Local-first · Zero-knowledge

Your keys.
Only yours.

Monark is an open-source password manager that keeps your credentials on your own machine. No account, no sync server, no telemetry — just a vault encrypted where it lives.

Runs on
Linux, macOS, Windows, Android, iOS
Cipher
XChaCha20-Poly1305
Key derivation
Argon2id · 64 MB
License
AGPL-3.0
What it does

Everything a password manager should do, and nothing it shouldn't.

Monark stores logins, notes and one-time codes in a single encrypted file you own. There is no vendor in the middle, because there is no vendor in the middle.

Your vault is a file on your disk

Entries are encrypted before they touch storage and decrypted only while you have the vault open. Monark works fully offline; the network is never involved unless you ask it to be.

Crypto done in Rust

The cryptographic core is written in Rust and runs natively, not in the page.

Password generator

Passwords and passphrases drawn from the operating system's CSPRNG, with the character sets and length you choose.

Two-factor codes

Store TOTP secrets next to the login they belong to and read the current code from the vault window.

Optional encrypted backup

Copy the vault to your own Google Drive or a WebDAV server. The file is already encrypted before it leaves your device.

One codebase, every desktop and phone you own

Monark is built on Tauri v2, so the same Rust core and interface ship to Linux, macOS, Windows, Android and iOS without an Electron runtime in tow.

Under the hood

The parameters, in plain writing.

Nothing here is proprietary and nothing is secret. The exact primitives are documented in the repository and covered by tests.

Key derivation
Argon2id with 64 MB of memory, 3 iterations and 4-way parallelism, to make GPU-assisted guessing expensive.
Authenticated encryption
XChaCha20-Poly1305 (IETF) with 256-bit keys and 192-bit random nonces per operation.
Randomness
Every key, salt and nonce comes from the operating system's CSPRNG, never from a language-level generator.
Memory hygiene
Derived keys and plaintext secrets are zeroized on drop, so they do not linger in freed memory.
Storage
A single local vault file you can move, copy or delete. Cloud copies are the same encrypted bytes.
Source
Licensed AGPL-3.0. Build it yourself, audit it, or file an issue against the exact revision you run.

Read the code before you trust it with your passwords.

Monark ships from an open repository with its tests, cryptographic parameters and release artifacts in the same place. Verify the build, or compile it yourself.