keeweb-lite

keeweb-lite is a lightweight, web-only password manager inspired by KeeWeb. It stays intentionally small and practical: static app, client-side only, and focused on core vault workflows.

Features

• Two source types only: Local and Google Drive.
• Unlock with password and optional key file.
• Key file stays in runtime memory during unlock flow.
• Google Drive records sync after every change.
• No settings/options UI; behavior is fixed by design.
• KeeWeb-like workspace layout: groups, tags, entry list, and details editor.
• Built-in password generator in entry editing flow.
• Native KDBX entry history with apply/restore workflow.
• Remove and restore entries with recycle-bin behavior.
• Download current encrypted .kdbx at any time.
• Mobile-friendly layout for unlock and workspace flows.
• Auto-lock after inactivity.

Requirements

• Node.js >= v24.13.0
• npm >= 11.9.0

Scripts

npm run dev          # Start Astro dev server
npm run build        # Build production output
npm run preview      # Preview production build

npm run check        # Astro diagnostics and type-checking
npm run test         # Run unit tests
npm run test:watch   # Run unit tests in watch mode

npm run lint         # ESLint check
npm run lint:fix     # ESLint fix

npm run csslint      # Stylelint check
npm run csslint:fix  # Stylelint fix

npm run format       # Prettier check
npm run format:fix   # Prettier write

Resources

• Feature specs: docs/features
• Screen specs: docs/screens
• Screenshots: workspace, unlock, workspace mobile, unlock mobile

Docker

The Docker image builds the Astro app inside the container, then serves the static dist/ output with Nginx.

PUBLIC_GOOGLE_CLIENT_ID and PUBLIC_GOOGLE_APP_ID are compiled into the client bundle at build time, so changing them requires rebuilding the image.

Build image:

docker build \
  --build-arg PUBLIC_GOOGLE_CLIENT_ID=your-client-id \
  --build-arg PUBLIC_GOOGLE_APP_ID=your-project-number \
  -t keeweb-lite .

Run container:

docker run --rm -p 4321:80 keeweb-lite

Use Docker Compose:

# Set `PUBLIC_GOOGLE_CLIENT_ID` and `PUBLIC_GOOGLE_APP_ID` in `.env`, then run:
docker compose up -d --build # App is available at `http://localhost:4321`.

Google Drive Setup

To enable Google Drive integration, you need a Google Cloud project with OAuth 2.0 credentials.

1. Create a Google Cloud Project

1. Go to Google Cloud Console and create a project.
2. In APIs & Services -> Library, enable Google Drive API.
3. In APIs & Services -> Library, enable Google Picker API.

2. Configure OAuth Consent Screen

1. Go to APIs & Services -> OAuth consent screen.
2. Set User type to External.
3. Fill required app information.
4. In scopes, add https://www.googleapis.com/auth/drive.file.
5. While publishing status is Testing, add your account as a test user.

3. Create OAuth 2.0 Credentials

1. Go to APIs & Services -> Credentials -> Create -> OAuth 2.0 Client ID.
2. Set Application type to Web application.
3. Add authorized JavaScript origins:
   • http://localhost:4321
   • Your production origin
4. Put the client ID in .env:

PUBLIC_GOOGLE_CLIENT_ID=your-client-id

4. Get the Project Number

The Google Drive Picker requires your Cloud project number (not the project ID string).

1. Go to IAM & Admin -> Settings (or the home dashboard).
2. Copy the Project number (numeric value).
3. Add it to .env:

PUBLIC_GOOGLE_APP_ID=your-project-number

License

MIT