Keyward Desktop and the Keyward Service
The vault on your own Windows computer, as it is designed; the service that holds it, the key the TPM keeps, how a program is identified when it asks, what you approve, and what is imported from Credential Manager.
Designed, not built. Everything on this page describes the design, with its decisions written down and its gates named. No installer exists yet. When one does, this page will change to say what is proven.
Two programs, one installer
The Keyward Service is a Windows service. It starts with Windows, under its own virtual service account
(NT SERVICE\Keyward), and needs no desktop and no signed-in user to answer. It holds the vault, identifies every
program that asks, applies the policy, keeps the leases and writes the audit trail. It listens on no network port:
programs reach it over a named pipe.
Keyward Desktop is the program in the notification area. It shows the approval prompts, lets you set the policy for each caller, shows the audit trail and the leases, imports from Windows Credential Manager, and, when you enrol the computer with a server, keeps the mirror in sync. It also holds the license: Help › License.
They are installed together, by one installer, for Windows 10, Windows 11 and Windows Server.
The vault
The service creates a key in the computer's TPM that cannot be exported, wraps a data key with it, and encrypts
the vault file under the data key (AES-256-GCM, in a versioned envelope). The file lives in the service account's
directory under %ProgramData%\Keyward, with permissions to that account only. A copy of the file on another
computer, or an imaged disk, opens nothing.
Without a TPM (an older machine, a virtual machine without a virtual TPM), the service falls back to Windows' own data protection and says so in every log line. It never falls back silently.
Who is asking
A request over the pipe carries the caller's process. The service reads the process's image path and the image's Authenticode signature, and the account of the user who runs it, and looks up the policy for that publisher and that user. A program is never believed about who it is: a program that claims to be Claude Code is not Claude Code; a program signed by Anthropic is. An unsigned caller gets references only, whatever it claims.
What a caller may have
| Tier | What the caller gets | Who decides |
|---|---|---|
| Reference | names, paths, handles (kw://project/env/KEY), when a secret was rotated, whether it exists |
the policy |
| Inject | the value, placed into a process's environment (keyward run -- <command>), a pipe or a helper protocol; never into the caller's own memory space if the caller is a model |
the policy; Windows Hello per caller or per project if you want it |
| Reveal | the value itself, once, for a lease of minutes | you, every time, with Windows Hello, with the caller, the secret and the reason on the prompt |
| Write | a new or changed secret; the caller gets the handle back | the policy |
Every answer is leased and audited: who, which program, which secret, the reason given, the approval. A revealed value is marked as exposed in the audit, so that its rotation can be scheduled.
Windows Credential Manager
Credential Manager is where Windows keeps what Windows needs: credentials for Remote Desktop, for shares, for a domain. Keyward leaves those alone. What it does:
- imports entries you choose into the vault, one way, when you ask;
- publishes entries you choose back into Credential Manager, for a program that reads it directly and has no other way; the vault owns that copy and rewrites it when the secret rotates;
- replaces Credential Manager where a tool has a pluggable helper, such as git, Docker and Python's keyring; see Credential helpers.
Hooking the Credential Manager API itself, so that every program would read from Keyward without knowing it, is not done, by decision: there is no supported way, and the unsupported ways are what endpoint protection exists to flag.
Sync with a server
Off by default. When you enrol the computer with a Keyward server, you choose which projects are mirrored. The server stays authoritative for them, the computer works when it is offline, and a revocation on the server empties the mirror the next time the computer connects. The connection is always from the computer to the server. See Enterprise.
The gates to exit the design
The first release is accepted when, on clean Windows 10, Windows 11 and Windows Server machines: it installs and survives a reboot as a service; a reveal needs Windows Hello; an unsigned caller is refused; a copy of the vault file on another machine cannot be opened; and no value appears in any log. Green unit tests do not pass these gates; only the machines do.