CryptKeepr stores the secrets your infrastructure runs on, encrypted, next to the things they belong to.
Features
- Eight credential kinds — passwords, SSH keys, API keys, SNMP strings, certificates, database credentials, TOTP seeds, and custom secrets.
- Envelope encryption by default — every item is encrypted with its own key, wrapped by a per-user key derived from a versioned master key. Nothing is stored in plaintext, ever.
- Zero-knowledge vaults (optional) — put credentials in an E2E vault and they're encrypted in your browser with a passphrase we never see. Not even a full server compromise can read them. (Trade-off: lose the passphrase, lose the vault.)
- Built-in TOTP — store a 2FA seed and CryptKeepr shows the live 6-digit code.
- Expiry & rotation reminders — set an expiry or a rotate-every-N-days policy; expiring credentials surface on the platform dashboard.
- Cross-links — attach a credential to the asset and runbook that use it.
- Import — bring your Bitwarden, LastPass, or KeePass export straight in (Settings → Import & Export, format auto-detected).
Envelope vs. E2E — which to use?
Envelope (the default) is right for team credentials: encrypted at rest, recoverable, searchable. E2E vaults are for the crown jewels — domain admin, root CA — where you'd rather accept unrecoverability than trust any server, including ours.