All projects

CryptHub

Development · 2026 · v1.2.0

Your vault is a file on your device. Not in the browser, not on a server.

SiteGitHub

Overview

CryptHub is an open-source password manager that runs entirely in your browser. Your vault is stored as an encrypted .crypthub file on your filesystem, not inside the browser and not on any server.

All cryptographic operations run locally through the browser’s native Web Crypto API. There are no accounts, no emails, no subscriptions and no telemetry. The only way into a vault is the master password used to create it.

A command-line tool opens the same file from the terminal, so a vault made in the browser works there too, and back again.

At a glance

Encryption
AES-256-GCM, authenticated
Key derivation
PBKDF2-SHA256, 310,000 iterations
Salt
32 bytes, random per vault, kept in the file header
IV
12 bytes, a fresh random value on every write
Auth tag
16-byte GCM tag; any tampering fails to decrypt
Session key
In memory only; cleared on lock or tab close
Storage
A local .crypthub file, through the File System Access API
Browsers
Chrome and Edge 86+ (not Firefox or Safari)
Dependencies
None: Web Crypto in the browser, Node’s crypto in the CLI
Cloud and telemetry
None
License
MIT
Version
1.2.0

How it works

  1. Open CryptHub in Chrome or Edge, or unlock from the terminal with crypthub open.
  2. Create a new vault, or open an existing .crypthub file from your device.
  3. Enter your master password. It derives a 256-bit AES-GCM key through PBKDF2.
  4. The vault decrypts into memory. Every change re-encrypts and writes back to the file immediately.
  5. Lock at any time. The session key is cleared from memory and the file on disk stays encrypted.

Features

  • Auto-save, always encryptedEvery add, edit or delete re-encrypts the whole vault with a new IV and writes it back to the file. There is no save button.
  • Tamper detectionThe GCM tag is checked on every read. Change a single byte of the file and it refuses to open.
  • Password generatorPasswords come from crypto.getRandomValues(), the browser’s cryptographically secure random source.
  • Strength meterA password strength meter sits alongside the generator.
  • Categories and searchEight categories (General, Social, Work, Finance, Entertainment, Dev/Tech, Shopping, Other) and full-text search across label and username.
  • Lock on demandLocking clears the session key from memory. The file on disk stays encrypted.
  • A terminal twinThe CLI works on the same .crypthub file with the same password, so the two are fully interoperable.
  • Browser checkAn unsupported browser gets a clear message instead of a broken page.

From the terminal

Manage the vault from the shell. Same file, same password, zero dependencies.

  • crypthub initCreate a new vault with guided setup
  • crypthub openUnlock a vault and start an interactive session
  • crypthub use <path>Point the CLI at any vault file
  • crypthub statusShow the current vault configuration
  • crypthub locateFind every .crypthub file on the system

Inside a session: list, get, show, add, edit, delete, search, dashboard, cls, lock.

Limits, stated plainly

  • Chrome and Edge only. Firefox and Safari do not implement the File System Access API, and there is no fallback.
  • No master password recovery. If it is forgotten, the vault cannot be decrypted.
  • No cloud sync. A vault moves by copying the .crypthub file.
  • No formal security audit has been done. The source is open for review.
  • A browser cannot guarantee memory is zeroed after a lock. This is a known limit of in-browser cryptography.

Version history

  • 1.2.0Apr 11, 2026
    Added the CLI: init, open, use, status, locate and an interactive session, with zero dependencies.
  • 1.1.0Apr 11, 2026
    Moved from an Electron desktop app to a web-only app. Removed Electron and better-sqlite3. Added security, contributing and deploy docs.
  • 1.0.0Jan 15, 2026
    First release: AES-256-GCM vaults, PBKDF2 key derivation, File System Access storage, a generator and search.

Drawn from:READMELive siteSecurity policyChangelog