Local-first and privacy
Data on your device, zero-knowledge, backups, and optional sync.
QubKey is local-first: your data lives on your machine, not on a remote server. Unlike a cloud-only manager (data hosted by the provider) or cloud-sync (encrypted but automatically synced data), QubKey puts the vault file under your direct control.
This philosophy has deep implications for security (no server attack surface), privacy (no metadata transmitted), and resilience (permanent offline operation).
Why local-first?
Data under your control
Your secrets stay on your device, in an encrypted .rkvey file you own, copy, and move freely — no online account or provider dependency.
Privacy by design
No telemetry, no tracking, no usage statistics: QubKey does not send your metadata (visited sites, entry count) to a remote service.
Always available
Works without an internet connection — no server maintenance, no downtime. Your passwords remain accessible while traveling, in dead zones, or after a network outage.
Full portability
Export, backup, and migrate at any time. Switch devices by simply copying the .rkvey file — you stay in control of your data for life.
Comparison
| Aspect | Cloud manager (e.g. 1Password) | Local-first (QubKey) |
|---|---|---|
| Storage | Provider servers | Your local disk |
| Privacy | Server-side zero-knowledge | Zero-knowledge on your device |
| Metadata | May transit through server | Stays on your machine |
| Availability | Depends on online service | Works offline |
| Cost | Monthly subscription | Free / open-source |
| Recovery | Account + provider support | Recovery key you save |
| Portability | Export possible, proprietary format | Self-contained, portable .rkvey file |
| Auditability | Partially closed code | Open-source (Rust + React) |
| Multi-device sync | Built into the service | Opt-in built-in (QubKey cloud; self-hosting coming soon) or via file (.rkvey) |
Optional sync
Built-in multi-device sync — disabled by default to preserve the local-first model. Enable it explicitly in Settings → Sync (vault open and unlocked).
Setup:
- Choose the QubKey cloud server (self-hosting will soon be available for download)
- Create an account or sign in, then register this device
- Enable sync — optional: automatic sync when opening the vault
- On your other devices, repeat with the same account and same master password
Vault contents: the server only receives encrypted snapshots (AES-GCM) and HMAC-SHA256 signed operations. The master password and master key never leave your device. See Built-in sync security below for details.
Cloud procedure:
- Install the cloud client (Dropbox, Google Drive, iCloud…)
- Create a dedicated folder (e.g.
Cloud/QubKey/) - Place or move your
.rkveyinto this folder - Wait for initial sync
- On another device, install QubKey and open the same file
The file stays encrypted at all times: only the master password can unlock it, regardless of the service used to transport it.
Tip: avoid opening the same vault simultaneously on multiple devices to prevent sync conflicts.
USB / NAS procedure:
- Unlock your vault and quit QubKey (for a consistent file)
- Copy the
.rkveyto the USB drive or NAS share - Store the media in a safe place
- To restore: copy the file to the new device and open it in QubKey
Recommended method for recovery backups — no internet connection required.
Git procedure (advanced users):
- Initialize a private local repository
- Copy the
.rkveyinto the repository - Commit regularly after each significant change
- Push to a private remote if desired
git init vault-backup
cp ~/Documents/QubKey/main.rkvey vault-backup/
cd vault-backup && git add . && git commit -m "backup $(date +%Y-%m-%d)"Never push to a public repo — the file stays encrypted, but exposes the structure.
Offline mode
Fully offline
QubKey works 100% offline.
- No network requests on startup
- No license verification
- Browser extension via native messaging (local)
Have I Been Pwned checking is planned but not implemented in the current version.
Essentials to know
Backup strategies
Desktop backup: enable automatic backup in Settings → Backup (default: every 24 h, max 10 copies) or create a manual backup before major changes
3 copies: original on disk + 2 backups (e.g. backup_passmanager/ folder + iCloud copy or USB drive)
2 different media: local disk + cloud OR USB (do not keep everything in one place)
1 offsite copy: OAuth cloud backup (Google Drive / OneDrive / Dropbox) or iCloud folder, USB drive, NAS
Test regularly: restore a backup from Settings → Backup or open a copy on another device (recommended: once per quarter)