Privacy policy

Effective date: October 13, 2026

This policy covers KeyPug for Mac (the app), the KeyPug Chrome extension (the extension), the KeyPug Safari extension included with the app, and this website. In short: KeyPug has no account, and no server ever receives your vault. Your vault stays on your Mac, encrypted. What leaves your device: a 5-character hash prefix used to check for breached passwords, only when you ask for that check; and, to show website icons that are not built into the app, a 3-character hash prefix shared by many sites, plus the name of a site only when KeyPug's icon service does not have its icon yet. You can turn icon downloads off.

What leaves your device

Two things: when you click Check now in Watchtower, the app sends the first 5 hexadecimal characters of the SHA-1 hash of each saved password to the Have I Been Pwned service; and, unless you turn it off, the app asks KeyPug's icon service for the icons of sites in your vault that are not built into the app, as described below.

For each password, the app computes its SHA-1 hash on your Mac and sends only the first 5 of its 40 hexadecimal characters to https://api.pwnedpasswords.com/range/. Passwords that share a prefix are covered by a single request. The service replies with every known hash suffix that starts with that prefix, and the app compares the rest of your hash on your Mac. The request includes the Add-Padding: true header, so the service adds decoy entries and the size of the reply does not reveal anything about your password. Neither your password, its full hash, your username nor the site it belongs to is sent. Have I Been Pwned, like any web service, sees the IP address the request comes from. The check never runs on its own.

Website icons

The app shows each site's icon next to its logins. It never contacts the websites themselves, or any third-party icon service, to get them:

Downloads run in the background after you unlock, a few at a time. The app stores downloaded icons encrypted in your vault and checks again after 30 days. Sites without an icon show their first letter instead. Icons you choose yourself for an item are stored encrypted in your vault and never leave your Mac. In Settings › General › Icons you can hide website icons, or turn off downloads and keep only the built-in icons.

Apart from these, the app and the extension make no network requests. There are no analytics, no telemetry, no crash reporting, no advertising identifiers and no third-party SDKs.

No account, no server

KeyPug does not have user accounts and does not run any server that receives, stores or syncs your vault. The only server KeyPug runs is the icon service, which holds public website icons and nothing about you. We cannot see, recover or hand over your vault, because we never have it.

KeyPug for Mac

Your vault

Your vault is a database file on your Mac, at ~/Library/Application Support/KeyPug/vault.sqlite. The full contents of every item (its type, title, usernames, passwords, websites, notes, card details, custom fields and one-time-code secrets) is encrypted with XChaCha20-Poly1305 before it is written to disk. The only values stored unencrypted are those needed to manage the file itself: random item identifiers, revision numbers, whether an item is archived or deleted, when it was last changed, and the settings and salt used to derive your key.

Master password and Secret Key

The key that unlocks your vault is derived from two secrets: your master password, stretched with Argon2id, and a random 128-bit Secret Key generated on your Mac when you create the vault. Your master password is never stored. The Secret Key is stored in the macOS Keychain on your Mac and printed in your Emergency Kit. Someone who obtains your vault file needs both secrets to read it.

Importing and exporting

KeyPug reads the export files you choose from other password managers on your Mac and never uploads them. You can export your vault as an encrypted KeyPug archive, or as unencrypted CSV or CXF (Credential Exchange Format) files, which KeyPug writes only where you choose; anyone who opens an unencrypted file can read what is in it, and a CXF file includes your passkeys. On macOS 26 and later you can also move your passwords and passkeys to or from another app you pick through macOS's credential exchange: macOS passes them directly between the two apps, without a file and without any server. The app you send them to keeps its own copy under its own privacy policy.

Other local data

If you turn on Touch ID unlock, macOS handles your fingerprint; KeyPug never receives it. Passwords you copy are cleared from the clipboard after a short time. The app writes error messages to the macOS system log on your Mac; these never contain your passwords or other vault contents.

KeyPug Chrome extension

What the extension reads on web pages

The extension's content script runs on secure (https) pages and on local development addresses (localhost and 127.0.0.1). To find login forms it looks at the structure of the page: input field types and attributes (such as autocomplete, name, id, placeholder and labels), button captions, the form's name and address, the page title, the page address and the origins of the frames it is embedded in. It does not read the rest of the page's content.

