KeyvaciApps
The vault, where the password
is actually typed
A credential you have to go and fetch is a credential people copy into a chat message instead. Keyvaci runs in the browser you already have open, on the phone in your pocket, and in the web console your administrators run the organisation from.
Why this is one product, not three
Three clients, one implementation of the cryptography
Most vaults ship an extension and a mobile app as separate projects, which means separate crypto, separate bugs, and separate answers to the same security question. Keyvaci does not have three implementations to keep in agreement, because it only has one.
| What is shared | How |
|---|---|
| Encryption and key derivation | One package consumed as source by all three clients. There is no second copy of XChaCha20-Poly1305 or Argon2id to drift |
| The verified read chain | One implementation: organisation signature on a member's key, grant signature before a vault key is unsealed, author signature on every entry |
| Every word on screen | One translation table across web and phone, in all five languages, so a warning that protects your data reads the same everywhere |
| The vault seal | One function. Two clients drawing different seals for the same vault would defeat the point of a mark you compare by eye |
The practical consequence: a fix to the cryptography is a fix everywhere at once, and an answer your security team gets about the web app is true of the extension and the phone as well.
Browser extension
Fill the login without opening anything
Click a password field on any site and the Keyvaci menu opens under it. Pick the credential and it is filled. The decryption happens on your machine, in the extension, and the reveal is written to your organisation's audit log exactly as it would be in the web app.
The menu only ever offers this site
Items are matched to the page by exact host, or a real parent and child relationship. A lookalike domain is never offered your credentials, and a page cannot trick a misplaced click into filling something that does not belong to it, because the rest of your vault is not in that menu at all.
The page never sees the credential
The secret travels from the extension's own background context to the exact field you opened the menu on. It is never posted into the page's messaging channel, which is the channel a hostile page can listen to.
Locks on a deadline, not on idleness
Ten minutes after unlocking, the keys are erased whether or not you came back. Locking keeps you signed in and drops only the keys, so you return to the unlock screen rather than to a login form.
Signing in with Microsoft, out of reach
The Microsoft window is opened and owned by the browser. The extension cannot script it and cannot read it, so a password vault never sees the company password that protects everything else.
Nothing running on pages it was not called to
The in-page component locates the menu and receives the fill instruction. It does not read your forms, hold keys, or make network calls, and everything sensitive stays in extension pages the site cannot open.
Copies clear themselves
Anything copied to the clipboard is cleared after 30 seconds, so a credential does not sit in the paste buffer for the rest of the afternoon.
Mobile apps
The vault away from the desk
Vaults, search, and account, laid out for a thumb rather than a mouse. The same words, the same icons, and the same seal as the web app, because people should recognise the product, not learn a second vocabulary for it. iPhone and Android run the same app, built from one codebase.
Real encryption on a real phone
Argon2id runs natively at the full 64 MiB the server-side parameters ask for. Weakening the key derivation to fit a phone would have meant a weaker vault for everybody, since the parameters are a property of the account, not of the device.
Locks the moment you leave
Switching away from the app clears the keys immediately, so the app switcher never holds an open vault, and there is still a hard ten-minute ceiling while you are looking at it.
Nothing decrypted is ever written down
Decrypted keys and entries exist only in memory. Restarting the app always lands on the unlock screen. The only thing kept between launches is the sign-in session, held in the device's secure hardware and marked so it does not travel to another device in a backup.
Biometric unlock, with the trade-off said out loud
Optional, and off until you turn it on. Face ID or Touch ID on iPhone, fingerprint or face on Android. Turning it on stores your master password on that one device, which is the whole trade, and the app says so on the screen where you decide. It never becomes the only way in.
The convenience expires on purpose
Every 30 days the app asks for the master password again, and it asks immediately if the password was changed anywhere else. A password your phone never asks for is a password nobody remembers, and a forgotten master password is the expensive path this product wants to keep rare.
Fills your other apps
Switch Keyvaci on in the system password settings, iOS AutoFill on iPhone, Android Autofill on Android, and any login form on the phone can pull from your organisation's vault. Secrets auto-hide after 30 seconds, and copies clear on the same timer.
The part that does not move
Convenience never buys itself a shortcut
Every client is faster than opening a console and copying by hand. None of them is a way around the rules the vault is sold on.
| Rule | Holds in the extension | Holds on the phone |
|---|---|---|
| Your master password never reaches us | Yes | Yes |
| Every reveal is written to the organisation's audit log | Yes | Yes, including fills into other apps |
| An entry that fails a signature check is discarded, not shown with a warning | Yes | Yes |
| Revoking someone re-encrypts the vault, so their device's copy stops working | Yes | Yes |
| Filling without unlocking first | Not possible | Not possible |
The last row is the one to check with any vendor. A product that can fill a password without anyone unlocking anything is a product holding a key where you cannot see it.
Availability
Where each one is today
Written plainly, because a roadmap dressed up as a feature list is how evaluations go wrong.
| Client | Status | Signs in with |
|---|---|---|
| Web app | Generally available | Microsoft Entra ID, Google Workspace, email |
| Browser extension · Chrome, Edge, Brave | Beta, installed directly. Not yet listed in the Chrome Web Store | Microsoft Entra ID, email |
| iPhone app, with iOS AutoFill | Beta, by invitation | Microsoft Entra ID, email |
| Android app, with Android Autofill | Beta, by invitation | Microsoft Entra ID, email |
| Firefox and Safari extensions | Planned | — |
Google Workspace sign-in is live in the web app and is being brought to the extension and the phone next. Everyone can use email sign-in on every client in the meantime, with identical encryption.
Try it on the machine you actually work on
Fourteen days, every feature, no card. Ask us for the extension and the mobile beta while you evaluate.