Help videos

Your documents, encrypted before they go anywhere

Keepsake is a vault for the documents that matter. Passports, insurance, contracts, certificates. Everything is encrypted on your own device, with a key made from your password, before it is written anywhere at all.

Open it and it works

There is nothing to sign up for. Open the web app and you make a vault in the browser itself. There are native apps for Windows and Android too, and they all read the same vault.

Filed for you, on your device

Add a document and Keepsake reads it where it sits, on your machine, and files it by type. It picks up expiry dates as it goes, so it can warn you before a passport or a policy runs out.

We cannot read your documents

This is the part worth checking rather than believing. We hold no key, so we can decrypt nothing. Sync goes to a cloud account you already own, and every release is signed so you can verify what you downloaded is what we published.

Start free

The free tier is genuinely usable, and Premium is a yearly licence. Everything exports, in ordinary formats, whenever you like. Being able to leave is the only real proof you were never locked in.

What the Recovery Kit is

When you create a vault, Keepsake shows you twenty four words once. That is your Recovery Kit. It is the only way back into your vault if you forget your password.

You will see this exactly once

Here is the screen. In this recording the words are deliberately blurred, because a recovery phrase that appears in a video is a recovery phrase that is no longer secret. Yours will be readable, and yours is worth treating carefully.

Write it on paper

Write the words on paper and keep them where you keep a passport. Not in the vault they open. Not in a photo on the phone you would lose alongside it. Not in a password manager you unlock with the same password you are trying to protect against forgetting.

Why we cannot reset it for you

There is no reset link and no support override, and this is worth being plain about. Your documents are encrypted with a key made from your password. We never receive that password or that key, and no copy of your documents exists on any server of ours. If both the password and the Recovery Kit are gone, the vault cannot be opened by anyone, including us.

So this cannot happen to your family

The Legacy Access Kit exists for exactly this. It splits your key into three shares, so any two people you trust can open the vault if you cannot. It is the answer to the question this video raises, and it takes about five minutes to set up.

Getting started on Windows

Four things to do: get the installer, check that it is the file we published, create your vault, and write down your Recovery Kit. The last one is the one people skip, and it is the only one that cannot be fixed later.

Get the installer

The download page carries the Windows installer along with its version, its size and its S H A two five six hash. That hash is the point of the next step, so keep the page open.

Check what you downloaded

Drop the file onto the verify page and your browser hashes it locally, then compares that hash against our signed manifest. It never uploads the file. Windows may also warn you that the publisher is unrecognised — that means the installer has not yet been seen by enough machines, not that anything is wrong with it. Verifying is the honest way past that warning; clicking through is not.

Install and create your vault

Run the installer and open Keepsake. It asks for a master password, and that password is not a login — there is no account and no server checking it. It is the input the encryption key is derived from, which is exactly why it should be long, and why nobody, including us, can reset it for you.

Write down the Recovery Kit

Keepsake then shows you twenty four words, once. Write them on paper and keep them where you keep a passport. If you ever forget your password, those words are the only way back into your vault. If you lose both, nobody can open it, and that includes us.

Add your first documents

Now add something. Keepsake reads each document on your machine, files it by type and picks up expiry dates as it goes. Passport, driving licence, insurance and tenancy are the usual first four, because those are the ones with dates on them that matter.

Worth doing next

Two things are worth doing in the first week. Set up sync, so the vault reaches your phone through a cloud account you already own. And read the getting started page, which covers the same ground in writing and stays up to date with the app.

Getting started on Android

The phone is where most documents actually arrive, because it is the thing with the camera. Four steps: install the app, create or restore a vault, write down your Recovery Kit, and photograph your first document.

Install the app

The download page carries the Android package with its version and its S H A two five six hash. Android will ask whether to allow installs from your browser the first time, which is normal for anything not fetched from a store.

Check what you downloaded

Before installing, it is worth thirty seconds to check the file. The verify page hashes it in your browser and compares that against our signed manifest, without uploading anything. A mismatch means the file is not the one we published — delete it and download again.

Create or restore

If this is your first device, create a vault and choose a long master password. If you already have a vault elsewhere, choose Restore instead — either from your Recovery Kit, or from the cloud folder your other device syncs to. Restoring brings back documents, tags and history, not just files.

Write down the Recovery Kit

On a new vault you are shown twenty four words, once. Write them on paper. Not a screenshot in your gallery — a screenshot of your recovery phrase lives in the same cloud backup as everything else, and travels with the phone you might lose.

Photograph your first document

Now use the camera. Flat paper, even light, no shadow from your own hand, and fill the frame. Keepsake reads the photograph on the phone itself — the picture is never uploaded to be read — and files the document by type with its expiry date already filled in.

Make it convenient, and safe

Turn on biometric unlock so you are not typing a long password at a counter, and set auto lock so a phone left on a table locks itself. Then set up sync, and the same vault appears on your computer. The written guide covers all of it and stays in step with the app.

Sync, without a sync server

Keepsake syncs your vault between devices without running a single server of its own. Your vault replicates as encrypted blobs through storage you already own, and because the encryption happens before anything is uploaded, the provider holds ciphertext with meaningless names and no keys.

Pick a provider

There are four choices. Google Drive uses a hidden app only folder, so Keepsake never sees the rest of your Drive. One Drive works the same way, under an app folder. Web D A V covers Next cloud, own Cloud and anything else that speaks it. And Folder points at any directory at all — a network drive, a Sync thing folder, even a memory stick. That last one needs no account anywhere.

