Alpha software. Don't point Clavix at a vault holding secrets you can't afford to lose yet — the crypto hasn't been independently audited. Read the disclaimer →

The KeePassXC experience for your Vaultwarden vault

Clavix is a fast, native desktop client for Vaultwarden and Bitwarden — the comfortable tree vault with real drag & drop that the self-hosted community has been missing.

Download for desktop View source
Linux macOS Windows Built with Tauri 2 GPL-3.0
Clavix — My Vault
No telemetry, ever Opens offline, read-only Full write access, no premium tier
Features

The tree is what Clavix adds. The rest comes free.

Clavix talks to your real Vaultwarden or Bitwarden server — it just gives you a far nicer way to live in your vault.

Only in Clavix

Tree vault & drag & drop

A real hierarchical tree built from your parent/child folder names and org collections. Drag items onto folders, drag whole folders to reorganise — sub-folders cascade-rename on the server.

Open an item and its header spells out where it's filed: the full folder path, or one line per collection for a shared item. Two entries with the same name never get mixed up.

Also included, free. Much of this exists in other Bitwarden clients too; in Clavix none of it sits behind a premium tier.

Sign-in & keys

Full 2FA, including WebAuthn

TOTP, YubiKey OTP and WebAuthn / FIDO2. Clavix drives your hardware key over CTAP2/HID itself, so it works even though a desktop app isn't a browser on your vault's domain.

YubiKey unlock

After auto-lock, touch a registered FIDO2 key instead of retyping your master password — CTAP2 hmac-secret, like Bitwarden's PRF unlock.

Embedded SSH agent

Serves your vault's Ed25519 and RSA keys to ssh, git and scp without writing them to disk — Unix socket on Linux and macOS, OpenSSH pipe and Pageant on Windows.

Live TOTP & QR scanner

Rolling codes from stored secrets (custom period, digits and hash), and QR scanning with your camera to add a new secret while editing a login.

Safety nets

Encrypted backups you can actually open

Export every item type under a password you choose (Argon2id). Re-import it, or open it read-only with no server and no account.

Encrypted offline cache

The vault is cached in encrypted SQLite under your user key, so unlocking is instant — and when your server is unreachable, it opens read-only from the cache.

Built-in security audit

A Have I Been Pwned k-anonymity lookup, plus local checks for reused and weak passwords. No password or hash leaves your machine in the clear.

Day to day

Password strength, where you choose one

The generator shows exact entropy in bits; the editor and item view show a zxcvbn score computed in Rust — even for a password that is still masked, and always in line with the audit.

KeePassXC import

Bring in a KeePassXC CSV export: Clavix creates a folder per Group, so your hierarchy lands intact instead of as a flat dump.

System tray & auto-lock

Hides to the tray on close like KeePassXC and auto-locks on idle — a Rust watchdog drops the session even if the window freezes. The clipboard clears after 30 s.

Security model

Your master password never leaves your device

Clavix reimplements the Bitwarden crypto in Rust (it does not bundle the ambiguously-licensed official SDK). Everything sensitive stays local.

Honest status: Clavix is alpha. The cryptography has not been independently audited and a significant part of the code was AI-assisted under human review. Don't trust it with irreplaceable secrets yet. Read before you decide:

Only derived values are sent

The server sees the master-password hash for auth and never the password itself; the master key stays on the client for decryption.

AES-256-CBC + HMAC-SHA256

Personal vault items are decrypted and encrypted client-side; organization keys use RSA-OAEP. PBKDF2 and Argon2id KDFs are both supported.

Keys zeroized on drop

Every sensitive key derives ZeroizeOnDrop, wiping its bytes from memory the moment it's no longer needed.

