Different approach, different trade-offs. Traditional password managers like 1Password, Bitwarden, and LastPass store your passwords in an encrypted vault. Keygrain doesn't store anything — it derives passwords on the fly.
Keygrain trades vault features (sharing, custom passwords, recovery) for a simpler threat model: if there is no password database, there is no password database to breach. The limitations below are architectural decisions, not missing features.
| Feature | Keygrain | Traditional Vaults |
|---|---|---|
| Storage | Nothing stored — nothing to breach | Encrypted vault on servers (encrypted even if breached) |
| Account | No account needed | Requires account + master password |
| Sync | Optional encrypted sync — or none needed | Cloud sync with offline cache available |
| Recovery | No recovery if secret is lost — by design. Deterministic derivation eliminates server-side recovery. Your secret IS your vault — there is no secondary copy to fall back on. | Recovery options exist (emergency contacts, reset flows) |
| Unique passwords | Deterministic — same inputs always produce the same output | Stored randomly generated passwords |
| Offline | Works fully offline | May need internet for sync or login |
| Cost | Free, open source | Ranges from free and open source (Bitwarden) to paid proprietary (1Password) |
| Password sharing | Not possible — by design. There is no vault to share from. Giving someone ongoing access to your passwords would require revealing your master secret, so Keygrain eliminates the sharing attack surface entirely. | Supported (family/team vaults) |
| Custom passwords | Not supported — by design. Deterministic derivation means every password is reproducible from inputs alone. Storing custom passwords would require a vault, defeating the core architecture. | Fully supported |
There's no wrong choice — only different priorities. Many people use both: Keygrain for personal accounts, a vault for team credentials.
Last reviewed: June 2026