keyforge

keyforge generates cryptographically strong secrets and keeps them in a

DPAPI-sealed local vault you can search. It ships as one binary with no runtime

and makes no network calls.

It generates random strings and API keys over a chosen alphabet, passwords with

character-class requirements, EFF diceware passphrases, structured identifiers

(UUIDv4, UUIDv7, ULID, nanoid, TOTP seeds), and keypairs (ed25519, RSA, and age

identities). Every value is drawn from the operating system CSPRNG by rejection

sampling rather than modulo, so no character is more likely than another, and

each generator reports the entropy it produced.

Secrets issued elsewhere can be stored too — paste an API key a provider gave

you and keyforge keeps it alongside the ones it made, honest about the fact that

it can only estimate the strength of a value it did not generate. Any secret can

be rolled: the replacement takes over while the name, creation date, and tags

stay put, and the outgoing value is kept so you can finish cutting over before

revoking it. An optional per-key interval flags anything overdue.

Saved secrets live in a vault sealed with Windows DPAPI under your login and are

found again with fuzzy search over names, tags, and kinds — never over the secret

material itself. Run `keys` with no arguments for the full-screen interface, or

use the subcommands for scripting.

Installs to your user profile and needs no administrator rights.