lys-secretsThe Secret Service for a lys desktop

One small process serves org.freedesktop.secrets, so libsecret, Chromium, git and sandboxed apps keep their secrets without gnome-keyring, KeePassXC or KWallet. It holds your Bitwarden vault too.

Get started

How secrets are protected

GitHub

A drop-in provider

secret-tool, python-secretstorage, Chromium and git's libsecret credential helper are checked against the real service in the test suite. It never takes the name from another provider.

Encrypted at rest

Each collection is one file, its key derived with Argon2id and its contents sealed with XChaCha20-Poly1305. Labels, attribute values and secrets need the password.

Unlocks with your session

lys-login hands over the password it just verified through a socket only your user can connect to. Everything else asks through the desktop's own password dialog.

Your Bitwarden vault

The one process holding the vault's keys. lys-shell's dropdown, launcher and network agent are views over it, and one folder can show as a read-only collection.