Where to find it

Sync lives in Settings. You will find it below the licence and password sections, with a provider selector and a Sync now button.

Connect the first device

Choose your provider and sign in when prompted. That sign in happens directly with Google or Micro soft on your own device, and the resulting tokens are stored encrypted inside your vault rather than on any server of ours. Then press Sync now. The first push uploads your encrypted vault.

Connect the other devices

On every other device, repeat the same setup with the same provider and the same account. If a device has no vault yet, choose Restore from sync instead, and it rebuilds the whole vault — documents, tags and history — from the cloud copy.

What happens when two devices disagree

Keepsake syncs operations rather than whole files. Edit a tag on your phone and a note on your computer, offline, at the same time, and both survive — the merge is deterministic and does not depend on which device speaks first. Deletions propagate too.

What your provider can see

Encrypted blobs with meaningless names, and nothing else. Someone who breaks into that folder gets bytes they cannot read and no key to read them with. That is the reason sync works this way rather than the easy way.

It reads your documents so you do not have to file them

When you add a document, Keepsake reads it. Not on a server — on the device in front of you. It works out what kind of document it is, pulls out the dates that matter, and files it. Adding a document costs you one click instead of five fields.

Add a document

Press Add document and choose a file, or on a phone, photograph it. Everything below the file picker is about to fill itself in.

A perfectly ordinary insurance certificate

This is the document going in — a motor insurance certificate. Nothing on it is real; it was produced for this video. What matters is that it looks like the post that lands on a real doormat: a policy number, a name, and an expiry date buried among seven other lines.

What it worked out on its own

A few seconds later: the category is set to Insurance, the expiry date is the eleventh of March twenty twenty seven, and the tags read insurance, financial, vehicle. None of that was typed. Every one of those fields is still editable, because a machine reading a photograph will sometimes be wrong, and correcting it should take a moment rather than an argument.

Filed, and watching the date

The document is now encrypted, filed under Insurance, and carrying its expiry date. That last part is what turns a pile of documents into something useful: Keepsake can warn you before the date arrives, without you ever having put it in a calendar.

Getting a good read

If a scan comes out badly, it is nearly always the picture rather than the software. Flat paper, even light, no shadow from your own hand, and fill the frame with the document. A photograph taken at an angle loses more accuracy than any setting will win back, and taking it again costs ten seconds.

English and Urdu

The engine underneath is Purple O C R, and it reads English and Ur doo. If a document comes back as nonsense, check the language set for that document before anything else — a page read as the wrong script produces gibberish rather than a warning.

Two features for two awkward moments

Two features that answer two awkward questions. What do I carry across a border? And how do I send one document to one person without leaving it lying around forever?

Where to find them

Travel Mode lives in Premium tools. Secure Send is on any document you open.

Travel Mode packs a capsule

Travel Mode packs the documents you choose into a separate offline capsule with its own PIN, lasting as many days as you set. There is a second, duress PIN as well, which opens a smaller and unremarkable selection — for the situation where somebody is watching you type.

Why a capsule rather than your vault

Because the rest of your vault is not on the device while the capsule is. That is the entire point. The capsule opens straight from the unlock screen without your vault password, it expires on the date you set, and then it is gone. If you forget the capsule PIN, nothing is lost — your vault is untouched and you simply pack another one.

Secure Send shares one document, once

Secure Send turns one document into a link. The file is encrypted in your browser before it is uploaded, and the key sits in the part of the link after the hash — the part browsers never send to a server. So our server holds unreadable bytes, and could not decrypt them if it wanted to.

Expiry, PIN, and burn after reading

You choose how many hours the link lasts, and optionally a PIN, which should travel by some route other than the link itself. The link can also destroy itself the moment it is read. All three are deliberate and none can be undone — when a link ends, you send a fresh one.

Send the whole link

If a recipient says the link will not open, the usual cause is a chat app that trimmed everything after the hash. Send it as plain text and it will work.

Sharing documents with people you actually trust

A Family Vault shares documents with up to six people through a folder your family controls. There is no Keepsake account for your family, no server holding the list of who may see what, and no company standing between a household and its own paperwork.

Access by key possession

This is the part worth understanding, because it is the difference between this and every other shared drive. Each category has its own key. A member can read the categories whose keys they hold, and nothing else. Nobody asks a server for permission — a member who does not hold a key cannot decrypt those documents even with the file in front of them.

Point it at a folder

Setting it up means giving Keepsake somewhere to put the shared vault: a Web D A V address on a home server, a Next cloud, or any folder the family already shares. Keepsake writes encrypted blobs into it. That storage never receives a key.

Where it lives

You will find it in Premium tools, alongside Travel Mode and the other Family plan features.

Adding and removing people

Adding a member means giving them the keys for the categories they should see. Removing someone is the interesting case: the vault is re keyed, so the copies they already hold stop being useful for anything added afterwards. There is no server to ask to stop letting them in, which also means there is no server that can be persuaded to let them back.

The honest limitation

Someone who had access to a document yesterday still holds the copy they downloaded yesterday. No system that lets people read things can undo that, and any product that claims otherwise is describing a hope rather than a mechanism. What re keying protects is everything added from now on.