keeweb-lite

keeweb-lite is a lightweight, web-only password manager inspired by KeeWeb. It stays intentionally small and practical: static app, client-side only, and focused on core vault workflows.

Features

• Source types: Local and optional Google Drive.
• Unlock with password and optional key file.
• Optional biometric unlock with a passkey (WebAuthn PRF): enter the password once, confirm the warning (the passkey is used in an unintended way and stays in your password manager after the record is removed), then use the fingerprint button.
• Key file stays in runtime memory during unlock flow.
• Google Drive records sync after every change.
• No settings/options UI; behavior is fixed by design.
• KeeWeb-like workspace layout: groups, tags, entry list, and details editor.
• Built-in password generator in entry editing flow.
• Native KDBX entry history with apply/restore workflow.
• Remove and restore entries with recycle-bin behavior.
• Download current encrypted .kdbx at any time.
• Mobile-friendly layout for unlock and workspace flows.
• Auto-lock after inactivity.

Requirements

• Node.js >= v24.22.1
• npm >= 11.19.1

Scripts

npm run dev          # Start Astro dev server
npm run build        # Build production output
npm run preview      # Preview production build

npm run check        # Astro diagnostics and type-checking
npm run test         # Run unit tests
npm run test:watch   # Run unit tests in watch mode

npm run lint         # ESLint check
npm run lint:fix     # ESLint fix

npm run csslint      # Stylelint check
npm run csslint:fix  # Stylelint fix

npm run format       # Prettier check
npm run format:fix   # Prettier write

Resources

• Screenshots: workspace, unlock, workspace mobile, unlock mobile

Docker

The Docker image builds the Astro app inside the container, then serves the static dist/ output with Nginx.

PUBLIC_GOOGLE_CLIENT_ID and PUBLIC_GOOGLE_APP_ID are optional. They are compiled into the client bundle at build time, so changing them requires rebuilding the image. Leave both unset to build without Google Drive.

PUBLIC_GOOGLE_SITE_VERIFICATION is optional too. When set, it adds the Google Search Console google-site-verification meta tag to every page.

Build image:

docker build \
  --build-arg PUBLIC_GOOGLE_CLIENT_ID=your-client-id \
  --build-arg PUBLIC_GOOGLE_APP_ID=your-project-number \
  --build-arg PUBLIC_GOOGLE_SITE_VERIFICATION=your-verification-token \
  -t keeweb-lite .

Run container:

docker run --rm -p 4321:80 keeweb-lite

Use Docker Compose:

# Optionally set `PUBLIC_GOOGLE_CLIENT_ID`, `PUBLIC_GOOGLE_APP_ID` and `PUBLIC_GOOGLE_SITE_VERIFICATION` in `.env`, then run:
docker compose up -d --build # App is available at `http://localhost:4321`.

Google Drive Setup

Google Drive is optional. It is enabled only when both PUBLIC_GOOGLE_CLIENT_ID and PUBLIC_GOOGLE_APP_ID are set at build time. Without them, the Google scripts are not loaded and the Google Drive import and create options are hidden. Records saved earlier from Google Drive are still listed. They can be unlocked, edited and downloaded locally, but they are not synced until the app is built with Google Drive enabled.

To enable Google Drive integration, you need a Google Cloud project with OAuth 2.0 credentials.

1. Create a Google Cloud Project

1. Go to Google Cloud Console and create a project.
2. In APIs & Services -> Library, enable Google Drive API.
3. In APIs & Services -> Library, enable Google Picker API.

2. Configure OAuth Consent Screen

1. Go to APIs & Services -> OAuth consent screen.
2. Set User type to External.
3. Fill required app information.
4. In scopes, add https://www.googleapis.com/auth/drive.file.
5. While publishing status is Testing, add your account as a test user.

3. Create OAuth 2.0 Credentials

1. Go to APIs & Services -> Credentials -> Create -> OAuth 2.0 Client ID.
2. Set Application type to Web application.
3. Add authorized JavaScript origins:
   • http://localhost:4321
   • Your production origin
4. Put the client ID in .env:

PUBLIC_GOOGLE_CLIENT_ID=your-client-id

4. Get the Project Number

The Google Drive Picker requires your Cloud project number (not the project ID string).

1. Go to IAM & Admin -> Settings (or the home dashboard).
2. Copy the Project number (numeric value).
3. Add it to .env:

PUBLIC_GOOGLE_APP_ID=your-project-number

License

MIT