GitVault
GitHub Open app

Product documentation

Documentation

Product
GitVault
Applies to
Web, Android, and Desktop
Updated
July 29, 2026

GitVault is an open source password manager for end users who want encrypted storage without a hosted backend. Your vault is encrypted on the device, then synced as ciphertext to your own private GitHub repository.

Start with confidence

Make the first vault boring—in a good way.

Begin with recovery and unlock, then add encrypted sync only when you need another device.

  1. 01Quick startCreate the vault and save recovery.
  2. 02Set up syncConnect private encrypted storage.
  3. 03Add a deviceUse a trusted-device link.

What is GitVault

GitVault stores passwords, private notes, TOTP authenticator secrets, and SSH credentials. It runs on the web and Android, and uses connected-device flows to keep trusted devices aligned.

End-user setup

No business verification or hosted service account is required. A normal GitHub account and private repository are enough for sync.

Local-first vault

Secrets are encrypted before sync. GitHub stores vault files, not readable passwords, notes, or recovery data.

Web and Android

Use the web app on desktop, Android APK on mobile, and device linking to keep trusted devices aligned.

Recovery owned by you

The recovery phrase and GitHub token access are what let you restore a vault. GitVault cannot recover secrets without them.

Common tasks

Documentation map

Tutorials

First-run paths from empty vault to synced vault.

  • Quick start - Create your vault, save recovery, set a PIN, add an item, and connect encrypted sync.
  • GitHub sync setup - Prepare a private repository and fine-grained token for encrypted GitVault storage.

How-to guides

Task-oriented procedures for daily vault use.

  • Passwords - Add, group, search, copy, edit, delete, and fill password entries.
  • Notes - Create private notes, checklists, tags, colors, pinned notes, archive, and search.
  • AI Apps and MCP - Connect MCP-compatible AI applications to approved GitVault notes with per-app permissions.
  • 2FA codes - Store TOTP secrets, organize codes by group, copy live codes, and handle countdown timing.
  • TOTP import - Import authenticator secrets from manual secrets, otpauth links, or QR codes when supported.
  • SSH credentials - Save SSH hosts, ports, usernames, passwords, keys, and Android terminal entries.
  • Autofill and GitVault Keyboard - Enable Android autofill and GitVault Keyboard for easier password entry in other apps.

Reference

Stable behavior, support, security, settings, and sync details.

  • Platform support - Feature availability across web, Android, Windows, macOS, and Linux.
  • Sync behavior - How encrypted GitHub sync, auto-sync, conflict handling, deletion tombstones, and device checks work.
  • Security model - How local encryption, unlock, biometric, duress mode, clipboard clearing, storage, and trust work.
  • Settings - Configuration reference for PIN, biometric, auth interval, sync, clipboard, autofill, keyboard, theme, devices, and recovery.
  • Connected devices - Link, approve, recognize, remove, and recover trusted web and Android devices.

Recovery

Ways to restore access and regain trusted-device status.

  • Recovery flows - Restore with trusted-device approval or recover after losing every trusted device with old and new GitHub tokens.

Operations

Install, update, release, and verification procedures.

  • Install and update - Open the web app, install Android APKs or Desktop archives, verify release assets, and understand version updates.
  • Release verification - Verify APK and Desktop archive checksums plus the deployed web version before trusting an update.

Troubleshooting

Symptom-led diagnosis and recovery checks.

  • FAQ and common mistakes - Answers for common setup, sync, device trust, recovery, autofill, and release questions.
  • Troubleshooting - Diagnose sync, token, unlock, device, autofill, biometric, web version, and Android issues in order.

Browse topics

Release and status

Use GitHub Releases for Android and Desktop downloads and /app/ for the web app. Static docs deploy from the same repository through GitHub Pages.