Clavis — Local Passkey Vault

Local passkey authenticator. Passkeys are generated and stored on this device in a password-encrypted vault.

Clavis turns Chrome into its own passkey authenticator, keeping the keys on your machine instead of in a cloud account. When you switch Clavis on, it handles passkey registration and sign-in itself. New passkeys are generated locally and stored in a vault encrypted with a password only you know. There is no account to create, no server to trust, and nothing is ever uploaded — the extension makes no network requests at all. HOW IT WORKS • Set a vault password, then switch Clavis on • Register a passkey on any site that supports them • Approve each sign-in from a prompt that shows you exactly which site is asking • Lock the vault whenever you want; it also locks itself after 15 minutes idle WHAT IT PROTECTS Passkeys are encrypted with AES-256-GCM, using a key derived from your password with 600,000 rounds of PBKDF2. The unlocked key exists only in memory and is discarded when Chrome closes. Even the list of which sites you have passkeys for is encrypted. IMPORTANT — PLEASE READ BEFORE INSTALLING • There is no backup, no sync and no password recovery. If you forget your vault password or lose your Chrome profile, those passkeys are gone permanently. Always keep another sign-in method enabled on any account you add a passkey to. • While Clavis is switched on it handles every passkey request in Chrome. Touch ID, Windows Hello and hardware security keys will not be offered until you switch it off again. Only one extension can do this at a time, so it conflicts with 1Password, Bitwarden and Dashlane while both are active. • Clavis cannot import passkeys you already have. Passkey private keys can never be exported from where they live — that is what makes them secure. To move an account to Clavis, register a new passkey with Clavis switched on, then delete the old one at the site. OPEN SOURCE Full source, unminified and dependency-free: https://gitlab.com/wsanriv/clavis