Hey Product Hunt 👋 I built KeeperPass because I wanted a password manager whose security model I could verify, not just trust. Every breach you read about has the same shape: one company holding millions of vaults in one place. The encryption is almost never the weak link. The concentration is. One database, one target, one bad day. So I removed the company. There's no KeeperPass server. Your vault is a single encrypted file in your own Google Drive, encrypted in your browser before it ever leaves. The master secret is never transmitted, so the only thing Google receives is ciphertext. Bytes they can store but can't read. You can verify this yourself. Open your network tab and the only requests go to Drive's API, with your own token. One detail I'm proud of: it requests a single OAuth scope, drive.file. That scope lets an app see only the files it created itself. Your documents, photos, backups, everything else in your Drive is invisible to it. Not because I promise to ignore it, but because Google's OAuth layer won't let it look. The honest tradeoff: there's no password recovery. If you lose your master secret and every copy of the vault file, the data is gone. I chose that on purpose. A recovery flow requires someone to hold a recovery key, and that someone becomes a target, a policy, and a point of failure. It's the cost of the architecture, and I'd rather state it plainly on the launch page than bury it in a help article. What it does today: autofill via the Firefox extension (Chrome is build-from-source for now), TOTP codes, a password generator, tags, multiple vaults, CSV import/export, and breach checking via Have I Been Pwned using k-anonymity. Your password never leaves the browser. Free, AGPL-3.0, no premium tier. Happy to answer anything about the crypto, the Drive scope, the missing recovery, or what's not built yet. Especially that last one. Tell me what's wrong or what's missing and I'll take it seriously.

KeeperPass

A password manager with no server. Nothing to breach.

A password manager with no server. Nothing to breach.