Introduction to QubKey
Local-first password manager: .rkvey vault, QubKey account, sync, and secure sharing.
QubKey is a local-first, open-source password manager designed as a digital vault system — not a simple encrypted file. Each layer — format, cryptography, index, and application — is designed to work together and protect your secrets end to end.
The native desktop app combines Rust (cryptographic core), Tauri (lightweight system shell), and React (UI). Your secrets live in a .rkvey (Rust Key Vault) file on disk, encrypted with proven primitives and strict separation of concerns.
This documentation is for individuals securing their credentials and technical teams evaluating the architecture. Start with Installation or First vault ; see Release notes for build history ; for security, see Architecture.
Design philosophy
- The vault is a system — identification, configuration, index, and data are distinct layers.
- Crypto is not a bolt-on — encryption, derivation, and integrity are built into the format.
- Resilience is mandatory — WAL, safe commits, and crash recovery are part of the model.
Diagram: application overview
Interface (React + Tauri)
- Vault
- Folders
- Search
- Generator
- One-time codes
- Dashboard
- Sync
- Sharing
- Browser extension
Rust core (QubKey Core)
- .rkvey v5 format
- Argon2id derivation
- Authenticated encryption
- Search index
- Safe commits
- Memory wipe
- Crash recovery
.rkvey v5 file on the filesystem
- Preamble
- Encrypted header
- Encrypted index
- Secret compartments
- Attachments
- Commit history
Core principles
Local-first
Your vault file lives on your filesystem. No internet required for core operations — your data never transits through a QubKey server.
Zero-knowledge
The master password never leaves your machine. Recovery relies on the recovery key you save at creation — QubKey cannot read or reset it.
Open source
Rust core, Tauri shell, and React frontend are open-source (MIT) — auditable by the community and security teams.
Why Rust?
| Benefit | Implementation | Advantage |
|---|---|---|
Memory safety | Compiler guarantee | Eliminates buffer overflows, use-after-free, and data races — common C/C++ vulnerability sources |
Zeroization | zeroize crate | Guaranteed wipe of keys and secrets in RAM when the vault locks |
Performance | Native | Calibrated Argon2id without unpredictable GC — stable, predictable unlock (~500 ms) |
Crypto | RustCrypto | Audited AEAD and Argon2 primitives — no homegrown reimplementation |
Technical stack
| Component | Technology | Role |
|---|---|---|
| Core | Rust | Crypto, .rkvey format, WAL |
| Desktop shell | Tauri | Secure IPC, file access |
| UI | React + TypeScript | UX, search, dashboard |
| Encryption | AES-256-GCM, XChaCha20 | Per-entry AEAD |
| Derivation | Argon2id | Master password → master key |
| Format | .rkvey | Layered vault |
Project structure
20 entry types
QubKey offers 20 types (EntryType, discriminants 0–19). Each type also accepts encrypted attachments (multi-file, folders). See the full catalog for each EntryData variant schema.
Passwords
Password, SSHKey, PGPKey, TokenLogin, Passkey, RecoveryCodes
Financial
CreditCard, BankAccount, CryptoWallet
Identity
NationalID, Passport, DriverLicense, HealthID, Profile, ContactAddress
Note
Note, RecoveryPhrase, ConfigSnippet
Document
Document
Device Access
WiFi
Next steps
Installation
macOS, Windows — extension prerequisites
First vault
Vault creation, master password, and recovery key
QubKey account
Sync, sharing, and web space with one identity
Sync
Same vault on multiple devices
Share an entry
Temporary link or QubKey user
Encryption model
.rkvey format, Argon2id derivation, AEAD, and per-entry isolation