Keyward Server is a secrets, credentials and machine-identity platform you run yourself. Keyward Desktop is a vault on your own Windows computer: AI sessions and developer tools ask it for secrets, it answers under a policy you set, and it syncs with a server only when you want it to.
Signed updates No cloud required, no tracking
They are separate programs with separate trust boundaries. The server never opens a connection to your computer; the Desktop never needs the server; and the model never sees what it does not need to.
Projects, environments, secrets, certificates and machine identities, with an API, a web console and a command line. A downstream fork of Infisical's MIT-licensed core, carrying its own provenance in every build, operated by Exprezoe on its own hardware.
A Windows service that starts with Windows and holds a vault encrypted under a key your TPM keeps; a desktop app for approvals, policy and import from Credential Manager. No cloud needed, ever.
Claude Code, Codex and Claude Desktop talk to the service on your computer; claude.ai, ChatGPT and Codex in the cloud talk to the server behind OAuth. Same tools, same policy, same rule: a handle by default, a value only where a process needs it.
Anything a model can read, a prompt injection can send away. So Keyward's default answer to an AI session
is a handle, kw://project/env/KEY, and what is known about it. The value goes into the
process that needs it, through keyward run or a helper protocol, and reaches the model's
context only when a person approves that one reveal, for minutes, with the reason on record.
The Keyward Service keeps its vault under a key that the computer's TPM creates and never exports; the data key is wrapped by it, and the vault file is encrypted under the data key. A copy of the file on another computer, or an imaged disk, opens nothing. There is no listener on the network: programs talk to the service over a named pipe, and the service identifies each one.
Every release carries a manifest signed with the Keyward release key, which lives in a vault and not on this site. Each program checks that signature against a key compiled into it, then checks the installer's size and SHA-256 against the signed manifest. A server, a mirror or a network in between can refuse you an update. None of them can hand you a forged one.
Claude Code, Codex and Claude Desktop on your computer; claude.ai and ChatGPT through the server. One MCP, handles by default.
Machine identities for GitLab CI, containers and services, with secrets fetched at run time instead of pasted into variables.
git, Docker and Python's keyring get a Keyward helper; keyward run puts a project's secrets into any command's environment.
Staff sign in with Exprezoe Identity, with a second factor, and reach only the projects their groups allow. Nobody types a secret into chat.
With the license key you were given. One license covers Keyward Desktop and the command line.
Download the installer and check its SHA-256 against the one shown.
Enter the key once, in Keyward Desktop. The computer takes one seat, for both programs, which you can give back at any time.
Allow Claude Code, or git, or a build script, to ask. Choose what each may have: a handle, a value in its process, or a reveal with your approval.
You are reading about a product that will hold your secrets. You should know what is built, what is designed, and what we have only tested ourselves. Today, Keyward Server 1.0.0-alpha.1 is the first build, running on an internal staging instance with empty data; Keyward Desktop, the Service, the command line and the connectors are designed, with their decisions written down, and not built.
| Area | Today |
|---|---|
| Keyward Server: the fork, with its provenance in every build | 1.0.0-alpha.1, internal |
| Restore and cryptographic recovery of the server's data, proven weekly | Proven |
| Licenses, seats, activation, signed updates, this site | Built |
| Staff sign-in with Exprezoe Identity, browser and desktop | Built; switched on per site |
| Keyward Desktop and the Keyward Service | Designed |
| Keyward MCP, local, for Claude Code, Codex and Claude Desktop | Designed |
| The Keyward Connector for claude.ai, Claude Desktop and ChatGPT | Designed |
| Credential helpers for git, Docker and keyring; Credential Manager import | Designed |
| Enterprise sync between a computer and the server | Designed |
| The command line for Windows, macOS and Linux | Not yet |
A platform for secrets, credentials, certificates and machine identities that you run yourself: Keyward Server, a downstream fork of Infisical's MIT-licensed core, operated by Exprezoe; and Keyward Desktop, a vault on your own Windows computer that AI sessions and developer tools use without any cloud, and that can sync with a server when you want it to.
It knows who is asking. Every request names the program that made it, checked by its signature, and is answered under a policy: a handle, a value placed into a process, or, only with your approval on the spot, a value shown. It keeps a lease and an audit line for each. Credential Manager keeps the secrets Windows itself needs and is left alone; Keyward imports from it when you ask and replaces it where a tool has a pluggable helper, such as git and Docker.
Anything a model can read, a prompt injection can send away. So the default answer to Claude Code, Codex or any other session is a reference like kw://project/env/KEY and what is known about it. The value goes into the process that needs it, through keyward run or a helper protocol, and never into the model's context unless a person approves that one reveal, for minutes, with the reason on record.
Yes, and there is one design for all of them: one MCP server with two transports. The Keyward Service on your computer serves the local one to Claude Code, Codex and Claude Desktop; the Keyward server serves the same tools over the internet, behind OAuth through Exprezoe Identity, which is what Claude's and ChatGPT's custom connectors are. ChatGPT has no local path, so it reaches a computer's vault only through the server.
Where you decide. On the computer, a vault file encrypted under a key the TPM holds, in a service account's directory, useless when copied elsewhere. On the server, Keyward Server's own database, on hardware Exprezoe runs. Syncing a project between the two is a choice per project, and the server never opens a connection to your computer.
Keyward Server runs as a container on Linux. Keyward Desktop is for Windows 10, Windows 11 and Windows Server. The command line is designed for Windows, macOS and Linux. Nothing on this site has been shown for a platform other than the one it names.
Each program checks this site's channel for itself, verifies the release's signature against a key built into it, downloads the installer when you agree, and checks its size and SHA-256 before running it. It never installs an older version.
One license covers Keyward Desktop and the command line on a number of computers. In early access, licenses go to Exprezoe's staff and to the testers we invite, issued by a person; there is no sign-up on this site, and nothing is on sale yet.
Not yet. Keyward Server 1.0.0-alpha.1 is the first build and runs on an internal staging instance; Keyward Desktop, the command line and the connectors are designed and not built. The status page says what exists, what is proven and what is next, and this page will change the day there is an installer to verify.
A secrets, credentials and machine-identity platform you run yourself, and a vault on your own Windows computer that gives AI sessions handles instead of secrets. In early access, licenses go to Exprezoe's staff and to the testers we invite; one license covers Keyward Desktop and the command line.