How Keyfold keeps your vault safe
The full threat model is on GitHub, with the code. This page is the summary.
Encryption
Your passphrase is stretched with Argon2id (64 MiB of memory, 3 passes) into a key that unwraps a random data key. The vault is sealed with XChaCha20-Poly1305, and the file's header is bound to its contents, so changing any byte makes it refuse to open. All cryptography comes from the audited RustCrypto libraries; Keyfold has no home-made primitives.
What an attacker can't do
There is no server holding vaults, so there is no database to breach. Someone who steals your vault file must guess your passphrase, and each guess costs memory and time; a strong passphrase puts that out of reach. The app makes no network connections unless you allow a daily update check, and updates must carry a signature from Keyfold's offline key.
What Keyfold can't stop
Malware running as you while the vault is unlocked can read what you can read; that's true of every password manager. Keyfold limits the window: it auto-locks, wipes the key from memory on lock, decrypts values only when you reveal or copy them, and clears the clipboard.
AI agents
The MCP server has no tool that returns a value. Agents can list names, write a .env file you approved, or run a command with keys injected, and each request appears in Keyfold for you to allow or deny.
Open source
The encryption, vault format, licence check, 2FA codes, agent protocol and CLI are AGPL-licensed at github.com/codewithkolin/keyfold, with tests that flip every byte of a vault. Keyfold hasn't had an external audit yet; it will before the site ever says so.
Report a vulnerability
Email security@keyfold.app or use GitHub's private vulnerability reporting. You'll hear back within 72 hours.