Does it use the cloud, or phone home?
No. keyward makes no network connection of its own. The only traffic is the ssh you start. There is no account, no sync, no telemetry and no update check. Updates are a download you verify yourself.
Which platforms?
Windows 11 (Windows OpenSSH; Git configured to use it) and Linux (X11 or Wayland; libfido2 for security keys). One vault can be shared by both sides of a dual boot. macOS is planned, not started.
Do I need a YubiKey?
No. A passphrase alone works, hardened with Argon2id. A FIDO2 key makes unlocking a touch and a PIN instead of typing, and lets you keep SSH keys inside the device so they can't be copied at all. Any FIDO2 key with hmac-secret unlocks the vault; hardware-held SSH keys need Ed25519 support (YubiKey 5, firmware 5.2.3 or later).
What happens if I lose the laptop?
The vault is useless without a credential. Your 24-word recovery phrase recreates every key keyward generated, on a new machine, offline. Imported keys come back from an encrypted backup file that the same phrase opens. Then rotate the old keys off your servers, one command each.
What if I lose the YubiKey?
Enrol a second key as a backup when you set up; keyward pairs hardware-held SSH keys across both devices and authorizes both on servers. Without a backup device, the passphrase or the recovery phrase still opens the vault. Keys that live inside a lost YubiKey are gone, which is the point of a hardware key; their backup is the second device.
What if I forget the passphrase?
keyward recover opens the vault with the recovery phrase and lets you set a new passphrase. Then run keyward rekey so the forgotten passphrase, and any old copy of the vault, stop working.How is this different from 1Password's SSH agent?
1Password asks "may this app use this key?" and keeps the vault in its cloud. keyward asks "may ssh log in as root on dj?", because it verified which server the signature is for and audited what that account can do. It then checks the server's logs for logins it didn't make. And nothing leaves your machine.
How is this different from Teleport or Tailscale SSH?
They give you short-lived access by putting a control plane between you and your servers: accounts, agents, a service to run or pay for. keyward works with stock sshd, no listener, no accounts, and keeps the decision on your machine behind your hardware key. For a person or a small team it's the benefit without the infrastructure.
Why not ssh-agent with confirmation?
ssh-add -c asks on every use with no idea where the signature is going or what it grants, and your keys are plain files in your home directory. keyward knows the destination, asks only when it matters, keeps keys out of reach of programs running as you, and tells you afterwards whether anyone else used them.Can malware on my machine still use my keys?
Partly, and keyward says so rather than pretending otherwise. Malware running as you can drive an allowed program and request whatever a relaxed key permits. It cannot read the keys, and it cannot reach root without you touching the security key or typing the passphrase. The full picture is in the threat model.
Is it open source?
Yes. The source, licence and signed releases are published together with the first release. A security tool nobody can read isn't one you should trust.