Encrypted session at rest

The refresh token on disk is itself encrypted under the user key; the access token auto-refreshes 60 s before expiry. Files are written 0600.

core/src/crypto.rs · L179–209real code, trimmed
#[derive(Zeroize, ZeroizeOnDrop, Clone)]
pub struct MasterKey([u8; 32]);

pub fn derive_master_key(password: &SecretString,
    email: &str, kdf: KdfType, /* … */)
    -> Result<MasterKey> {
    let email_lower = email.trim().to_ascii_lowercase();

    // Bitwarden salts PBKDF2 with the raw e-mail and
    // Argon2id with its SHA-256 digest.
    let salt: &[u8] = match kdf {
        KdfType::Pbkdf2 => email_lower.as_bytes(),
        KdfType::Argon2id => {
            argon_salt = Sha256::digest(
                email_lower.as_bytes()).into();
            &argon_salt
        }
    };
    // … refuses PBKDF2/Argon2id parameters below the floors
}
How it compares

Clavix vs. the alternatives

Why build another client? Because nothing else gives self-hosters a proper tree with drag & drop and full write access for free. Here is where it wins, and where it doesn't yet.

Clavix Bitwarden Keyguard KeePassXC
Syncs with Vaultwarden / BitwardenFile-based
Tree vault (nested folders)11
Drag & drop items / folders
Create & edit items (write)Premium in store builds4
Embedded SSH agentVia the system agent
Native (not Electron)Tauri / RustElectronComposeQt / C++
Independent security auditNot yet?2
Signed release buildsNot yet?
Mobile appsDesktop only3iOS & AndroidAndroidThird-party apps
Browser autofillNoAndroid only
PriceFree · GPL-3.0Free / PremiumFree / PremiumFree · GPL
  1. Bitwarden and Keyguard nest folders named “Parent/Child”, but neither offers drag & drop to move items or folders (Bitwarden, Keyguard).
  2. KeePassXC 2.7.4 was reviewed by an independent consultant in 2023 (report). KeePassXC keeps a local file; it doesn't talk to a Vaultwarden server.
  3. Clavix talks to your server like any Bitwarden client, so your phone keeps using the official Bitwarden app alongside it: same server, same vault.
  4. Keyguard's Google Play and App Store builds need a premium license to add or edit items (docs).

As of October 2026, from each project's public documentation. Amber marks where Clavix falls short; a dash means partial support; “?” means the project doesn't document it. Clavix is not affiliated with Bitwarden, Vaultwarden, Keyguard or KeePassXC.

Download

Get Clavix for your platform

Free and open source. One recommended build per system; links always point to the newest release.

See the latest release on GitHub alpha · changelog

First run: sign in with a test account on your server and try Clavix there. Move real items over once you trust it.

Linux

AppImage x86_64

Runs on any x86_64 distro. Also as .deb for Debian / Ubuntu or .rpm for Fedora / RHEL.

Not yet signed. Make the AppImage executable before the first run: chmod +x clavix_*.AppImage.

macOS

Disk image universal

One build for Apple silicon and Intel. Also as a bare .app.tar.gz bundle.

Not yet signed or notarized by Apple, so macOS blocks the first launch: open System Settings → Privacy & Security and click Open Anyway.

Windows

Installer x64

Also as an .msi package for managed installs.

Not yet code-signed — SmartScreen may warn on first run.

Verify your download SHA-256

Compare the file's hash with the one GitHub publishes for it: sha256sum <file> on Linux, shasum -a 256 <file> on macOS, Get-FileHash <file> in PowerShell. Every file's hash is listed on the release page.

What this proves: the file you have is the file uploaded to the release, intact. What it doesn't: who built it. Releases aren't signed yet, so a tampered release would come with matching hashes; building from source is the way to rule that out.

Linux or Windows on ARM64? There's no build for it yet: build from source with the development guide. Older versions are on the releases page.

FAQ

Frequently asked questions

What is Clavix?

Clavix is a native desktop client for Vaultwarden and Bitwarden. It connects to your existing server and gives you a KeePassXC-style hierarchical vault with drag & drop, plus features the official client lacks — an embedded SSH agent, a security audit, YubiKey unlock and more.

Is it safe to use with my real vault?

Clavix is alpha. The cryptography hasn't been independently audited and part of the code was written with AI assistance under human review. Treat it as experimental — test against a throwaway vault first and read the disclaimer before trusting it with real secrets.

Does it work with my self-hosted Vaultwarden?

Yes — that's the whole point. You enter your own server URL at login. Self-hosted Bitwarden works too (same single-domain layout). Bitwarden's cloud (bitwarden.com / bitwarden.eu) is supported as well: pick your region from the Server menu on the login screen — Clavix targets the cloud's separate api. / identity. endpoints for you. Clavix never sends data anywhere except your configured server (and Have I Been Pwned's k-anonymity API, hash-prefixed, when you run the audit).

