Free · Open source · Built on Google Drive
Your passwords live in your Google Drive. Not ours.
KeeperPass encrypts your entire vault in your browser and saves the result as a single file, inside a folder in your own Drive. There is no KeeperPass server — because there's nothing left for one to hold.
- AES-256-GCM
- Argon2id
- drive.file scope only
- no server
- AGPL-3.0
How it works
Three files. One folder.
Nothing else.
There's no account database, no user table, no company infrastructure standing between you and your passwords. When you sign in, KeeperPass asks Google for permission to see exactly one thing: a folder it creates for itself.
keeperpass/
└─ vault.json.enc encrypted
-
1
Sign in with Google
One click grants a single Drive scope —
drive.file— which only lets KeeperPass see files it creates itself. Everything else already in your Drive stays invisible to it. -
2
We create one folder
The first time you use KeeperPass, it creates a folder named
keeperpassand one file inside it. That's the entire footprint, for as long as you use it. -
3
You choose a secret
Your master secret never touches Google and is never transmitted anywhere. It's used once, inside your browser, to derive an encryption key.
-
4
Every change re-encrypts and re-uploads
Add a password, edit a note, delete an item — each change re-encrypts the whole vault and overwrites that one file. Google stores bytes it cannot read.
See it everywhere
One vault. Every screen.
The same encrypted file, opened from the web app, the browser extension, or your phone — nothing is ever synced anywhere but your own Drive.
Web app screenshot coming soon
Extension screenshot coming soon
Mobile screenshot coming soon
Under the hood
Locked before it ever
leaves your device
Your secret is run through Argon2id — a memory-hard key-derivation function built to resist GPU cracking, the same default security-focused apps like Bitwarden use. The resulting key encrypts your vault with AES-256-GCM, an authenticated cipher: tamper with a single byte of the ciphertext, and decryption fails outright instead of quietly returning garbage.
Google can host the file. Google cannot read it. Neither can anyone else — there's no third party holding the key, because there's no third party at all.
your secret →
correct horse battery staple 3f9a1c…e207b4 (256-bit key)
↓ Argon2id · 64 MiB · 3 iterations · p=4
↓ AES-256-GCM
U2FsdGVkX1+8mK/qN3vRw==:kX9dP…4Lz2Qa==
✓ this is what reaches Drive
Why this matters
Nothing to breach, because
there's nothing to hold
No company database
Password managers get breached because they're one juicy target holding everyone's vaults at once. KeeperPass has no vaults to lose — each one lives in its owner's own Drive.
Revoke it in one click
KeeperPass only ever holds a temporary access token, never your data. Remove its access from your Google Account and it's gone instantly — your vault file stays exactly where you left it.
Real breach checking
The security report checks every password against Have I Been Pwned using k-anonymity — only the first 5 characters of a SHA-1 hash ever leave your browser. Your actual password never does.
Still a real password manager
TOTP codes, a strong password generator, tags, multiple vaults, CSV import and export — everything you'd expect, built on an architecture most password managers don't have.
Everywhere you type a password
Get the browser extension
Unlock your vault and autofill logins from the toolbar, on whichever browser you use. Same encrypted file, same Drive folder — just quicker to reach.
Chrome
Not on the Web Store yet — build it from source in a couple of minutes.
Build & installEdge
Store listing in progress — check back soon.
In progressFirefox
Install straight from Firefox Add-ons (AMO).
Get the extensionFree. Open source. Always.
No plans. No paywalls. No catch.
$0
Free, forever
- No subscription, no premium tier, no feature paywall.
- Unlimited vaults and items, limited only by your own Drive storage.
- Free because there's no infrastructure to fund — you're already paying Google for Drive, if you pay for it at all.
Open source
Every line that touches your vault — the encryption, the Drive calls, the app itself — is public under the GNU AGPL-3.0. Read it, audit it, or fork it. Trust doesn't have to be a leap when you can just look.
View the repositoryOpen your first vault
Sign in with Google, choose a secret, and KeeperPass writes its first encrypted file in about two seconds.
Free, forever. No KeeperPass account — just the Google one you already have.