📖 Getting Started

How to use KeyVault Sidekick

A friendly, step-by-step walkthrough — no technical background needed. In about five minutes you'll have a private, encrypted vault for your passwords and API keys, and (if you want) your AI assistant helping you manage them.

~5 minutes No sign-up Nothing to install (Steps 1–4)

What is KeyVault Sidekick?

It's a free, private place to keep your secrets — passwords, API keys, and tokens. Everything is locked with a single master password and stored only on your own device. There's no sign-up and no company server, so your secrets never travel anywhere. Close the tab and they stay safely encrypted in your browser until you come back.

⚠ Before you start — the one rule that matters

All you need is a web browser (Chrome, Edge, Firefox, or Safari).
Pick a master password you'll remember. A long phrase like purple-otter-rides-the-train is both strong and easy to recall.
There is no "forgot password." If you lose it, the vault can't be opened — by design, because no one (not even us) can see inside it. We'll make a backup in Step 6.

Open the app and create your vault

Go to keyvault-sidekick.pages.dev and click Open vault.
The first time, you'll see Create your vault. Type your master password twice (at least 8 characters — a long passphrase is best), then click Create vault.
That's it — you're in. Next time you visit, you'll just type the same password to Unlock.

Make a project

Projects are simple folders that group related keys together — for example, one project per app or website.

Click + New project.
Give it a name (e.g. My Website), pick a color, and click Create project.

Add your keys

You can store a key you already have, or let KeyVault generate a strong new one.

I already have a key: click + Add key, fill in the Name (e.g. STRIPE_SECRET), paste the Value, choose a Type, and click Save.
Make a new strong one: click + Quick generate ▾ and pick what you need — a password, API key, JWT secret, UUID, and more. It's created and saved instantly. (The Generator tab at the top gives you more options.)

Every key has Show / Hide and Copy buttons. Values stay hidden until you choose to reveal them.

Use your keys in your projects

When you need your keys somewhere else — like a .env file for an app:

Copy as .env — copies the whole project as NAME="value" lines.
The small .env button on a single key copies just that one.
The Export tab lets you choose specific keys and a format (.env, .envrc, or settings.json), then Copy or Download.

Connect your AI assistant NEW

Want your AI coding assistant (like Claude Code or ChatGPT) to help with your keys? Open a project and click 🔌 Connect to AI. You'll see two choices:

💬 Paste a prompt · the easy way

Pick your assistant (Claude Code, ChatGPT Codex, or any AI).
Click Copy prompt and paste it as your first message in that assistant.

Your assistant now knows your project and the names of your keys, and can help you save new ones. Your secret values are never put into the chat — when the assistant saves a key, KeyVault pops open so you can review and click Save.

🤖 Full automation · hands-free, for more technical users

This installs a small local helper (an MCP server) so your AI can create, save, read, and manage keys by itself — no clicking. The modal gives you a copy-paste install command (clone the repo, then register the server) and a ready-to-paste kickoff message. It works with local AI tools (Claude Code, Claude Desktop, Cursor, Codex CLI).

Heads-up: by default this gives the assistant full access to your vault (it can change and delete keys). For least privilege, the Connect page's “Harden it” box shows how to make it read-only or keep your master password in a separate file.

Full step-by-step install (including Claude Desktop / Cursor / Codex) lives on the Connect page, Option 5. Set it up with the wrong password? Ask your AI to run keyvault_status (or run keyvault status in a terminal), then follow the troubleshooting guide.

Bonus: the Hand off to AI ↗ button hands your assistant the actual values for a specific task — only when it needs them, with a "don't echo these" guardrail.

Back up your vault & stay safe

Because there's no password recovery, a backup is your safety net:

Click the ⚙ Settings gear to open Settings, then Export .vault. This saves an encrypted backup file. Keep it somewhere safe — it still needs your master password to open.
To move your vault to another device, copy that file there and use Import .vault.

Other good habits, all in Settings: turn on auto-lock (locks the vault when idle), clipboard auto-clear, and you can change your master password anytime.

🎉 You're done!

You now have a private, encrypted vault and know how to add, use, back up, and (optionally) let your AI manage your keys. Everything stays on your device — no accounts, no servers, no surprises.

Quick answers

Is it really private?

Yes. KeyVault Sidekick is open-source and makes zero network requests — your keys never leave your device. You can even save the page and run it offline. There are no accounts, analytics, or telemetry.

I forgot my master password — can you reset it?

No, and that's the point: no one can see inside your vault, including us, so there's no reset. If you have a .vault backup you can restore it (you'll still need the password it was saved with). Otherwise you can wipe and start fresh in Settings.

Where exactly are my keys stored?

Encrypted in this browser, on this device. A different browser or device is a separate, empty vault — move yours by exporting a .vault file and importing it on the other device.

What's the difference between "Connect to AI" and "Hand off to AI"?

Connect to AI introduces your assistant to a project (its key names and how to save more) without sharing any secret values. Hand off to AI gives the assistant the actual values for a task, on demand. And Full automation (the MCP server) lets a local assistant do it all itself.

My AI assistant can't connect, or I set the wrong password

This only applies to Full automation (the MCP server). Ask your assistant to run keyvault_status — it says whether your password opened the vault, without showing any secrets. If it's the wrong password, the fix (reinstall with the right one, re-key the vault, or start fresh) is in the troubleshooting guide. The "Paste a prompt" mode never needs this.

Does it cost anything?

No — it's free and open, and always will be. If it saves you time, a ☕ Ko-fi tip is appreciated but never required.

Open the vault Connect your AI →