What happens to my vault if my server dies?

Two answers, depending on how bad it is. If the server is merely unreachable, unlocking with your master password still works: Clavix derives the key locally and opens the encrypted cache read-only. If the server — or the account — is gone for good, open an encrypted backup instead: Export the vault → Encrypted JSON gives you a file sealed under a password of your choosing, and Clavix reopens it on any machine with no server, no account and no stored session. Both modes are clearly banded as read-only, so you always know you're looking at a copy.

Can Bitwarden read a Clavix encrypted backup?

No — the encrypted format is Clavix's own, and it's the one to use for backups, because Clavix can reopen it with nothing but the file and its password. For migrating to another password manager, use the Bitwarden-format CSV export instead, which any Bitwarden-compatible client imports. It's plaintext on disk and carries only logins and notes, so treat the file accordingly and delete it once the migration is done.

My SSH keys don't show up — why?

SSH keys are vault items of type SSH key, and Vaultwarden only serves that type when the experimental feature flag is enabled. On a recent Vaultwarden, set EXPERIMENTAL_CLIENT_FEATURE_FLAGS=ssh-key-vault-item,ssh-agent and restart it. Then sync in Clavix — your keys appear under the SSH key type filter, and the embedded agent can serve the Ed25519 / RSA ones. (Official bitwarden.com already supports the type.)

How do I point ssh at the agent for good on Linux or macOS?

The agent listens on /run/user/<uid>/clavix/agent.sock (the exact path is in the Infos dialog), and nothing points to it by default. Add IdentityAgent /run/user/%i/clavix/agent.sock under a Host * block in ~/.ssh/config — that covers ssh, git and GUI apps launched from your desktop menu. Also add export SSH_AUTH_SOCK="/run/user/$(id -u)/clavix/agent.sock" to ~/.bashrc: ssh-add ignores ~/.ssh/config and reads only that variable, so without it ssh-add -l says "The agent has no identities" even while ssh works fine. On macOS the socket is ~/Library/Caches/clavix/agent.sock instead: use that path in both lines, and ~/.zshrc for the export.

And on Windows?

Nothing to configure. Unlocking the vault serves your keys on \\.\pipe\openssh-ssh-agent, the named pipe ssh.exe, ssh-add and Git for Windows look for on their own — no SSH_AUTH_SOCK to export. It also answers PuTTY's Pageant protocol, so plink, pscp and putty -agent reach the same keys. Run ssh-add -l to check. The pipe has a single owner: if Windows' own OpenSSH ssh-agent service is running, Clavix tells you instead of half-starting — stop it with Stop-Service ssh-agent from an elevated PowerShell (set its startup type to Manual to keep it away), then start the agent again. A real Pageant already running is fine; Clavix leaves it alone and serves the pipe only.

Which platforms are supported?

Linux (AppImage, .deb, .rpm), macOS (universal .dmg) and Windows (.exe / .msi). The embedded SSH agent works on all three: a Unix socket on Linux and macOS, and on Windows the OpenSSH named pipe plus PuTTY's Pageant. There is no mobile app: on your phone, keep using the official Bitwarden app against the same server. Both see the same vault, so whatever you file in Clavix shows up there after a sync.

Which languages does it speak?

English and French. Switch in Preferences, or right from the sign-in, unlock and two-factor screens — handy when Clavix picked the wrong one before you've even logged in.

Does Clavix use the official Bitwarden SDK?

No. The Bitwarden SDK has an ambiguous license, so Clavix reimplements the crypto in-project under GPL-3.0, inspired by rbw. The frontend is Svelte 5 + TypeScript; the backend is Rust on Tauri 2.

Is it really free?

Yes — Clavix is free and open source under the GPL-3.0-or-later license, with no premium tier. Write access, the SSH agent and the security audit are all included. Contributions are welcome on GitHub.

Try it on a test vault first

Point Clavix at a throwaway account on your Vaultwarden and see whether the tree and drag & drop earn their place. Linux, macOS and Windows.

Download Clavix Read the disclaimer