Kavach is a local-first personal password manager. All credentials are encrypted with AES-256-GCM and stored on your device. No cloud. No accounts. No subscriptions. No one else can access your data -- not even us.
Windows x64 · No Java required · Eclipse Temurin 21.0.9 bundled
Every password is encrypted with a unique key. Your master password is never stored -- it derives the encryption key at login.
Reveal any saved password only after verifying with a 6-digit TOTP code from your authenticator app. Works with Google Authenticator and Authy.
Data never leaves your machine. No sync, no cloud, no remote servers. Your vault is a single SQLite file at ~/.kavach/kavach.db.
Every login, credential view, and change is recorded in a tamper-evident audit log so you always know what happened in your vault.
Instantly see which passwords are weak, reused, or old so you know exactly where to focus your security hygiene.
Export your entire vault to an encrypted file for safekeeping or migration. Import it back on any machine running Kavach.
Label credentials with custom tags and filter by them in one click. Star your most-used entries to pin them to the top of your vault.
Store encrypted free-text notes -- API keys, recovery codes, SSH passphrases -- with the same OTP-protected reveal as passwords.
Generate strong passwords in four modes: Custom rules, PIN, Alphanumeric, or a memorable Passphrase from a 256-word list with zero bias.
Download Kavach-v1.2.0-windows-x64.zip and extract it anywhere on your machine.
Double-click Kavach.exe. Your browser opens automatically to the setup wizard. Create your master password and scan the QR code with your authenticator app.
Your vault is ready. Add credentials, reveal passwords with TOTP verification, and check your password health report.
Kavach uses PBKDF2WithHmacSHA256 (600,000 iterations) to derive your master key, AES-256-GCM for all encryption, and RFC 6238 TOTP for credential reveal. The source code is open for review on GitHub. No proprietary algorithms, no hidden backdoors.
Read the source code