Most password managers today are cloud-first products wearing a privacy costume.
You create an account. You sync. You trust a company, their servers, their employees, their breach history, and their incentive to keep you inside their ecosystem forever. Even the “zero-knowledge” ones still require you to believe a lot of marketing claims you can’t independently verify.
I wanted something different.
Kryptix is a privacy-first, fully offline vault for passwords, recovery phrases, and high-sensitivity secrets. It runs on mobile (React Native + Expo) and desktop (Tauri 2 + React + TypeScript). Your data never leaves the device unless you deliberately export an encrypted backup. There are no accounts, no telemetry, no third-party servers, and no “optional” cloud sync that slowly becomes mandatory.
The source is public so anyone can audit the encryption, storage, and data handling instead of taking my word for it.
Why another password manager?
Because the existing options force a false choice:
- Convenient cloud managers that centralize your entire digital life
- Or clunky offline tools that feel like they were designed in 2012
Kryptix tries to be modern and local-first.
Three specialized vaults
Instead of treating everything as a generic “note,” Kryptix has three distinct sections:
| Section | Purpose | Special handling |
|---|---|---|
| Passwords | Everyday logins | Categories, favorites, generator, import/export |
| Recovery phrases | Crypto seed phrases | Word count awareness, show/hide, careful copy controls |
| Hardcoded | PINs, emergency codes, ultra-sensitive values | Decrypt-on-demand, per-entry copy permission |
This separation isn’t just UI sugar. Recovery phrases and hardcoded secrets get different UX treatment because a leaked seed phrase is catastrophic in a way that a leaked Netflix password isn’t.
Encryption & backup model
- Master password is the root of trust
- Biometrics (Face ID / fingerprint / Windows Hello / Touch ID) are a convenience layer only — they can only be enabled after a successful master-password unlock
- Full-vault backups use a custom .kryptix format: AES-256-CBC + SHA-256 key stretching + MAC for integrity
- Export is protected by a separate passphrase you choose
- Import supports both merge and replace modes
The application never sends vault contents anywhere. After install it works completely offline.
Transparency over marketing
Password managers demand an unusual amount of trust. The honest response is to make the code available for inspection.
Kryptix is source-available under the PolyForm Noncommercial License 1.0.0. This is deliberately not OSI open source. You can use, study, and modify it for noncommercial purposes. You cannot sell it, republish it as a commercial product, or use it commercially without a separate license.
I chose this license because I want the code to be auditable while still being able to sustain the project long-term. I’m not pretending it’s “fully open source” when the terms restrict commercial use.
Tech stack (for the curious)
Mobile
- React Native + Expo (TypeScript)
- Expo Router
- SecureStore + custom encryption utilities
- expo-local-authentication
- 14 languages with consistent LTR layout
Desktop
- Tauri 2 + React + TypeScript
- Shared @kryptix/core package (encryption, types, vault format)
- tauri-plugin-store + AES-256 encrypt-at-rest
- Biometric unlock via tauri-plugin-biometry
The core encryption and format logic lives in a shared package so mobile and desktop stay consistent.
Current status
- Mobile and desktop vaults are fully functional (Passwords + Recovery + Hardcoded)
- Biometric unlock on both platforms
- Full-vault encrypted backup/restore
- Multi-language support
- Import/export (including JSON/CSV for passwords)
- Categories on desktop
- Privacy Policy and Terms of Service published
Still on the roadmap: more hardening, independent security review, and polishing the remaining mobile settings links.
Try it / inspect it
Repository: https://github.com/nima-mehr/Kryptix
I’m not claiming Kryptix is perfect or that you should switch to it tomorrow. I’m claiming it is honest about its threat model, its limitations, and its license. In a space full of marketing claims, that feels like a useful contribution.
If you care about local-first tools, auditability, or just hate the idea of your seed phrases living on someone else’s servers, take a look. Feedback, security reports, and thoughtful criticism are all welcome.
Your secrets should stay under your control.
Top comments (0)