Kosh

Secure. Simple. Open. Your credentials never leave your machine.

Get Started What's new in v0.3.0 View Source

$ kosh add
(work) [?] enter master password:
(work) [?] enter credential label: git_personal_access_token
(work) [?] enter credential user: alice
(work) [?] enter credential secret:
(work) [?] confirm credential secret:
(work) [✓] credential saved successfully

# four keystrokes to get it back
$ kosh gpat
(work) [?] enter master password:
(work) [✓] credential copied to clipboard

Local-first by construction

No cloud. No accounts. No network.

Kosh is a single static binary with a single job: keep your credentials encrypted on your own disk and hand them to you fast. It makes no network requests, writes nothing outside ~/.kosh, and never prints a secret to your terminal — retrieved secrets go straight to the clipboard.

Argon2id
Curve25519
XChaCha20-Poly1305
Per-entry ephemeral keys
Encrypted SQLite
No CGO
Zero telemetry

How the encryption works →

Adaptive search

Type what you remember

Kosh ranks on how closely a credential matches what you typed. Usage habits nudge the order but can never override relevance — so a credential you open daily can’t outrank the one you actually asked for. Highlighted characters below are the ones Kosh matched.

Abbreviations — characters in order, gaps allowed

gpat→git_personal_access_token

awsprod→aws_production_key

dbpw→database_password

Typos — a swapped pair costs one edit, not two

crat→cart

recieve→receive

githbu→github

How ranking works →

Profiles

One vault per context

Work secrets and personal secrets live in separate files with separate master passwords and separate keys. There is no global password and no shared root secret — unlocking one profile gives you no access to another.

default.db

master password Aown salt + keypair

work.db

master password Bown salt + keypair

personal.db

master password Cown salt + keypair

kosh use work switches every command at once, and the active profile prefixes every line Kosh prints — so you always know which vault you are talking to.

Working with profiles →

Install

Up and running in a minute

go install git.plutolab.org/plutolab/kosh@latest

kosh init      # create your encrypted vault
kosh add       # store a credential
kosh           # interactive search — type to filter, enter to copy

Prebuilt binaries for macOS, Linux and Windows are on the releases page.

Full installation guide →