Documentation

Keyguard's documentation, grouped by product area. New to Keyguard? Start with Get started with Keyguard.

Get started

Get started with Keyguard — Install Keyguard, create its local vault, and add your first Bitwarden or KeePass account.
Premium — What Keyguard Premium unlocks, and how to buy a subscription or lifetime license.
License keys — Activate Keyguard Premium with a lifetime license bought on the web or a key from an existing purchase.

Bitwarden
- Connect to a Bitwarden server — Connect Keyguard to bitwarden.com, bitwarden.eu, Vaultwarden or another self-hosted Bitwarden server.
- Two-factor authentication — The two-factor methods Keyguard supports when you sign in to a Bitwarden account.
- Sends — Share text or a file through a Bitwarden link that deletes itself, with an optional password or access limit.
KeePass databases — Open, create and edit KeePass (KDBX) databases in Keyguard, and how their entries map to items.
Multiple accounts — Connect several Bitwarden and KeePass accounts and see their items in one merged vault.
Sync and conflict resolution — How offline edits sync back to the server, and how Keyguard merges conflicting edits field by field.

Items and fields — What an item holds: item types, custom field types, and the folders, tags, archive and trash that organize them.
Search — Search your vault with terms, phrases, exclusions and field qualifiers, and sort the results.
Filters — Narrow the vault list by account, type, folder, tag and more, and save the filters you use as custom filters.
One-time passwords — Store authenticator keys in login items and use TOTP, HOTP, Steam and mOTP codes.
Generator — Generate passwords, passphrases, PIN codes, usernames, email aliases, and SSH and GPG keys.
Email forwarders — Generate masked email addresses through SimpleLogin, addy.io, Firefox Relay and other forwarders.
Attachments — Attach files to vault items, download them, and preview images, text, GPG keys and ZIP archives without saving them to disk.
Bulk actions — Select several vault items, then move, rename, tag, merge, archive, trash or export them in one step.

Autofill — Fill logins in other apps and browsers with Keyguard: turn it on, allow it in browsers, and adjust its options.
Passkeys — How passkeys work, why they resist phishing, and how Keyguard stores and signs with them.
Use Keyguard as a passkey provider — Register Keyguard as the system's passkey provider to create and sign in with passkeys stored in your vault.
URL matching — How Keyguard picks the items to suggest for a website or app: match detection and equivalent domains.
Blocked URIs — Stop Keyguard from offering autofill in the apps and on the websites you list.
Quick search — Find an item from any desktop app with a global shortcut, then copy its values or auto-type a login.
Troubleshoot autofill and passkeys — Fix missing or wrong autofill suggestions, and problems with Keyguard as a passkey provider.

Lock and unlock — The app password, biometric, YubiKey and security key unlock, auto-lock, and what to do if you forget a password.
Watchtower — The security checks Keyguard runs on your vault, how each one works, and how they protect your privacy.
Security model — How Keyguard protects the local copy of your vault, what it can't protect against, and its known limitations.

SSH agent — Sign SSH requests with keys from your vault, from desktop tools, Termux and Android apps.
GPG agent — Sign and decrypt with GPG keys from your vault, from GnuPG on desktop and in Termux, and from OpenPGP apps on Android.
Agent approvals — How long Keyguard remembers an approval for the SSH and GPG agents, the command line and MCP, and who can reuse it.
Sign Git commits — Sign Git commits with a GPG or SSH key from your vault, through Keyguard's GPG or SSH agent.
GPG keys — The GPG Key item: identifiers, algorithms, edits, import and export, GPG tools and keyservers.
GPG tools — Encrypt, decrypt, sign and verify text or files with the GPG keys in your vault, without GnuPG.
Environments — Keep environment variables in your vault and pass them to local tools through local .env files, keyguard run or MCP.
Connect a coding agent — Let a coding agent create and edit your environments through MCP, and run its commands with their variables, without seeing values.
Command line — The keyguard command-line tool, with its commands, flags, endpoints, exit codes, error messages and MCP tools.

Import from another password manager — Move your passwords into Keyguard through a Bitwarden account, a KeePass database or Credential Exchange.
Export your vault — Export items from Keyguard as an encrypted ZIP archive or a KeePass database, with or without attachments.
Credential Exchange — Move passwords, passkeys and other items between Keyguard and another app on the same device.
Automatic backups — Save versioned snapshots of your vault to a folder, a WebDAV server or S3-compatible storage after each change.

Platform support — Which pages and features each platform supports, built from the docs themselves.
Wear OS — Use your vault on a Wear OS watch: setup, what works on the watch, and its limits.

Placeholders — Tokens that expand into an item's data: fields, URL parts, text transformations, dates and times.
URL overrides — Rewrite or extend an item's URLs with regex-matched commands and placeholders.
Keyboard shortcuts — Global, Quick search and in-app keyboard shortcuts for the desktop app.
Custom field conventions — Custom-field names that Keyguard reads as Wi-Fi credentials, tags, item links, GPG keys, SSH certificates and environments.
Appearance settings — Language, theme, color, font, navigation, icon, behavior and layout settings that change how Keyguard looks.
Security settings — Every setting on the Security screen: locking, the clipboard, screen privacy, unlock methods and the app password.

Troubleshooting — Every troubleshooting page in the docs, with the problems each one covers.
Send feedback — Suggest a feature, report a bug, ask a question or start a discussion about Keyguard.
Report a vulnerability — Report a security vulnerability in Keyguard privately by email, optionally encrypted with PGP.
Architecture — How Keyguard is built: the shared code, the app for each platform, the core technologies and the local-first design.