Keyring 0.51.0 beta

Your digital keys. Only yours.

Keyring is a password and passkey manager for desktop Chromium browsers that encrypts everything on your device before it syncs, so the server only ever holds ciphertext.

Install
Update
Permissions
Security status
Release identity
Privacy

Download Keyring

Download Keyring 0.51.0

Browser: Desktop Chromium 148 or newer. Tested in Brave and Chrome; other desktop Chromium browsers may work but are unsupported. Vivaldi receives no dedicated compatibility testing or fixes.
File: keyring-chromium.zip, 2.3 MB (2,379,679 bytes)
SHA-256: 9c47a05e28aa0f60d296206c7a7caa05f2b519c27ff3b9b5b561fa89f11d5feb
Price: Free. No account needed.
Install: Developer mode and Load unpacked, step by step below. A direct download has no automatic updates.

No installation at all: open the Keyring web app, which runs the same engine in a browser tab.

What Keyring does

One encrypted vault for the credentials you move between sites, devices and browsers.

One encrypted vault

Logins, secure notes, cards, identities, SSH keys, authenticators and passkeys, across as many keyrings as you need, with search, sorting, pinning and a Trash you can restore from. A local monitor flags weak and reused passwords and logins without two-factor authentication.

Autofill without page-load filling

Keyring never fills on page load and never submits a form. Click into a login field and it lists the logins saved for that site in a panel the page cannot read; a click or Enter fills the one you pick. By default, focusing a sign-in field, or a sign-in form that opens after your click, fills the login you chose last time on that site, or its only login, at once (see the Fast lane below). Saving a new login asks for an explicit confirmation first.

Saved usernames work without a saved password, including email-first SSO and incomplete imports. Only values present in the selected login are filled; missing values leave the corresponding page fields unchanged. Keyring never clicks Next.

Passkeys

Create passkeys in Keyring and sign in with them, including passkey autofill from the login field's list. A sign-in shows Keyring's confirmation window, saving a new passkey always asks, and the browser's own passkey prompt stays available as the fallback.

One-time codes

Keep TOTP authenticators beside their logins and see the current code. Keyring can also enter the current code of a site's linked authenticator into its verification-code field, including the code field of a sign-in form it has just filled.

Imports from other managers

Bring in Bitwarden (CSV, JSON, password-protected JSON or ZIP), Proton Pass (CSV, JSON or ZIP) and Apple Passwords (CSV) exports. Every import is inspected and shown for review before anything is written; ZIP attachments are listed but not imported. An item Keyring cannot store, such as a card without a number, is left out and named, and everything else imports. "Dedup my keyring" finds entries that are the same, takes an encrypted backup first, shows what it would merge, and moves the copies to Trash, where they can be restored. Browse every preview row, filter entries that need review, and see why a group stayed separate. A merge that cannot preserve all saved data leaves its originals active.

CSV password merge and sync

Merge an Apple Passwords CSV in the extension or web app. Recommended merge first downloads a verified encrypted backup using the unlocked session, without asking for your master password. Restoring that backup requires the vault password or recovery phrase from when it was saved. It groups logins by domain and exact username, updates passwords, combines repeated data throughout the selected active keyring, and moves duplicate logins to recoverable Trash. Previous passwords stay in history; conflicting CSV passwords ask for review. Preview before applying. If backup preparation fails, Keyring explains which step needs attention before any merge can run.

The original Conservative strategy updates a unique exact URL and username match; conflicting authenticator settings ask for review. It preserves existing titles, tags, fields and notes, appends distinct notes, and never deletes items missing from the CSV. Choose a file each time; there is no automatic file watcher.

Encrypted backup and recovery phrase

Setup shows a 24-word recovery phrase once, with a QR code, and you can view it again after entering your Keyring password. An encrypted backup file under its own backup password moves a complete snapshot without plaintext. Restore up to 100,000 items from a backup with at most 64 MiB of decrypted data. Interrupted restores resume without adding duplicate copies or exposing partial entries. Backups containing unfamiliar item data keep their original keyring and item identities when restored. Restores never replace existing entries.

