Your self-hosted secrets vault.
kbox is a CLI-first, end-to-end encrypted vault for passwords, API keys, SSH credentials, and secure notes.
Credential vault
Store passwords, API keys, SSH keypairs, and notes — all encrypted client-side before they reach the server. Organise, search, and retrieve secrets instantly from the CLI or web UI.
SSH management
Run kbox ssh serverA and connect instantly — kbox fetches the host, user, and private key from your vault, writes a temp keyfile, proxies to ssh, then cleans up. No manual key juggling.
Secure sharing
Share individual records with other users using cryptographic access control. Access can be revoked at any time — revoking re-encrypts the record with a new key that the evicted user can never derive.
How encryption works
-
—
Your master password deterministically derives a Curve25519 keypair in your browser using Argon2id. It is never sent to the server.
-
—
A second device keypair is generated randomly and stored only in your browser's IndexedDB.
-
—
A shared secret (SUS) derived via Diffie-Hellman between the two keypairs is used as the root key for all record encryption. The server only ever sees ciphertext.
-
—
Each record has a unique per-record key (DSS) derived from SUS — so a compromised record key exposes nothing else.
Powered by libsodium — XSalsa20-Poly1305 symmetric encryption, X25519 key agreement, Argon2id key derivation.