Overview

llaves is a KeePass-compatible password manager with local custody, a modern UI on every platform, sync that doesn’t corrupt your vault, and painless one-time sharing.

It is a clean-room, independent implementation — compatible with the KDBX format, not a fork of any existing app.

The problem

KeePass and its ecosystem win on security and local custody but lose people on three things: a steep first experience, weak and conflict-prone sync, and awkward sharing. Many users leave for hosted managers to get sync that “just works” — giving up local custody for convenience. llaves aims to offer both.

What makes it different

• Local custody by default. Your vault is a standard .kdbx file you own and can use fully offline. No account is ever required to open it.
• Format compatibility. llaves reads and writes standard KDBX 4 (and reads 3.1), so vaults move freely between llaves and any other KeePass app.
• Sync that merges, not overwrites. When a vault is edited on two devices, llaves detects the conflict and merges entry by entry instead of clobbering one side.
• Zero-knowledge sharing. Share a single credential with an expiring, burn-after-read link. The decryption key travels in the URL fragment, which never reaches the server.

How the pieces fit

A single shared library, core, holds everything security-critical: KDBX read/write, crypto, the data model, unlock, search, TOTP and the merge engine. Every app — desktop, the command line, Android (next) — is a thin layer on top of that one audited core, so behaviour is identical everywhere.

See the Core library, Desktop app and Command line docs for each piece, and Security for the guarantees underneath them all.