KeyPlus desktop guide

Launch the PySide6 interface with keyplus --gui or keyplus-gui. The desktop interface uses the same VaultService, data path, vault format, and session rules as the CLI.

Set up, migrate, or unlock

With no 0.3 vault present, the setup screen can create a vault or migrate a known KeyPlus 0.2 folder. If a 0.3 vault exists, enter its master password on the login screen. KeyPlus reports a single unlock failure when the password is wrong or authenticated decryption detects modified data; it does not expose which condition occurred.

Manage entries

The dashboard lists each entry’s name and domain. Select an entry to view its domain, password, creation time, and modification time. The domain and password fields are read-only but selectable, so the operating system’s normal copy action can place either value on the clipboard.

Select Add Entry to provide a name, domain, and password. From an entry view, select Edit to change any field; leaving the password field empty keeps the current password. Delete asks for confirmation before permanently removing the entry from the active vault.

Select Change Password on the dashboard to enter the current master password and confirm a replacement. KeyPlus reauthenticates against the vault on disk before re-encrypting it. A wrong current password leaves the vault and existing unlocked session unchanged. The previous encrypted vault is retained as last-good.vault.

The view displays the password as readable text. KeyPlus does not currently provide a reveal timer, dedicated copy button, or automatic clipboard clearing. Anything copied remains subject to operating-system and clipboard-manager behaviour.

Back up and restore

Select Backup on the dashboard to create a timestamped encrypted copy in the application backup directory. The confirmation dialog shows its path.

To restore, return to the login screen, enter the backup’s master password, select Restore Encrypted Backup, and choose a .vault file. KeyPlus validates and decrypts the selected backup before replacing the active vault. The prior active vault is preserved as last-good.vault.

Locking and timeout

Select Logout to invalidate the shared in-memory session and return to the login screen. The default idle timeout is five minutes. Session checks happen when core operations run and, in the GUI, through a one-second timer while an unlocked screen is displayed.

KeyPlus overwrites its mutable in-memory key buffer on lock as a best effort, then drops the key and decrypted document references. Python cannot guarantee secure memory erasure or removal of every temporary runtime copy.