KeyholeSSH-based secret manager

Store and retrieve secrets using your existing SSH key — no new credentials, no browser, no agent to install.

Ed25519 Encryption

Secrets are encrypted at rest using AES-256-GCM with keys derived from your SSH agent signature via HKDF. Your private key never leaves your machine.

SSH-Native

No new credentials to manage. Connect with your existing Ed25519 SSH key and agent. Single-use invite codes handle user registration.

Shared Vaults

Create shared vaults for teams. Each member gets an individually wrapped copy of the vault key — revoking a member never requires re-encrypting secrets.