Encrypted by default
Argon2id key derivation, XChaCha20-Poly1305 envelopes. Keys never touch disk in plaintext.
Every AI key. One encrypted vault.
AIPass keeps your AI provider keys in an end-to-end encrypted vault on your machine. Your tools get scoped, time-limited access — never the plaintext.
Desktop only
Continue on your computer
AIPass does not have a mobile app. Open aipass.alkinum.io on your Mac to download and use the desktop app. Windows support is coming soon.
One vault for every AI workflow.
Configured in one step
Codex, Claude Code, and Gemini CLI read from the vault, with one-command rollback.
Browser autofill, granted
The Chrome extension fills keys only with time-limited grants from the desktop app.
Plaintext never touches the disk.
Each record is an encrypted envelope with its own data key, wrapped by a rotating vault epoch key. A one-time recovery key protects against lockout.
Get started# master password -> vault key
kdf argon2id(64 MiB, 2 rounds)
envelope xchacha20-poly1305(record_dek)
# every record, fully encrypted
record encrypted(title, endpoint, api_key, ...)
# browser fills expire on their own
grant ttl(browser_fill) -> erased