The open-source, zero-knowledge password manager: all the best features under one roof.
Passwords, passkeys, 2FA codes, secure sharing and email aliases for you, your family and your company. End-to-end encrypted, with no backdoors.
komboe.com · All 106 features · Roadmap · Architecture · Threat model
- Zero-knowledge, end to end. Your master password and keys never leave your devices. The server stores only ciphertext.
- No backdoors, ever. No key escrow, no master or recovery key, no admin password reset. Lost master password means lost vault, by design.
- Built for families and teams. Shared vaults and admin seats, while every member keeps a personal vault no admin can read.
- Every platform. Web vault, desktop, Android, browser extensions and a CLI. iOS is coming soon. See Clients.
- Fully open source (AGPL-3.0). Self-host it free, or subscribe to hosted Komboe at komboe.com.
- Minimal data. Hosted billing keeps only plan, seats and status, never your vault.
Status: pre-alpha. The images below are preview mockups of the UI in development, not screenshots of shipped software.
| Client | Where it runs |
|---|---|
| Android | Android phones and tablets (io.komboe.android) |
| Desktop | Windows, macOS and Linux |
| Browser extension | Chrome, Edge, Brave, Opera, Vivaldi, Cerebro, Firefox, Tor Browser; Safari (Mac) |
| Web vault | Any modern browser |
| CLI | komboe on the command line |
| Self-host server | Your own machine, with Docker or the single binary |
| MCP agent integration | Agents that use the same Komboe account |
| iOS | Coming soon |
Chrome, Edge, Brave, Opera, Vivaldi and Cerebro Browser (GoDesk Chromium) use the Chromium MV3 extension build. Firefox and Tor Browser use the Firefox build. The Safari build needs a Mac. See docs/BROWSER-EXTENSIONS.md and clients/SUPPORTED-BROWSERS.json.
One Komboe account is an email plus a master password. A passkey and two-step login are optional. That same account signs in and syncs on every Komboe client: the web vault, the browser extensions, Android, the desktop apps, the CLI, and the MCP agent. Every device shares one vault. Each sign-in is its own session.
Hosted sign-in is Komboe's own login on komboe.com. The master password never leaves the device, and there is no admin reset.
In the web vault, device approval and revocation are under Settings → Security → Devices. Ending sessions is under Settings → My account → Deauthorize sessions. The other clients use those same server records.
Self-host defaults to local accounts. Enterprise OIDC is optional and stays off until you configure it. Examples are in Running Komboe locally.
Local accounts (the default):
SIGNUPS_ALLOWED=trueOptional enterprise SSO (Keycloak or Okta). Leave SSO_ONLY unset so local accounts keep working:
SSO_ENABLED=true
SSO_CLIENT_ID=komboe
SSO_CLIENT_SECRET=replace-with-the-provider-secret
SSO_AUTHORITY=https://idp.example.com/realms/komboe
SSO_SCOPES="email profile"
SSO_PKCE=true
SSO_SIGNUPS_ALLOWED=true| Provider | Issuer to put in SSO_AUTHORITY |
|---|---|
| Keycloak | https://keycloak.example.com/realms/your-realm |
| Okta | https://your-org.okta.com/oauth2/default |
Register the redirect URI {DOMAIN}/identity/connect/oidc-signin. The provider only proves identity. The master password and the vault keys stay on the device. There is no admin reset and no Key Connector.
Real screenshot from a local test instance
Unlimited logins, secure notes, cards, identities, SSH keys, Wi-Fi, passports, API secrets, GPG keys and bookmarks, with folders, tags, favorites, custom fields, attachments, item history, trash and offline access. Every item is encrypted on your device before it syncs.
Where it came from: Bitwarden clients and Vaultwarden (vault and item types); Psono (extra item types); KeePassXC and Passbolt (tags, history).
Real screenshot from a local test instance
Strong passwords and memorable passphrases with a live strength meter, plus username generation and history.
Where it came from: Bitwarden clients, KeePassXC, Proton Pass.
Mockup: this feature is not built or not verified in Komboe yet
An inline in-form menu, keyboard shortcuts and a popup for Chrome, Edge, Brave, Opera, Vivaldi, Cerebro Browser, Firefox, Safari and Tor Browser. On desktop, global auto-type.
Where it came from: Bitwarden browser extension; Proton Pass (inline UX); KeePassXC (auto-type).
Mockup: this feature is not built or not verified in Komboe yet
Store and autofill passkeys, import and export them via FIDO Credential Exchange, and keep TOTP codes next to your logins. Protect your account with security keys, an authenticator app, Duo/YubiKey or biometric/PIN unlock.
