keyforge

Joshua·ElJoshua08.KeyForge

Generate and manage secrets locally, sealed with Windows DPAPI.

keyforge generates cryptographically strong secrets and keeps them in a DPAPI-sealed local vault you can search. It ships as one binary with no runtime and makes no network calls. It generates random strings and API keys over a chosen alphabet, passwords with character-class requirements, EFF diceware passphrases, structured identifiers (UUIDv4, UUIDv7, ULID, nanoid, TOTP seeds), and keypairs (ed25519, RSA, and age identities). Every value is drawn from the operating system CSPRNG by rejection sampling rather than modulo, so no character is more likely than another, and each generator reports the entropy it produced. Secrets issued elsewhere can be stored too — paste an API key a provider gave you and keyforge keeps it alongside the ones it made, honest about the fact that it can only estimate the strength of a value it did not generate. Any secret can be rolled: the replacement takes over while the name, creation date, and tags stay put, and the outgoing value is kept so you can finish cutting over before revoking it. An optional per-key interval flags anything overdue. Saved secrets live in a vault sealed with Windows DPAPI under your login and are found again with fuzzy search over names, tags, and kinds — never over the secret material itself. Run `keys` with no arguments for the full-screen interface, or use the subcommands for scripting. Installs to your user profile and needs no administrator rights.