Keyrook
Download

Open source

The code that holds your secrets, in the open.

A tool that holds the keys to your accounts should not ask to be taken on trust. Both Keyrook extensions are published under GPL-3.0, for anyone to read, build and check against what they install.

See the code Check a build

keyrook/passhold

Passhold · GPL-3.0-or-later

  • The extension and its core — encryption, the vault, site matching, the generator, import and export — and the Keyrook account's code it syncs with
  • Its security design, with the test beside each claim
  • Published at each store release, from that release's tag
github.com/keyrook/passhold

keyrook/keyrook-authenticator

Keyrook Authenticator · GPL-3.0

  • The extension, its sync client and its tests — among them one that plays a hostile server
  • Every store release tagged, with its archive on GitHub
  • Issues open for problems anyone can follow
github.com/keyrook/keyrook-authenticator

Public, and not

What you can read, and what you cannot.

The code that runs on your computer is public. The code of our servers is not — which is exactly why the extensions are written so that a server need not be trusted: it holds only what it cannot open, and your devices refuse what it alters.

  • Public

    Passhold and Keyrook Authenticator: everything that touches your passwords and codes on your device.

  • Not public

    The sync server at api.keyrook.com and the account page at account.keyrook.com, which see only sealed data.

  • The licence

    GPL-3.0: read it, change it and share it — and share your changes under the same terms.

Check a build

The file on the store is the file the code builds.

Since 0.3, each Keyrook Authenticator release is one archive, sent unchanged to every store, and byte for byte what its published source builds. Its SHA-256 is on the GitHub release.

  1. 1Take the source at the release's tag, such as v0.4.1.
  2. 2Build it as its README says.
  3. 3Compare your archive's SHA-256 with the one on the release.

Passhold builds the same files every time: build the tag of the version you have, such as v0.2.1, and compare them with the copy your browser installed. Its README says where to find it.

Found a bug?

Open an issue on the product's repository, where anyone can follow it.

Keyrook Authenticator issues

Want to change something?

Pull requests are welcome, under the terms in the repository's CONTRIBUTING file.

Passhold's terms

Found a weakness?

Tell us privately, not in a public issue, so it can be fixed before it is known.

Report a vulnerability