Where it came from: Bitwarden clients and Vaultwarden; Proton Pass; KeePassXC (YubiKey challenge-response).
Real screenshot from a local test instance
Share an item or a whole vault with people and groups, with per-vault permissions, or send expiring, view-limited, password-protected text and files. Sharing uses public-key encryption, so the server never sees what you share.
Where it came from: Bitwarden Send and Vaultwarden; Proton Pass and Psono (secure links); Passbolt and Padloc (group sharing).
Real screenshot from a local test instance
Create unlimited aliases, use custom domains and catch-alls, forward to multiple mailboxes, reply from the alias, PGP-encrypt forwarded mail, block senders and see stats.
Where it came from: SimpleLogin (alias server); Proton Pass (alias UX).
Real screenshot from a local test instance
Organizations own shared vaults, and admins add or remove seats and set policies such as required 2FA. Families pay a small per-member fee. Every member keeps a personal vault the admin cannot read. Audit logs, a public API and clean-room SSO/SCIM are planned for companies.
Where it came from: Bitwarden, Vaultwarden, Passbolt, Padloc, Psono (orgs and RBAC). Per-member family pricing is original to Komboe.
Real screenshot from a local test instance
A member can ask to leave and start their own family account. Once an admin approves, the member keeps their whole personal vault, still end-to-end encrypted, and becomes admin of the new family.
Where it came from: Original to Komboe. No source project has this.
Mockup: this feature is not built or not verified in Komboe yet
A vault health score, weak/reused/exposed password reports, missing-2FA and unsecured-site reports, and breach monitoring. Exposed-password checks use k-anonymity, so only a hash prefix leaves your device.
Where it came from: Bitwarden and Vaultwarden (reports); Proton Pass (monitor); KeePassXC and Psono (HIBP checks).
Mockup: this feature is not built or not verified in Komboe yet
Native apps for Windows, macOS, Linux, iOS and Android, with biometric unlock, system autofill, an SSH agent, Secret Service integration and watch apps.
Where it came from: Bitwarden desktop and mobile; KeePassXC (Secret Service, auto-type); Proton Pass.
Mockup: this feature is not built or not verified in Komboe yet
Script your vault: log in, search, read TOTP codes, generate passwords, create aliases and inject secrets into deploys.
Where it came from: Bitwarden CLI; KeePassXC CLI; Psono and Passbolt CLIs (ideas).
Mockup: this feature is not built or not verified in Komboe yet
Run it all with Docker as a lightweight single binary with SQLite or Postgres, with S3 attachments and an admin page. Or use hosted Komboe at komboe.com.
Where it came from: Vaultwarden (server); SimpleLogin (aliases); Psono (storage backends).
Admin password reset and account recovery, Key Connector (org-held keys), Passbolt-style recovery, and anything under Bitwarden's bitwarden_license/ are not part of Komboe. They conflict with the zero-knowledge, no-escrow design or aren't open source. See docs/FEATURES.md.
Komboe brings together the best ideas from these open-source projects. Each "Where it came from" line above points back here. No upstream logos or trademarked assets are used; all mockups and the padlock-K logo are original Komboe artwork.
| Project | License | What Komboe uses / learns from |
|---|---|---|
| Bitwarden clients | GPL-3.0 (excluding bitwarden_license/) |
Forked base for web, desktop, browser extension and CLI clients |
| Vaultwarden | AGPL-3.0 | Forked base for the Komboe server |
| SimpleLogin | AGPL-3.0 | Email alias service |
| Proton Pass | GPL-3.0 | Dashboard look-and-feel inspiration, alias UX |
| KeePassXC | GPL-2.0/3.0 | Offline vault and KDBX import/export ideas |
| Passbolt | AGPL-3.0 | Team sharing ideas (its account recovery model is deliberately not adopted) |
| Padloc | AGPL-3.0 | Org/sharing UX ideas |
| Psono | Apache-2.0 | Self-hosted feature ideas |
No endorsement. Komboe is an independent project, not affiliated with, sponsored by, or endorsed by Bitwarden Inc., the Vaultwarden contributors, Proton AG, KeePassXC, Passbolt SA, Padloc, Psono, SimpleLogin, or any other listed project. All product names, logos and trademarks belong to their owners and appear here only to give credit. Upstream branding is removed from Komboe builds.
GNU AGPL-3.0. Third-party notices: NOTICE.
Wordmark: padlock-K mark + "Komboe" set in Sora SemiBold (SIL Open Font License 1.1; credited, no endorsement implied), outlined in branding/wordmark/. Fonts are self-hosted from branding/fonts/sora/ (no font CDN).