Skip to content
Marketing Bull

Open source (MIT) · macOS 14+

KeyVaultA password manager that understands developer credentials.

General password managers treat every credential as a username and password. KeyVault knows an AWS key has a Region and an OAuth client has a token URL and two tokens. Every entry gets the right fields, encrypted and kept on your Mac.

View the sourceHow to get it
  • Native Mac app
  • AES-256-GCM per field
  • Touch ID unlock
  • Nothing leaves your Mac

The right fields for each credential

Templates for API keys, OAuth clients, service accounts and AWS IAM, plus custom entries with any fields you need.

Encrypted field by field

Every field value is encrypted on its own, with the key kept in the macOS Keychain and unlocked with Touch ID.

No cloud in the middle

The vault lives on your Mac. There is no account, no sync service and no server that ever sees a secret.

What it does

Everything in KeyVault.

Entry templates

  • API Key: the key
  • OAuth: client ID, client secret, token URL, scope, access and refresh tokens
  • Service Account: project ID, client email, private key
  • AWS IAM: access key ID, secret access key, region
  • Custom: any fields you define

Security

  • AES-256-GCM encryption for each field value
  • Key derived with PBKDF2-SHA256 at 100,000 iterations
  • Key stored in the macOS Keychain, never on disk in plain text
  • Touch ID unlock with a password fallback

Day to day

  • Locks after 5 minutes idle, on screen sleep and on system lock
  • Copied values clear from the clipboard after 30 seconds
  • Sensitive fields stay masked until you reveal them

Organizing

  • Three-column layout: sidebar, entry list, detail
  • Free-form tags and notes on every entry
  • Expiry dates, with a macOS notification a week before a credential lapses

Backups

  • Export the whole vault as one encrypted file
  • Import it again with the same master password

Agent access records

  • Record which named scripts or agents may use an entry
  • Read or read-and-write, per entry, and revocable

Privacy

Where your secrets live

  • On your Mac only, in an on-device SwiftData store. Nothing is sent to a cloud service.
  • Each field value is encrypted with AES-256-GCM. The key is derived from your master password and kept in the macOS Keychain.
  • Backups are encrypted files you control, readable only with your master password.

How to get it

Build it from the source.

KeyVault is open source under the MIT License: free to use, change and build. There is nothing to buy and no account to create.

macOS 14 (Sonoma) or laterSource available

KeyVault for Mac

Build it with Xcode and run it on your own Mac.

You need

  • A Mac running macOS 14 or later
  • Xcode 15 or later
  • XcodeGen (brew install xcodegen)

Steps

  1. Clone the repository and run ./setup.sh to generate the project and open it in Xcode.
  2. Select the KeyVault target and set your signing team. A free Apple ID works for personal use.
  3. Build and run on your Mac (not the simulator: Touch ID and the Keychain need a real device).
github.com/Marketing-Bull/KeyVault ↗

Under the hood

How it's built

App
Swift, SwiftUI, SwiftData
Encryption
CryptoKit (AES-256-GCM), PBKDF2-SHA256
Key storage and unlock
macOS Keychain, Touch ID (LocalAuthentication)
Builds
XcodeGen

Planned

On the roadmap, not built yet

  • Full-text search across names, providers, tags and field values
  • An audit log of every agent access
  • Quick copy from the menu bar
  • Rotation reminders and a configurable auto-lock timeout

Questions

Is KeyVault free?

Yes. The source is published under the MIT License. Build it with Xcode and use it at no cost.

Does KeyVault sync to the cloud?

No. The vault stays on your Mac. To move it, export an encrypted backup and import it on the other machine with the same master password.

What happens if I forget my master password?

The vault cannot be decrypted without it, by design. Keep an encrypted export and your master password somewhere safe.

Does it run on iPhone or Windows?

No. KeyVault is a native Mac app for macOS 14 or later.

Do I need a paid Apple Developer account?

No. A free Apple ID can sign it for personal use; the README explains the one entitlement to remove first.

KeyVault is released under the MIT License. Copyright © 2026 Marketing Bull, LLC. See also our other free tools and the apps we've built.

Want software like this for your firm?

We built KeyVault for our own work. If your firm or practice needs a tool like it, twenty minutes is enough to see whether we can help.

Start a conversationCall 1-833-GET-BULL