery if a save fails
• Auto-lock, unlock backoff, and secure clipboard clearing

Zero knowledge: All crypto runs in the browser. If the master password and recovery phrase are lost, the vault cannot be recovered by anyone — including the developer.

git clone https://github.com/hmalvee/EnigmaKeep.git
cd EnigmaKeep
npm install
npm run dev       # local development
npm run build     # production bundle
npm run preview   # preview production build

Deploy the contents of dist/ to any static host (Netlify, GitHub Pages, Vercel, etc.).

1. Choose a strong master password (minimum length enforced).
2. Save the 12-word recovery phrase offline and verify it.
3. Save the encrypted vault file when prompted (File System Access API on supported browsers).

1. Enter the master password, or use biometrics when enabled.
2. Decrypted data lives only in memory for the session.
3. Lock or idle timeout clears session secrets.

Use the built-in file manager to store encrypted files and folders alongside passwords and notes. Large vaults use a raw binary save path to avoid encoding blow-up.

Unlock with the recovery phrase if the master password is forgotten. Regenerating the phrase invalidates the previous one after verification.

• src/pages/LandingPage.tsx — marketing site
• src/App.tsx — unlocked vault shell
• src/crypto/ — encryption, vault format, recovery, device binding
• src/utils/vaultManager.ts — save / load / verify
• src/components/FileExplorer.tsx — encrypted file manager
• src/components/LoginScreen.tsx — unlock, biometric, snapshot restore

1. Fork and branch from main.
2. Keep branding consistent (EnigmaKeep).
3. Prefer accessible UI (keyboard, focus, ARIA on modals).
4. Document crypto changes clearly in the PR.
5. Open a PR against main with UI screenshots when relevant.

• Issues: https://github.com/hmalvee/EnigmaKeep/issues
• Discussions: https://github.com/hmalvee/EnigmaKeep/discussions
• Security: contact via the maintainer’s GitHub profile

Never paste recovery phrases or vault files into public issues.

EnigmaKeep — offline secrets, under your control.