It fills a login only when you ask it to: by choosing a login from the extension's menu or toolbar popup, or with the keyboard shortcut. It never fills on page load.

When you submit a login form, the extension captures the username and password you entered so it can offer to save or update them. They are kept only in the extension's memory, for up to two minutes. If you choose to save, they are sent to the KeyPug app on the same Mac and encrypted into your vault. If you dismiss the prompt or do nothing, they are discarded. They are never written to the browser's storage, never logged and never sent anywhere else.

Passkeys

On the same pages, the extension also adds a small script to the page itself so that KeyPug can answer when a site asks to create or use a passkey (the WebAuthn API). The script sees only what the site passes to that API (such as the site's name, the account name and a one-time challenge) and hands it to the extension, which asks you, in KeyPug's own prompt, whether to use KeyPug. The address of the site is taken from the browser, not from the page. The KeyPug app then asks you to confirm with Touch ID or your master password before it creates or uses a passkey. The page receives only the passkey's public data (its public key or a signature for that one sign-in), never a private key, and never learns which other passkeys KeyPug holds. If you choose another device, KeyPug has no passkey for the site, or the extension is not paired, the request goes to the browser unchanged.

How the extension talks to the app

The extension never connects to the internet. It talks only to the KeyPug app on the same Mac through Chrome's native messaging, which starts a small helper program included with the app; the helper relays messages over a local socket. Before first use you pair the extension and the app by typing a 6-digit code the app shows you. After that every session is end-to-end encrypted with fresh keys between the extension and the app.

What the extension stores

The extension stores two things in chrome.storage.local on your computer, and nothing else:

Your logins, passwords and one-time codes pass through the extension's memory only while it fills a form or shows you a list, and are never stored by the extension.

Permissions and why each one is needed

nativeMessaging
To communicate with the KeyPug app on your Mac, where your vault lives. This is the extension's only channel for reading and saving logins.
storage
To remember the pairing with the KeyPug app and your "Never for this site" choices, as described above.
activeTab
To read the address of the tab you are on when you open the extension's popup, so it can suggest the logins for that site and fill them into that tab.
favicon
To show site icons in the popup. The icons come from Chrome's own local icon cache; the extension makes no network request to fetch them.
clipboardWrite
To copy a password to the clipboard when you click Copy.
offscreen
Chrome's extension background worker cannot use the clipboard directly, so the copy happens in a hidden offscreen page created only for that purpose.
alarms
To clear the clipboard 90 seconds after you copy a password, even if Chrome has paused the extension's background worker in the meantime.
Access to https://*/*, http://localhost/*, http://*.localhost/* and http://127.0.0.1/*
To run the content script that detects login forms, fills them when you ask and offers to save logins you submit, and the passkey script, as described above. Plain http pages on the internet are excluded so passwords are never filled into unencrypted connections.

Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. KeyPug uses the data described above only to provide its password filling and saving features to you. We do not sell it, transfer it to third parties, use it for advertising, use it to determine creditworthiness or for lending, or allow any human to read it. In fact, none of it ever reaches us.

KeyPug Safari extension

The Safari extension is included with the app and stays off until you turn it on in Safari's settings. It is the same extension as for Chrome, so everything above about what it reads on web pages, when it fills, and how it handles logins you submit applies to it as well. The differences:

It asks Safari for nativeMessaging, storage, activeTab, clipboardWrite and alarms, and for access to the same sites as the Chrome extension, for the reasons given above. It also asks for scripting, used only to add the passkey script to pages, which Chrome does through the extension's manifest instead.

This website

This website uses no cookies, analytics, trackers, third-party scripts or web fonts. Our hosting provider may keep standard server access logs, such as IP addresses and requested pages, for security and operations.

Children

KeyPug is not directed to children and does not knowingly collect any data from anyone, including children.

Changes to this policy

If a future version of KeyPug changes what data it handles, for example by adding optional sync, we will update this policy and its effective date before that version is released.

Contact

Questions about privacy: privacy@keypug.com.