Local-first encrypted vault

Private by design.
Useful by default.

GitVault keeps your passwords, notes, 2FA codes, and SSH credentials with you. Encryption happens on your device; your private GitHub repository only receives ciphertext.

Open web app See how setup works

01: Encrypt on device
02: Sync ciphertext
03: No vault account

encrypted locally

GitVault password vault with grouped sample entries in dark theme

device private repository

One encrypted vault

Ready wherever you need it.

Web
Android
iOS
Windows
macOS
Linux

Download desktop & Android releases

A vault for actual work

One calm place for the sensitive parts of your day.

Not a pile of isolated utilities. GitVault keeps the credential, context, live code, and private note close together—then keeps the readable version on the device you unlock.

Credentials + 2FA

Logins and live codes, in the same private record.

Store the URL, username, password, notes, and optional TOTP secret together. Search quickly, copy deliberately, and let the clipboard clear itself afterwards.

Explore passwords and codes

GitVault password detail with a live TOTP code

Private notes

Working memory that stays yours.

Write Markdown, pin active context, connect ideas with wiki links, and keep daily notes or templates close without sending their plain text to a hosted notes service.

Explore encrypted notes

GitVault Markdown note editor with a checklist

Desktop AI Apps

Useful AI starts with a hard boundary.

GitVault Desktop can share only scoped notes with MCP-compatible apps. Passwords, TOTP data, SSH credentials, tokens, keys, PIN data, recovery data, and device-linking secrets stay out.

Read the AI Apps security model

Local app requestpermission gate

NotesScoped tags, explicit app approval, controlled writes

Allowed

Credentials + recoveryPasswords, codes, SSH, keys, tokens, PIN and recovery data

Never exposed

127.0.0.1 + stdio · lock or revoke to end access

Phone + terminal

Take the vault into the places you sign in.

Android adds autofill and a keyboard fallback for difficult login forms. Keep SSH connection details nearby when a terminal session is part of the work.

Android autofill SSH workflow

GitVault Android settings for autofill and connected devices

GitVault SSH terminal session on Android

The data path

A simple route for secrets.

Your repository is useful storage. It is not asked to become a password manager.

01
Write locally
Create a password, note, code, or SSH entry on a device you control.
02
Seal it first
GitVault applies authenticated XChaCha20-Poly1305 encryption before sync begins.
03
Store ciphertext
Your private repository receives encrypted files and sync history, not a readable vault.

Security, made legible

No hidden vault service. No ambiguous owner.

GitVault makes the trust boundaries visible, so you can see who is responsible for each part of your vault.

Review the security model

01Your device: Creates keys, encrypts records, and holds the unlocked vault session.
02Your repository: Stores encrypted vault files in the private GitHub repository you choose.
03GitVault: Has no hosted vault layer, account database, or readable copy of your secrets.
04You: Approve devices, protect the recovery phrase, and decide when sync belongs.

A quieter first setup

Bring your own key.
Bring your own repository.

Start a vault in the web app, protect it with a PIN, and save the recovery phrase outside GitVault. Connect a private repository when you want encrypted backup or another trusted device.

Open web app Read the complete quick start

1
Create & recover
Make the vault, save the recovery phrase externally, and set a PIN.
2
Choose private storage
Prepare a dedicated private GitHub repository when you want sync.
3
Verify the boundary
Run sync and confirm the repository contains encrypted files, not readable entries.

Your vault, your rules

Keep the useful parts close.

Open source, local first, and ready when you are.

Open GitVault View source

Private by design.Useful by default.