Kosh
A fast, secure, offline-first command-line password manager. Doing one thing well: managing passwords without complexity.
Offline by Design
Zero trust, zero tracking. All encryption happens locally. Your vault never touches the cloud.
Modern Crypto
Secured with the best modern primitives. No outdated algorithms.
- Argon2id
- Curve25519
- ChaCha20-Poly1305
Adaptive Search
Tolerates typos and abbreviations. kosh gpat finds git_personal_access_token, ranked by match quality, then recency and frequency.
Isolated Profiles
Separate vaults for work, personal, or anything else — each with its own master password and keypair. Unlocking one grants no access to any other.
- kosh profile create work
- kosh use personal
Encrypted SQLite
Encrypted SQLite Vault
A single, highly portable file using Write-Ahead Logging. Deleted vaults are overwritten with random bytes on top of SQLite's secure-delete — best-effort on modern SSDs, which is why everything is encrypted at rest: whatever survives on disk is ciphertext with no key.