# KAPEVault > KAPEVault is an encrypted password vault for Windows and Android. It keeps passwords, 2FA codes, IDs, secure notes, API keys and file links in one file encrypted on your device, and syncs your PC and phone through a Cloudflare R2 bucket you own, with no KAPEVault server. ## Key facts - Platforms: Windows 10, Windows 11, Android 11+ - Encryption: master password -> scrypt -> AES-256-GCM over the whole vault, on the device - Storage: one encrypted vault file on each device; no account and no KAPEVault server - Sync and backup: optional, through a Cloudflare R2 bucket the user owns; only the sealed vault file and the Forever Opener page (no vault data) are uploaded - Item kinds: login, note, key, link, payee, device, thing, ID (there is no payment-card type) - Recovery: a sealed copy in a OneDrive, Google Drive or Dropbox folder (PC only), an Emergency Kit QR that reconnects the phone to the R2 backup, and restore from a file on Android - Works fully offline - Price: KAPEVault is free to download and use. Some features may be offered as a paid option in the future. If so, we will describe them, with the price, before anyone pays. - Network: no account, analytics or telemetry; the apps connect only to the user's own R2 bucket (when connected), open links in the user's browser, and on Windows the Air Wall Test makes one connection to 1.1.1.1:443 when the user presses Test - Made by BrewedOps (https://brewedops.com), Philippines ## Features - Find anything in two keys: Press Ctrl+Shift+Space in any app, type a few letters, hit Enter. The password is copied and clears in 30 seconds. - 2FA codes, built right in: Scan the QR code or paste the setup key. The six-digit code sits beside the password. - Your IDs, kept like passwords: Passport, PhilSys, UMID, TIN and more. The number stays hidden until you reveal it, and an optional photo of the card stays encrypted. - Files and folders, linked: Link a folder and browse it inside the vault. PDFs, images, video and Markdown open in a preview. - Spot the weak ones: Flags weak, reused and year-old passwords, and API keys near expiry. A strong new one is a click away. - Lost both devices? Three steps back: Point your PC at a OneDrive, Google Drive or Dropbox folder and every save lands there, still sealed. Your Emergency Kit can carry a QR to your R2 backup. - Windows app: Quick search, tray, Windows Hello. - Android app: Fingerprint unlock, 2FA codes, sync. - Forever Opener: One HTML file opens your vault in any browser, even offline, even without KAPEVault. ## Security - Windows Hello and fingerprint: Unlock with your face, finger or PIN. - Locks on its own: PC: after 5 minutes with no keyboard or mouse use, on sleep or Windows lock. Phone: when you leave the app. - Clipboard clears itself: PC: after 30 s, on lock and on quit. Phone: within a minute, usually 30 s, and on lock. - Air Wall: One switch has Windows Firewall block the app. Encrypted backups still reach your bucket. - Secrets stay hidden: A password reaches the screen only when you reveal it. - Emergency Kit: A printable page with everything needed to recover. ## Phone sync, step by step 1. Add a phone: On your PC: Settings, Backup, Add a phone. Scan the code with the app. 2. Unlock with your finger: Set it once, then open the vault with a touch. 3. Edit on either: Changes merge item by item. Old passwords stay in history on both. ## FAQ ### What is KAPEVault? An encrypted password vault for Windows and Android. It stores passwords, 2FA codes, IDs, secure notes, API keys and file links in one encrypted file on your device. ### Where does my vault live? In one encrypted file on your device. Nothing about it is stored on a KAPEVault server, because there is none. ### How is the vault encrypted? Your master password is turned into a key with scrypt, and the whole vault is sealed with AES-256-GCM before it is written or uploaded. ### Do I need the cloud at all? No. KAPEVault works fully offline. Connecting your own Cloudflare R2 bucket adds backups and phone sync. ### What gets uploaded when I sync? The sealed vault file, encrypted on your device before it leaves, and the Forever Opener page, which holds no vault data. Backup names hold a random install ID and the time, nothing about you. ### What if I forget my master password? Nobody can reset or recover it, including us. Print the Emergency Kit and keep it somewhere safe. ### I lost both my devices. Now what? Install KAPEVault, pick your vault file or scan the QR on your Emergency Kit, then type your master password. Your PC can keep that file in a OneDrive, Google Drive or Dropbox folder for you. ### Can I store my IDs? Yes. Pick the type, from Passport and PhilSys to PRC license, or name your own. The number stays hidden like a password, the optional photo stays encrypted until you tap Show photo, and IDs never show up in autofill. ### Can I open my vault without the app? Yes. The Forever Opener is a single HTML file that decrypts your vault in any browser, with no network. ### Is it on iPhone or Mac? Windows and Android today. iPhone and Mac are on the list. ## Links - [Features](https://kapevault.brewedops.cloud/#features) - [Security](https://kapevault.brewedops.cloud/#security) - [Download](https://kapevault.brewedops.cloud/#download) - [FAQ](https://kapevault.brewedops.cloud/#faq) - [Docs](https://kapevault.brewedops.cloud/docs/): Set up KAPEVault on Windows and Android, learn what each item kind holds, and how backup, phone sync, recovery, the Emergency Kit and Air Wall work. - [Trust](https://kapevault.brewedops.cloud/trust/): How KAPEVault keeps your vault safe: scrypt and AES-256-GCM on your device, no account and no server, your own R2 bucket, and the honest limits. - [Privacy](https://kapevault.brewedops.cloud/privacy/): KAPEVault collects nothing: no account, no analytics, no telemetry. Your vault stays encrypted on your devices and only travels to storage you own. - [Terms](https://kapevault.brewedops.cloud/terms/): The plain-language terms for using the KAPEVault apps for Windows and Android, and this website.