We use cookies to enhance your experience. Learn more

🔒 100% Free · Zero-Knowledge · Fully Local

ShabaVault

A zero-knowledge password and secret vault for Windows. AES-256-GCM, Argon2id, an emergency recovery key and built-in 2FA codes - and nothing ever leaves your machine.

Price

Free

Download Free (64-bit)
AES-256-GCM + Argon2id
Emergency Recovery Key
No Cloud, No Account
ShabaVault

What ShabaVault does

A vault, not a service. Your secrets stay on your machine.

Encryption that assumes the file gets stolen

The vault is AES-256-GCM encrypted under a random 256-bit key, and that key is wrapped with Argon2id at 64 MiB - a memory-hard function that collapses the parallelism a GPU farm needs to guess master passwords. Any bit flipped in the file is rejected outright.

An Emergency Recovery Key

Issued once when the vault is created, as a printable SHABA-XXXX-... sheet. It opens the vault if you ever forget your master password, and it is never stored in plain text - so it cannot be shown again, and it cannot be read out of the file.

Built for the secrets you actually keep

Windows entries with RDP host and domain and a one-click Launch MSTSC. Linux entries with SSH port, sudo password and Copy SSH command. macOS with Screen Sharing. Websites with a live TOTP authenticator and countdown ring. API keys and cloud secrets with access key, secret and endpoint.

Bring everything with you

Import from KeePass (CSV/XML), Bitwarden (CSV/JSON), 1Password, LastPass and Chrome or Edge. The format is auto-detected, every row is previewed with a reason if it will be skipped, and duplicates are merged rather than doubled.

Multiple vaults, wherever you want them

A vault is a single .shabavault file. Keep one for work and one for home, put it on a USB stick, a NAS or a synced folder, and open it with a double-click. Recently used databases are listed on the unlock screen.

Backups that stay encrypted

Back up to a local path or a network share with snapshot rotation, or to WebDAV - which insists on HTTPS when credentials are set, so the backup password never crosses the wire in readable form. One click exports an encrypted .vaultbak.

A decoy vault for when you are pressured

A second, duress password opens a harmless decoy at the visible default location. The real vault lives on media you choose and is never written to the recents list. Nothing in either file says which is which.

Hardened against what runs beside it

Auto-lock on inactivity, on Win+L and on suspend. The window renders black to screenshot and screen-recording tools. Copied secrets are wiped from the clipboard after 15 to 30 seconds. Keys are zeroed from memory on lock.

Export on your terms

CSV, HTML or PDF, redacted by default - an inventory of what exists with every secret replaced by [redacted], safe to share. Including secrets is a separate, explicitly warned choice, and CSV round-trips back through the importer without loss.

Your secrets stay yours

ShabaVault is a zero-knowledge password and secret manager for Windows. Every entry is encrypted on your own machine with AES-256-GCM under a random 256-bit vault key, and that key is wrapped with Argon2id - a memory-hard function that makes brute-forcing your master password on a GPU farm impractical. There is no account, no server and no sync service. The vault is a single .shabavault file on your disk, and it opens with a double-click.

When you create a vault you are issued an Emergency Recovery Key - a printable, one-time code that can open the vault if you ever forget your master password. It is the only way back in, and it is never stored in plain text.

Entries are shaped for what you actually keep: Windows machines with RDP host, domain and one-click Launch MSTSC; Linux hosts with SSH port, sudo password and Copy SSH command; macOS with Screen Sharing; websites with credentials and a live two-factor authenticator; and API keys and cloud secrets with access key, secret and endpoint. Custom folders with drag-and-drop, instant search, a password generator with an entropy readout and a security health audit round it out.

Bring your existing passwords with you. Imports from KeePass, Bitwarden, 1Password, LastPass and Chrome or Edge auto-detect the format, preview what will be imported and merge without duplicates. Export to CSV, HTML or PDF is redacted by default. Back up to a local path, a network share or WebDAV with snapshot rotation, or keep several vault files on a USB stick, a NAS or a synced folder.

Threats beyond the file are handled too. The vault auto-locks on inactivity, on Win+L and on suspend; the window renders black to screenshot and screen-recording tools; copied secrets clear from the clipboard after 15 to 30 seconds; and a decoy vault can open with a second password when you are under pressure to unlock.

  • AES-256-GCM encryption with Argon2id key derivation
  • Emergency Recovery Key if you forget your master password
  • Built-in TOTP two-factor codes
  • Import from KeePass, Bitwarden, 1Password, LastPass and Chrome
  • Multiple vault files - USB, NAS or synced folder
  • Encrypted backups to a local path, network share or WebDAV
  • Decoy vault for duress situations
  • Auto-lock, screenshot protection and clipboard purge

Frequently Asked Questions

Common questions about ShabaVault before you download.

Yes. There is no trial period, no licence key and no paid tier. Create a free Spaqitech account, download it, and use it.

In a single encrypted .shabavault file on your own computer. Nothing is uploaded or synced by the app. You decide where the file lives, and you can keep several - on a USB stick, a NAS or a folder your own sync tool already handles.

The database is encrypted with AES-256-GCM under a random 256-bit vault key. That key is wrapped twice, once under your master password and once under your recovery key, each derived with Argon2id at 64 MiB of memory. GCM authenticates the ciphertext, so any tampering with the file is detected and refused.

Use the Emergency Recovery Key you were shown when the vault was created. It unlocks the vault and lets you set a new master password. It is the only way back in - the key is never stored in plain text, so it cannot be redisplayed later and there is no reset link. Print the recovery sheet and keep it somewhere safe.

Yes. ShabaVault imports KeePass (CSV or XML), Bitwarden (CSV or JSON), 1Password, LastPass and Chrome or Edge exports. The format is detected automatically, you see a preview with per-row skip reasons before anything is written, and existing entries are not duplicated.

Yes. Web entries can hold a TOTP secret and show a live six-digit code with a countdown ring, following RFC 6238 - the same standard as Google Authenticator and Authy.

A second vault, opened by a separate duress password, that sits at the visible default location and contains nothing sensitive. Your real vault is stored wherever you chose at setup and is never added to the recent-databases list. It is a deterrent against casual inspection, not a defence against a forensic examination of the same disk.

Master passwords must be at least 12 characters, are checked against a common-password blocklist (including disguised forms like P@ssw0rd or Summer2024), and must contain three character classes or be a passphrase of 16 or more characters. A passphrase of four unrelated words is the recommended choice.

ShabaVault runs on Windows 10 and Windows 11, 64-bit. A portable build that runs without installing is also included.

Lock it down — free

One encrypted file, one master password, a recovery key on paper, and nothing in the cloud.

Price

Free

Download Free (64-bit)

Free account required • Instant download • Windows 10 & 11 • Signed installer