Design Philosophy
Calm software. Serious boundaries.
Oak Keyring does not try to manufacture trust with feature volume. It starts with vault structure, key lifecycle, and recovery boundaries.
Learn more ->Local-first TUI password manager
Oak Keyring
Your passwords stay local. Sync is yours to choose.
Oak Keyring is a local-first TUI password manager. The vault starts on your device; Google Drive sync is optional encrypted transport and backup that you control.
Oak Keyring
Items842
Compromised0
Review3
Your devicesEncrypted vault
Encrypted syncTransport only
Cloud boundaryNot trust root
EncryptionClient-side boundary
RecoveryKey-first lifecycle
TrustNo public audit claim
End-to-end encryptedSecrets are encrypted before sync begins.
Zero-knowledgeSync storage never receives your vault key.
Clean migrationBring existing passwords without lock-in.
Security Surface
Security you can inspect.
The public site only states boundaries that can be stated now: local-first design, transport is not the trust root, and no public audit claim yet.
Explore security ->Architecture
A vault model before product theater.
The narrative centers on encrypted vaults, device boundaries, sync boundaries, and recovery flow instead of premature cloud-service promises.
See architecture ->Notes
Short notes, not a blog launch.
Notes record project judgment and boundaries without fake article streams, fake dates, or public maturity signals.
Browse notes ->