A free screenshot app for Mac: press a hotkey, select, mark it up and paste it anywhere with ⌘V.
Minions
Web appFree
A free, self-hosted password manager and secrets vault, end-to-end encrypted, for passwords, API keys, .env files and 2FA codes.
- Price
- Free
- Runs on
- Your own server (Docker)
- Apps
- Web, Chrome, Windows
- Licence
- AGPL-3.0, open source
- Open source
- Security
- Self-hosted
- Developers
01 / 06Minions vault: logins, API keys, cloud credentials and cards, grouped by project and collection
What it does
Everything in one click.
End-to-end encrypted
Argon2id and AES-256-GCM on your device. Your master password never leaves it, and the server stores only ciphertext.
Every kind of secret
Logins, API keys, .env files, servers, SSH keys, databases, cloud credentials, cards, licences and notes.
Organised by project
Group what each product or client depends on, then filter by project, collection, tag and type.
Paste anything
Paste a .env, card details, label: value lines or a 2FA QR screenshot, and the fields fill themselves in.
Security Center
Weak, reused, old and expired passwords and accounts without 2FA, with a health score that explains itself.
Built-in authenticator
Live 2FA codes, with QR import that includes Google Authenticator’s export.
Share safely
Share items by email, run team workspaces with roles, or send one-time links that expire.
Autofill in Chrome
The extension fills logins on matching sites and offers to save new ones, with phishing-resistant matching.
The details
Built for power users.
- Self-host with Docker: one public web service and an API
- Web app for desktop and mobile, a Chrome extension and a Windows desktop app
- Import from Bitwarden, Chrome, Edge, Firefox, Notion and CSV/JSON, with duplicate detection
- Encrypted version history for every change
- Encrypted backups that only your master password can open
- Two-factor sign-in, passkeys, auto-lock and a full activity log
- Bulk move, tag, star or trash, and every move can be undone
- Vault-key rotation that re-encrypts everything on your device
- Optional AI organising that only ever sees names and websites
- Light and dark themes
Who it’s for
Who gets the most out of it.
- Developers keeping API keys, .env files and server logins out of chat and notes
- Freelancers and agencies with credentials for many clients
- Small teams that want shared secrets without a per-seat bill
- Anyone who wants a password manager they host and control
Private by design.
Secrets are encrypted on your device with keys from your master password, which is never sent. The server cannot decrypt your vault. Some metadata, like item names, websites and tags, stays readable so search and the Security Center work.
Minions has had an internal security review but no independent audit yet. Keep your own encrypted backups.
FAQ
Good questions.
Is it really free?
Yes. It’s open source under the AGPL-3.0 licence, and you run it on your own server.
Is it a Bitwarden, 1Password or LastPass alternative?
It covers the same everyday needs: encrypted logins, autofill, 2FA codes, sharing and import from Bitwarden and browsers. It adds a vault for developer secrets like API keys, .env files, servers and SSH keys, organised by project.
Can the server owner read my passwords?
No. Secrets are encrypted on your device and your master password is never sent. The server can see some metadata, such as item names and websites.
What if I forget my master password?
The vault can’t be recovered, not even by the server owner. That’s the price of end-to-end encryption, so keep an encrypted backup and store your master password somewhere safe.
Does the AI see my passwords?
No. AI organising is optional and off without an API key. It only receives names and websites, and financial items are never sent.
Can I use it with a team?
Yes. Team workspaces have members, roles and per-item access, and you can share single items with people by email.
Free. Go grab it.
Open source, no signup and no catch. Install it and start in a minute.