End-to-end encrypted sync

Keyring syncs through api.lifub.com, which stores only ciphertext. There is no account and no e-mail address: a keyring proves itself with a cryptographic challenge. On another browser, "Recover an existing Keyring" with your recovery phrase brings it back. Starting a new keyring's sync can take your browser a moment of proof of work, and one network starts at most ten a day, which keeps free sync from being flooded.

Leaving stays possible

An unencrypted Bitwarden JSON or Apple Passwords CSV export is available behind an explicit warning, and a Bitwarden JSON export can be mirrored onto Keyring as a reviewed plan. Repeated Bitwarden updates preserve saved creation dates. Passkey private keys are never exported.

Single purpose

No AI, no analytics, no advertising, no third-party service and no remotely executed code. The only outside control is the agent control switch described below, which never releases a secret. Keyring can also switch off the browser's own offer to save passwords, so only one manager asks.

Fast lane: shortcuts with their cost

Keyring's options gather the switches that trade a safeguard for speed in one "Fast lane" section, each with its cost written beside it. Off is safer. Four are on by default; passkey sign-in without confirming is off by default.

Fill on focus or when a sign-in form opens On by default

Clicking into a sign-in field, or clicking a button that opens a sign-in form, fills the login you chose last time on that site, or its only login, without another click. A site's www address and its bare domain count as the same site, and a login saved for another address of the site fills there once you have picked it from the list. Any other login still takes a pick from the list.

Cost: the site receives that login as soon as its field is focused or its sign-in form appears after your click, including a field that is already focused when Keyring's page helper starts.
Fill one-time codes On by default

Enters the current code of the site's linked authenticator into a verification-code field, and into the code field of a sign-in form as soon as Keyring fills its login.

Cost: the code reaches the page without a separate copy step.
Stay unlocked when the browser restarts On by default

A browser restart or extension reload resumes the unlocked session until the auto-lock deadline (15 minutes by default), which a restart never resets. Lock and auto-lock always end it.

Cost: a wrapped key and the key that opens it sit together in the browser profile meanwhile, so anyone with a copy of that profile could open Keyring without your password.
Sign in with passkeys without confirming Off by default

While Keyring is unlocked and the site's tab is in front, a sign-in with the site's only passkey completes without Keyring's window; with several, the window opens straight at the account list. Saving a new passkey still asks. It needs "Ask for the Keyring password at every passkey use" off.

Cost: any script on that site could sign in as you without a click.
Agent control On by default

An agent channel for a companion extension you load yourself in Developer mode; a downloaded or store install admits no other extension. Where the browser offers page tools, a browser agent on Keyring's own page can use the same controls, except the four that take a file: import, set-up, unlock and recovery. The channel can report status, counts and settings, search login titles and website hosts, change settings other than this switch, lock Keyring, unlock it or set up a new Keyring with a password the companion attaches as a file, recover an existing synced Keyring with a file holding the password and the recovery phrase, fill a saved login into a sign-in form on that login's own site, import a file and reset this browser's Keyring after an exact confirmation. Recovery is refused while a Keyring is open on the profile. In the options it reads "Allow your automation extension to control Keyring".

CSV sync has separate preview, apply, cancel and status tools. Page tools use a file you select locally. A companion uses a paired local acli helper that encrypts the CSV before it enters the bridge, and verifies encrypted replies. Pairing requires your confirmation in Keyring. Neither preview nor status applies changes; applying requires explicit confirmation. Previewed CSV data stays in memory for at most five minutes and is discarded when Keyring locks or restarts.

Cost: what you allow can unlock, recover, fill, reconfigure or reset Keyring here, and anyone who can read the password file - or the recovery file, which also holds the recovery phrase - the companion attaches can open Keyring. It can never read a password, one-time code, passkey or recovery phrase.

