LocalKey Vault — Secret store for local-first AI tools

Let browser-side AI tools store API keys safely without any backend.

Problem

More devs are building purely front-end AI workflow orchestrators that go BYOK straight to model providers, but the key just sits in LocalStorage/IndexedDB in plaintext. On a shared computer or when lent out, there is zero shoulder-surfing protection, and importing community-shared workflow JSON is scary because it may carry credentials. Meanwhile desktop AI CLIs encrypt keys with predictable strings derived from the platform name plus home path, which is encryption in name only.

Solution

A tiny front-end crypto library plus CLI that derives a key from a passphrase (WebCrypto + Argon2/scrypt) and stores API keys encrypted inside LocalStorage/IndexedDB. Supports lock/unlock sessions, sanitized import/export, and a credential scanner for workflow JSON. Ships as a one-line snippet embedded into existing tools.

Users

Authors of local-first AI workflow tools, privacy-sensitive indie devs, and home-lab users running browser AI tools on a NAS or router.

MVP

WebCrypto passphrase derivation + AES-GCM storage; lock/unlock API with session timeout; credential scanner that highlights keys in JSON; an embed demo showing integration into an existing AI tool; a CLI to encrypt local config files.

Revenue

Open core + commercial license for closed-source embedding / one-time Pro buyout with multi-device synced encrypted blobs and audit log.

Why now

AI tooling is shifting from SaaS to local-first BYOK, yet almost nobody ships a matching local secret layer. A pure front-end scope makes it doable solo before big players bother.