keyforge 0.2.0

About keyforge

keyforge generates cryptographically strong secrets and keeps them in a
DPAPI-sealed local vault you can search. It ships as one binary with no runtime
and makes no network calls.

It generates random strings and API keys over a chosen alphabet, passwords with
character-class requirements, EFF diceware passphrases, structured identifiers
(UUIDv4, UUIDv7, ULID, nanoid, TOTP seeds), and keypairs (ed25519, RSA, and age
identities). Every value is drawn from the operating system CSPRNG by rejection
sampling rather than modulo, so no character is more likely than another, and
each generator reports the entropy it produced.

Secrets issued elsewhere can be stored too — paste an API key a provider gave
you and keyforge keeps it alongside the ones it made, honest about the fact that
it can only estimate the strength of a value it did not generate. Any secret can
be rolled: the replacement takes over while the name, creation date, and tags
stay put, and the outgoing value is kept so you can finish cutting over before
revoking it. An optional per-key interval flags anything overdue.

Saved secrets live in a vault sealed with Windows DPAPI under your login and are
found again with fuzzy search over names, tags, and kinds — never over the secret
material itself. Run keys with no arguments for the full-screen interface, or
use the subcommands for scripting.

Installs to your user profile and needs no administrator rights.