Kakuremi vs PassPony

A local-first KeePass (KDBX) password manager for iPhone -- works offline, with AutoFill and Face ID, compatible with KeePassXC and KeePass2. Opening your first database and editing your vault are free. YubiKey NFC unlock is included free -- no subscription. Kakuremi was built for one thing: a KeePass vault that stays yours. **YubiKey Challenge-Response -- Free, No Subscription** Enter your master password, then hold your YubiKey to the top of your iPhone over NFC -- the key is a second factor, not a replacement for your password. The hardware-key unlock is not time-limited, not gated, and not billed separately. Kakuremi uses HMAC-SHA1 Challenge-Response, the same scheme as the KeePass desktop apps. It works with NFC-capable YubiKey 5 Series models and the YubiKey NEO once an HMAC-SHA1 slot is configured (via the YubiKey Manager / Authenticator app). FIDO2/passkey-only keys -- such as the Security Key Series -- cannot unlock a database, because they do not implement HMAC-SHA1 Challenge-Response. **A KDBX Engine Written in Rust** Kakuremi's KDBX parsing and serialization are written in Rust, a memory-safe language chosen to reduce the risk of buffer-overflow and use-after-free bugs. Open KDBX 3.x (read-only) and KDBX 4.x; create, edit, and save in KDBX 4. Compatible with KeePassXC, KeePass2, and other standard-compliant KeePass clients. **AutoFill in Safari and in Apps** Kakuremi ships a native Credential Provider extension that works with AutoFill on current and older versions of iOS. Tap the key icon, choose Kakuremi, and pick the login you need. **Local-First -- No Accounts, No Cloud Sync** Kakuremi has no accounts, no sync service of its own, no telemetry, and no analytics. Your database is decrypted in memory and released when the app locks. An encrypted copy of your logins (used by AutoFill) and recent copies of your vault file stay in the app's own storage -- you can clear both in Settings. Apart from Apple's own App Store purchase checks, the only network features are optional and off by default: website icons (only a site's domain is sent to Google's favicon service) and password breach-check (a partial, anonymized hash sent to Have I Been Pwned). Neither lookup sends your master password or an entry's password, username, or notes. **What's Free** - Create or open one KeePass database (KDBX 4; KDBX 3.x read-only) - Create, edit, and organize entries, groups, and tags - YubiKey NFC Challenge-Response unlock - Face ID / Touch ID biometric unlock - iOS AutoFill (Credential Provider) - Store TOTP (2FA) secrets and view live one-time codes - Password generator - Search and Recycle Bin - View attachments - Password breach check (Have I Been Pwned) - Themes (Light / Dark / Warm) and 6 accent colors - Localized in 9 languages **Kakuremi Pro** For power users who want more: - Use more than one database - Add file attachments - Backup history & restore Pricing: a monthly or yearly subscription, or a one-time purchase. New subscribers get a 1-month free trial on the yearly plan; the subscription then renews at the yearly price unless it is canceled at least 24 hours before the trial ends. Prices for your region are shown on this page. **Why "Kakuremi"?** Kakuremi (Japanese: hidden form) refers to the art of concealment. Your secrets deserve to be invisible -- no account to sign into, no service of ours holding them, no fragile code to corrupt them. Just hidden in the file you chose. Built by Springhiker Inc. --- Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ Privacy Policy: https://kakuremi.com/privacy/

PassPony is a password manager for people who want to own their passwords. Every entry is one encrypted file in a store you control, in the same format as the pass and passage command line tools. Your Mac, your server, and your phone can all work on the same store. WHY A FILE-BASED STORE One entry, one file: the password on the first line, anything else after it. Encrypted with your keys: age identities for passage stores, OpenPGP keys for pass stores. Synced with git over HTTPS or SSH: clone your existing store, publish a new one, and resolve conflicts per entry, never with a silent merge. Interoperable: commits match the pass CLI format, so the store stays fully usable from the desktop tools. EVERYDAY USE AutoFill: your passwords appear above the keyboard when you sign in. Only entry names are indexed; nothing decrypts until you fill. Passkeys: save a passkey for a site and sign in with it. It lives in that site's entry, encrypted with your keys, and syncs like everything else. One-time codes: TOTP with a countdown ring, HOTP counters, and import from an authenticator app's export QR codes. Face ID or Touch ID unlock, with a five-minute grace window shared with AutoFill. Ephemeral clipboard: copies are local only and clear after 45 seconds. Field-level editing that preserves the exact bytes of lines it does not touch. YOUR KEYS STAY YOURS Back up every key on your phone to one file locked with a recovery code, and restore it on a new phone. SSH sync uses a key made on your phone or imported; hosts are trusted on first use and a changed host key is refused. Phones that share a store each add their own public key to it when they sync, and you approve every new key before your entries are re-encrypted for it. Secret keys never leave a device. PRIVATE BY ARCHITECTURE No account, no signup, no PassPony server. The only network connection is the git remote you configure. No analytics, no ads, no tracking. Open source, Apache-2.0. The full app and its Rust core are published in a public git repository for anyone to audit. FORMATS passage stores encrypt with modern age identities. pass stores encrypt with OpenPGP keys (Cv25519 and X25519/Ed25519 in software). RSA-keyed stores need a smartcard, which is not supported yet. Each format keeps its own store; switching never touches the other. Localized in English, Spanish, French, German, Simplified Chinese, Brazilian Portuguese, and Russian. If you already run pass or passage, PassPony is the missing phone half of your setup. If you have never used them, the first-run tour will have you adding your first pass in about a minute.