7KEY
NewAI agents use keys they never see

Passwords, 2FA and team secrets. One vault.

Encrypted on your device, shared only with the people you choose.

Add to ChromeSee how it works
AES-256 on your deviceZero-knowledge serverFree for teams of up to 5

Switch in a minute fromBitwarden1PasswordProton PassChromeFirefoxSafari

Who it's for

Built for you, your team and your deploys.

One vault, three ways in.

  • 2FA codes next to the loginFilled with the password. No phone to dig out.
  • Fills where you sign inLogins, cards and addresses. Offers to save new ones.
  • Unlock with a touchTouch ID or Windows Hello, and passkeys for sites that take them.
  • Share without sending a passwordA link that expires, with an optional link password or named recipients.
  • A separate email for each siteSign up as you+shop@gmail.com in one click and see who leaks your address.
Recovery codes

Backup codes that keep count.

Save the codes a site gives you when you turn on 2FA. Tick each one off when you use it, and always know how many are left.

  • Paste the whole list
  • Tick off used codes
  • Copy the ones left
  • The right access for each personCan edit or can view, per team. Invite people straight into a team.
  • Protect productionEveryone reads it, only admins change it.
  • Shared team vaultsLogins the whole team uses, encrypted for each member.
  • Re-key when someone leavesOne click gives the team new keys and re-encrypts everything. Old copies open nothing new.
  • Secrets per environmentDev, staging, production. See what is missing before a deploy breaks.
  • One CLIrun, dotenv, read, inject. No .env files passed around in chat.
  • GitHub Actions, checked with OIDCOnly the repository and branch you linked can read.
  • AI agents that never see the keyClaude Code and Codex call your APIs with placeholders.
How zero-knowledge works

We can't read your data.

Everything is encrypted on your device before it is sent, guaranteed by the architecture rather than a promise. Read the threat model.

  1. 01

    Encrypted on your device

    AES-256-GCM, with a key only your master password can unlock.

  2. 02

    Stored as ciphertext

    Even a leaked database reveals nothing readable.

  3. 03

    Decrypted by your teammate

    With their own key, on their own device.

AES-256-GCMThe most widely used cipher
600,000PBKDF2 iterations on your password
No backdoorNobody can open your vault for you
SyncedEvery device, still end-to-end encrypted
Developers

Secrets where your code runs.

From your terminal to CI to your AI agent, without pasting a value.

~/payments-api
$ 7key link
Linked to Acme / Payments API / Development (.7key.json).
.7key.json holds no secrets and can be committed.

$ 7key run --env production -- npm start
7key: 3 values from Payments API / Production
> payments-api@1.4.0 start
Listening on :3000

$ 7key inject -i config.tpl -o config.yml
7key: injected 2 references into config.yml

$ 7key agent -- claude
7key: Payments API / Development for claude
  STRIPE_KEY  → api.stripe.com
Allow? [y/N] y
7key: used STRIPE_KEY for api.stripe.com
$
Installnpm install -g @7key/cliorbrew install linhv14/7key/sevenkey

GitHub Actions

Every read is checked against GitHub's OIDC token: repository and branch must match. 

permissions:
  id-token: write
steps:
  - uses: Linhv14/7key-action@v1
    with:
      link: ${{ vars.SEVENKEY_LINK }}
      key: ${{ secrets.SEVENKEY_KEY }}
  - run: ./deploy.sh

AI agents

The model gets a placeholder. 7key swaps in the value only for hosts you allowed.

Teams

Share access, not passwords.

Who can edit, who can view, what changed and when.

Protected production

Everyone in the team reads it. Only admins change it.

Can edit, can view

Set per person, per team.

Activity log

Every read and change, in a tamper-evident chain.

Secret history

The last 5 values and who wrote them.

Compare

Two tools in one vault.

Password managers stop at the browser. Secret managers stop at the terminal.

7key compared with password managers and secret managers
Feature 7KEY Password managers Secret managers
Passwords and 2FA codes ✓ Often —
Autofill and passkeys in the browser ✓ ✓ —
Team secrets per environment ✓ — ✓
CLI and GitHub Actions ✓ Varies ✓
AI agents without exposing keys ✓ — Rare
Zero-knowledge encryption ✓ Often Varies
Share links that expire ✓ Often —
Self-host ✓ Varies Varies

Categories, not specific products. Features vary by product and plan.

Pricing

Less than a coffee per person.

Every feature on every plan. You pay only for team members beyond five.

Free

Start here
$0

For individuals and teams of up to 5 members.

5members
∞teams
∞projects
  • Vault, 2FA, passkeys and autofill
  • Teams, projects, CLI, CI, AI agents
  • Sharing, import and export
Add to Chrome

Team

Most teams
$3/ person / month

billed yearly, or $3.5 monthly

For teams of 6 members or more.

  • Everything in Free
  • Unlimited members
  • Pay only for the members you have

Billing isn't open yet. Teams over 5 use it free, with 30 days' notice.

Get Team free

Self-host

Your server
$0

Run the 7key server on your own Cloudflare.

  • Every feature, no limits
  • Your domain, your backups
  • Same end-to-end encryption
Talk to us
Get started

Up and running in a minute.

The extension for your browser, the CLI for your terminal.

Chrome extension

Vault, autofill and 2FA codes in your browser.

  1. Download 7key-extension.zip and unzip it.
  2. Open chrome://extensions and turn on Developer mode.
  3. Load unpacked and pick the folder.
Download for Chrome Chrome Web Store listing coming soon.

CLI

Secrets for local runs, CI and AI agents.

$brew install linhv14/7key/sevenkey
$7key login
>npm install -g @7key/cli
>7key login
$npm install -g @7key/cli
$7key login
FAQ

Common questions.

Forgot my master password?

If you created a recovery code, use it to set a new master password. Without one, the vault can't be opened: nobody else has a copy.

Can 7key read my data?

No. It is encrypted on your device and the keys never leave it.

Where is it stored?

Encrypted, on Cloudflare's network and on your devices. See the privacy policy.

Has it been independently audited?

Not yet. The design and its limits are in the threat model.

Can I bring my passwords from another app?

Yes. 7key imports exports from Bitwarden, 1Password and Proton Pass, and the CSV that Chrome, Edge, Firefox and Safari export.

Does it work offline?

Yes. Your vault is stored encrypted on your device, so you can unlock it, search it and get 2FA codes without a connection. Adding, editing or deleting needs one.

How long does a share link last?

It stops opening after 1 hour, 1 day, 7 or 30 days, or after its one view, and you can revoke it at any time. The key is in the link itself, so the server can't read what you shared.

What happens when someone leaves the team?

An admin re-keys the team in one click. Every secret is re-encrypted, so what they kept can't open anything written afterwards.

Can we run our own server?

Yes. A team can run its own 7key server on its own domain. Write to hello@7key.online.

One vault for every key.

Free for you and teams of up to 5. Set up in a minute.

Add to ChromeTalk to us