The server stores ciphertext, not your secrets.

Encryption and decryption happen in your browser, in a Rust core compiled to WebAssembly. Titles, usernames, URLs, passwords, notes, item types and one-time-code secrets are encrypted before anything syncs. A high-entropy recovery phrase enrolls a browser; a separate local Keyring password unlocks it day to day and is never sent anywhere.

The sync server still sees opaque identifiers, ciphertext sizes, revisions, timing and your IP address. There is no server-side reset that can decrypt your vault: without the recovery phrase, an enrolled browser you can still unlock, or an encrypted backup, the data cannot be recovered.

1Recovery secret256 random bits, written as 24 words and kept by you

2User root keyRandom; wrapped by the recovery secret, and by your local password through Argon2id

3Vault keySeparate for each keyring

4Per-item data keyA fresh key and nonce for every encrypted record

One engine, two surfaces

The browser extension and the web app run the same Rust engine against the same ciphertext. Each keeps only its interface and browser integration in JavaScript.

Keyring for desktop Chromium

A standalone, single-purpose browser extension running the Rust core as WebAssembly.

Requires Chromium 148 or newer on a desktop. Keyring's test suites run in Brave and Chrome; other desktop Chromium browsers may work but are unsupported. Vivaldi receives no dedicated compatibility testing or fixes. Mobile browsers are not covered.
Page helpers stay inert while Keyring is locked, load in the top frame of https pages, fill only a focused login field or a sign-in form that opens after your click, and never submit a form.
The vault auto-locks after inactivity, 15 minutes by default.

The Lifub web app

The same engine and client run in a Web Worker in an ordinary browser tab.

Recover a keyring with its 24-word phrase, no extension needed.
CSV password merge and sync works here too. Vendor import and Bitwarden sync stay in the extension.
Open the web app

Failure should be visible and recoverable

Keyring prefers boring, testable recovery paths over silent data loss.

Conflicts become copies

Concurrent edits, unknown formats and records that fail to decrypt are preserved for review instead of being silently overwritten or dropped.

Offline edits wait

An edit made without a connection stays encrypted in a local outbox and syncs when the connection returns. Deleted items go to a Trash you can restore from.

Restores resume

A restore or import interrupted by a browser worker restart pauses safely; select the same file again to resume from its journal.

Permissions and why Keyring needs them

Keyring asks for exactly these permissions and no optional ones.

storage: Keeps the encrypted vault, its settings and, while "Stay unlocked when the browser restarts" is on, the wrapped restart key in this browser profile. None of it is used for analytics or advertising.
scripting: Registers Keyring's own bundled page-helper scripts at runtime, for the top frame of https pages, so it can add and remove them; the passkey scripts are registered only while Passkeys is on. Keyring never downloads, evaluates or injects server-supplied code.
alarms: One alarm enforces the inactivity auto-lock, because the browser can stop the background worker before an in-process timer fires.
tabs: Reads the current tab's address to match it against your saved logins, and opens Keyring's own page. Keyring keeps no record of where you browse and sends no tab, address or history data.
clipboardRead: Before clearing a password or recovery phrase Keyring copied, it reads the clipboard once to check the value is still there, so it does not erase something you copied since. The value is compared in memory and never stored or sent.
favicon: Shows each entry's site icon from the browser's own local icon cache, with no request to the website, an icon service or Lifub. You can turn site icons off.
privacy: Used for one browser setting only: the browser's own offer to save passwords, which Keyring turns off by default so you are not asked twice. Turning the option off hands the setting back.
Access to all sites (<all_urls>): A password manager cannot know in advance where you will sign in. Page helpers stay inert while Keyring is locked, and off the page Keyring talks to one fixed service: api.lifub.com/keyring/v1, carrying ciphertext. It sends no page content, page addresses or browsing history.

