A modern, secure password manager with a beautiful user interface, built using Electron and React.
| Feature | Details |
|---|---|
| KeePass databases | Full .kdbx support, compatible with KeePass and every other .kdbx client |
| Modern UI | Clean, dense interface with light and dark themes |
| File attachments | Add, download and remove files on any entry |
| Entry history | Every edit records a revision, browse and restore past versions |
| One-time codes | TOTP with live codes and HOTP (counter-based), add secrets by scanning a QR code (screen, clipboard or image) or a Google Authenticator export |
| Browser integration | Autofill, save and update logins via the KeePassXC-Browser extension (Windows, Linux, macOS) |
| Passkeys | Create and use passkeys in the browser, stored in your database |
| Import | Bitwarden (JSON and CSV), 1Password (1PUX, 1PIF and CSV), KeePassXC (XML and CSV), LastPass and generic CSV, format auto-detected |
| Export | CSV export |
| Password generator | Character and passphrase modes with entropy estimate |
| Custom fields | Arbitrary entry fields with per-field protection |
| Tags | Tag any entry, click a tag to filter the whole vault |
| Search | Field-scoped terms (title:, user:, url:, notes:, tag:), quoted phrases, matches tags and custom fields |
| Key files | Unlock with a key file alongside the master password |
| Hardware keys | YubiKey challenge-response as an extra unlock factor |
| SSH agent | Private keys stored as attachments are loaded into your ssh-agent on unlock and removed on lock, KeeAgent-compatible entries |
| Entry expiry | Expiry dates with visual indicators for expired entries |
| Recycle bin | Deleted entries and groups can be restored or purged |
| Security report | Breached, reused, weak, exposed and expired credentials (HaveIBeenPwned) |
| Biometrics | Windows Hello and Touch ID unlock, session-scoped by default so nothing on disk releases the master password |
| Strong crypto | Argon2 password hashing, Argon2id defaults for new databases |
| Database settings | Master password change, KDF tuning, name, description, history retention |
| Multiple vaults | Each database opens in its own window |
| Large vaults | Virtualized entry list, fast unlock, search and save with thousands of entries |
| Safe saves | Atomic writes, external changes to the file are merged, not clobbered |
| Auto-updates | Self-updating builds on Windows, macOS and Linux |
| Cross-platform | Windows, macOS, Linux |
| Accessibility | Keyboard operation throughout, screen reader support, Windows High Contrast, reduced motion |
Everything works from the keyboard: the group tree, entry list and tab strips take arrow keys, Home/End and type-ahead, F6 cycles the panes, dialogs trap focus and return it on close. The full shortcut list is in Settings > General.
Screen readers get roles, names and states on every control, live announcements for toasts and search counts, and text alternatives for the clipboard and one-time code timers. Verified with UI Automation on Windows and AT-SPI on Linux.
Windows High Contrast keeps the selection and focus visible with system colours. Animations are off when the OS asks for reduced motion.
Grab the latest installer from the releases page: Windows installer (x64), Linux AppImage (x64) or macOS DMG (Apple Silicon). The builds update themselves when a new release is published.
Every release file carries a build provenance attestation: a signed record that it was produced by this repository's release workflow from a given commit. Check a download with the GitHub CLI:
gh attestation verify vigil-linux-x64-v1.5.0.AppImage --repo Earu/VigilThe application code inside each release, the app.asar archive, is reproducible: the same commit built with the same Node major and on the same platform gives the same bytes. Each release ships a *.asar.sha256 file per platform, attested like the installers, and CI rebuilds the archive on two runners from two paths and fails if they differ.
To check a release yourself, extract app.asar from the installer (--appimage-extract on the AppImage, 7-Zip on the Windows installer, the zip on macOS; it sits under resources/) and compare its SHA-256 with the shipped file. To go further, rebuild at the release tag and compare against your own output:
npm ci
npm run electron:build -- --dir
node scripts/asar-hash.mjsThe installer wrappers themselves are not reproducible: they embed timestamps and, on macOS, a signature.
The native modules (keytar, argon2, node-hid, and on Windows passport-desktop) sit outside the archive, under resources/app.asar.unpacked/dist-electron, and are the only copies the app loads. Their SHA-256 per platform is pinned in electron/native-pins.mjs: the build refuses any other bytes when it copies them, and refuses again after packaging if what landed in the unpacked directory is not exactly those files plus the two addons built from this repository. The archive carries dist-electron/native-manifest.json, which names each file, its module, version, target and digest, so the unpacked files can be checked against the pins directly.
- Node.js (Latest LTS version recommended)
- npm or yarn package manager
- Clone the repository:
git clone https://github.com/Earu/Vigil.git
cd Vigil- Install dependencies:
npm install
# or
yarnnpm run dev- Start Vite development servernpm run electron:dev- Start Electron development environmentnpm run build- Build the applicationnpm run electron:build- Build the Electron application for distribution
The application can be built for different platforms:
- Windows (NSIS installer)
- macOS (DMG)
- Linux (AppImage)
Build configuration is handled through electron-builder. The application automatically associates with .kdbx files for seamless database opening.