Google Drive
- Access
drive.file— only files KeeperPass creates- Location
keeperpass/vault.json.enc- Works in
- Web app, browser extension, mobile app
Revoke any time in your Google account permissions.
New
Dropbox support in the web app
Your passwords live in your cloud. Not ours.
KeeperPass encrypts your entire vault in your browser and saves it as one file in your own Google Drive or Dropbox. There is no KeeperPass server — because there's nothing left for one to hold.
- AES-256-GCM
- Argon2id
- drive.file scope only
- Dropbox app folder only
- no server
- AGPL-3.0
My Drive keeperpass vault.json.enc
0
KeeperPass servers holding your data
0
KeeperPass accounts to create or lose
256-bit
key derived from your secret with Argon2id
$0
forever — free and open source under AGPL-3.0
How it works
One folder. One file. Nothing else.
No account database, no user table, no company infrastructure between you and your passwords. When you sign in, KeeperPass asks Google or Dropbox for permission to see exactly one thing: a folder it creates for itself.
-
01
Sign in with Google or Dropbox
With Google, one click grants a single Drive scope —
drive.file— which only lets KeeperPass see files it creates itself. With Dropbox, access is limited to KeeperPass's own app folder. Everything else in your storage stays invisible to it. -
02
We create one folder
The first time you use KeeperPass, it creates a folder named
keeperpass(in Dropbox, underApps) and one file inside it. That's the entire footprint, for as long as you use it. -
03
You choose a secret
Your master secret never touches Google or Dropbox and is never transmitted anywhere. It's used inside your browser to derive an encryption key.
-
04
Every change re-encrypts and re-uploads
Add a password, edit a note, delete an item — each change re-encrypts the whole vault and overwrites that one file. Your provider stores bytes it cannot read.
-
05
Switch providers whenever you like
In the web app, Settings → Storage → Move Vault copies your vault between Google Drive and Dropbox. The copy is checked before anything else changes, and the old file is renamed, never deleted.
Your device
Your browserwhere the vault is opened and edited
Argon2idyour secret becomes a 256-bit key
AES-256-GCMthe whole vault, sealed and signed
ciphertext only
Your Google Drive or Dropbox
vault.json.encbytes your provider can store, but not read
Your storage, your choice
Google Drive or Dropbox. Same vault, same encryption.
Pick the account you already trust. KeeperPass asks each one for the narrowest access it offers, and the file it writes is unreadable to both.
Dropbox
- Access
- App folder only — nothing else in your Dropbox
- Location
Apps/keeperpass/vault.json.enc- Works in
- Web app (the extension and mobile app use Google Drive for now)
Revoke any time in your Dropbox connected apps.
Move your vault between them
Settings → Storage → Move Vault. Your vault is copied and checked, and only then is the old file renamed. If anything fails, nothing is changed.
See it everywhere
One vault. Every screen.
The same encrypted file, opened from the web app, the browser extension, or your phone — nothing is ever synced anywhere but your own cloud storage.
Web app screenshot coming soon
Extension screenshot coming soon
Mobile screenshot coming soon
Under the hood
Locked before it ever leaves your device.
Nothing to breach, because there's nothing to hold. Google or Dropbox can host the file. Neither can read it — nor can anyone else, because there's no third party holding the key.
Argon2id + AES-256-GCM
Your secret is run through Argon2id — a memory-hard key-derivation function built to resist GPU cracking, with the same parameters Bitwarden uses. The key then seals the vault with AES-256-GCM: tamper with a single byte, and decryption fails outright instead of quietly returning garbage.
secretcorrect horse battery staple3f9a1c…e207b4 (key)
Argon2id64 MiB · 3 iterations · p=4
AES-256-GCMfresh 12-byte nonce per save
to your cloudU2FsdGVkX1+8mK/qN3vRw==…
No company database
Password managers get breached because they're one juicy target holding everyone's vaults at once. KeeperPass has no vaults to lose — each one lives in its owner's own storage.
Revoke it in one click
KeeperPass only ever holds a temporary access token, never your data. Remove its access in your Google or Dropbox settings and it's gone instantly — your vault file stays exactly where you left it.
Real breach checking
Every password is checked against Have I Been Pwned using k-anonymity — only the first 5 characters of a SHA-1 hash ever leave your browser. Your actual password never does.
No tracking in the app
The web app and the extension contain no analytics, no telemetry, no crash reporting, and no advertising code. See exactly what moves where in the privacy policy.
-
TOTP codes
Two-factor codes next to the login they protect.
-
Password generator
Strong, unique passwords in one click.
-
Tags
Group items your own way.
-
Multiple vaults
Keep personal and work apart.
-
CSV import & export
Bring your passwords in, take them out.
-
Security report
Spot breached and reused passwords.
Everywhere you type a password
Get KeeperPass on every device.
Unlock your vault and autofill logins from the toolbar, or carry it on your phone. Same encrypted file — just quicker to reach.
Web app
Nothing to install. Works with Google Drive or Dropbox.
Open the vaultFirefox
Install straight from Firefox Add-ons (AMO).
Get the extensionChrome
Not on the Web Store yet — build it from source in a couple of minutes. Edge listing in progress.
Build & installMobile app
Your vault in your pocket — build and install from source.
Build & installThe browser extension and the mobile app currently sign in with Google Drive. Dropbox is available in the web app.
Free. Open source. Always.
No plans. No paywalls. No catch.
$0
Free, forever
- No subscription, no premium tier, no feature paywall.
- Unlimited vaults and items, limited only by your own Google Drive or Dropbox storage.
- Free because there's no infrastructure to fund — you're already paying Google or Dropbox for storage, if you pay for it at all.
Open source
Every line that touches your vault — the encryption, the Google Drive and Dropbox calls, the app itself — is public under the GNU AGPL-3.0. Read it, audit it, or fork it. Trust doesn't have to be a leap when you can just look.
Can KeeperPass read my passwords?
No. Your vault is encrypted in your browser before it is uploaded, with a key derived from a secret that never leaves your device. We never receive the vault, and Google or Dropbox only ever stores ciphertext.
Can it see the other files in my Drive or Dropbox?
No. On Google Drive it uses the drive.file scope, which only covers files KeeperPass creates. On Dropbox it is limited to its own app folder, Apps/keeperpass.
What happens if I forget my secret?
Nobody can recover it — not us, not Google, not Dropbox. "Forgot your secret?" on the unlock screen starts a fresh, empty vault and keeps the old file renamed in your storage, in case the secret ever comes back to you. Use the export feature to keep your own backups.
Can I switch from Google Drive to Dropbox?
Yes, in either direction. In the web app, open Settings → Storage → Move Vault. The vault is copied and checked first; only then is the old file renamed, never deleted.
Does Dropbox work in the extension and mobile app?
Not yet. Dropbox is available in the web app today; the browser extension and the mobile app currently sign in with Google Drive.
Is it really free?
Yes. There is no subscription, no paid tier, and no payment of any kind. The source code is public under the GNU AGPL-3.0.
Open your first vault.
Sign in with Google or Dropbox, choose a secret, and KeeperPass writes its first encrypted file in about two seconds.
No KeeperPass account — just the Google or Dropbox one you already have.