Install Keyring

Download keyring-chromium.zip and check its SHA-256 against the value under Release identity before you open it: shasum -a 256 keyring-chromium.zip on macOS, sha256sum keyring-chromium.zip on Linux, or Get-FileHash keyring-chromium.zip -Algorithm SHA256 in PowerShell on Windows. Stop if the values differ.
Extract the ZIP into a new, empty folder you keep, somewhere only you can write. The browser loads Keyring from that folder every time it starts, so leave it in place.
Open chrome://extensions (brave://extensions in Brave).
Turn on Developer mode. If your organization has disabled it, ask its administrator rather than working around the policy.
Select Load unpacked and pick the extracted folder, the one that contains manifest.json.
Pin Keyring to the toolbar from the extensions menu, then open it.
Choose Create encrypted Keyring and set a local Keyring password of at least 8 characters. Write down the 24-word recovery phrase it shows and keep it offline: anyone with those words can open your keyring, and without them a new browser cannot reach your synced keyring. Already have a keyring? Choose Recover an existing Keyring and enter your phrase instead.

Update Keyring

A direct download has no automatic updates and makes no update checks. Check this page for a new version; latest.json names the current release.

Make an encrypted backup first: in Keyring's Settings, open Export and choose Create backup. Let pending changes finish syncing.
Download the new version and check its SHA-256 as during installation.
Replace the files in the same folder with the new version's files. Do not load a second folder and do not remove the extension.
Open the extensions page and press Reload on Keyring. A reload locks Keyring unless "Stay unlocked when the browser restarts" is on; unlock it with your Keyring password and check the version.

Keep the folder in place. Moving it, or removing the extension, gives you a new, empty Keyring in that browser profile, because the browser ties an unpacked extension's identity and data to its folder. What had synced stays recoverable with "Recover an existing Keyring" and your recovery phrase, and an encrypted backup also brings back what had not synced yet. That is why the backup comes first.

The browser does not verify the integrity of an unpacked extension's files, so only the published SHA-256 proves the download is the one released here. Anything that can change the files in that folder can change what Keyring does: keep the folder where only you can write.

Your data

Each browser profile has its own Keyring, stored in that profile's extension storage and IndexedDB. A new profile or browser starts empty until you recover your keyring there.
Your Keyring password, recovery phrase and keys never leave your device.
Sync carries ciphertext only, plus the metadata needed to route and order it. Your IP address reaches our servers as with any HTTPS request and is kept in security and access logs for up to 30 days.
"Reset this browser's Keyring" deletes everything Keyring keeps in this browser; your recovery phrase brings the synced keyring back.

Details: Keyring in the privacy policy.

Security status

Keyring is beta software and has not yet had an independent security assessment. Its behaviour may still change. Keep another copy of anything you cannot afford to lose.

Keyring cannot protect your data against:

a device or browser that is compromised while Keyring is unlocked, including malicious system software, keyboards or screen recorders;
a site reading a credential you fill into its page;
a recovery phrase kept where someone else can reach it;
a weak Keyring password or backup password guessed offline from a copied browser profile or backup file;
a copy of the browser profile taken while "Stay unlocked when the browser restarts" holds a session.
data the sync server loses or deletes when no browser and no encrypted backup still holds a copy.

Found a vulnerability? Report it to info@lifub.com. Keyring's licence permits good-faith security research on your own installation, provided you report what you find before disclosing it publicly, allow reasonable time for a fix, and do not access or alter data that is not yours or degrade a service for others.

Release identity

Version: 0.51.0
File: keyring-chromium.zip
Size: 2.3 MB (2,379,679 bytes)
SHA-256: 9c47a05e28aa0f60d296206c7a7caa05f2b519c27ff3b9b5b561fa89f11d5feb
Source commit: 05e610902ccfb351a2ebe44a5034c21b9990154d
Requires: Desktop Chromium 148 or newer

Release manifest / SHA-256 checksums / Licence / Third-party notices / Latest release

The versioned address keeps this release's bytes unchanged. The ZIP is the same package the Chrome Web Store receives, not a variant.