Skip to main content
FOKS is currently in beta. It is fully usable, but there is some risk of data loss. Use accordingly.

​
What is FOKS?

FOKS (Federated Open Key Service) is an open-source system for sharing and managing cryptographic keys across devices and teams. The simplest summary: Keybase, but with federation, SSO, and YubiKey support, and fully open-source. FOKS provides:
  • End-to-end encrypted Git repositories — source code and commit history are encrypted on your machine before reaching any server
  • Encrypted key-value store — store secrets, configs, and files that sync across devices and teams
  • Federated team management — teams can span multiple servers; role-based access with automatic key rotation on membership changes
  • Multi-device support — provision new devices, YubiKeys, and manage them all in one place
  • Single Sign-On — OAuth2-based SSO for enterprise deployments
Everything is encrypted client-side. The server never sees your data or filenames in plaintext. Users are identified as user@host pairs — like email addresses — so a user on foks.app and a user on corp.example.com can share the same team.

​
Key Properties

End-to-end encrypted

Data is encrypted on your machine before it is sent to any server. Servers store only ciphertext.

Open source

All code is released under the MIT License. Run your own server or use the hosted service at foks.app.

Federated

Like email, FOKS consists of many independently-operated servers speaking the same protocol. Teams can span servers.

Post-quantum cryptography

Combines Curve25519 with ML-KEM algorithms to provide resistance against quantum attacks.

​
Get Started

Install FOKS

Install the foks CLI on macOS, Linux, or Windows.

Quickstart

Sign up, create an encrypted Git repo, and push your first commit.

CLI Reference

Full reference for all foks commands.

Self-hosting

Run your own FOKS server for your team or organization.

​
How It Works

FOKS uses a hierarchical key structure. Each device has its own key pair. User keys are derived from device keys. Team keys are derived from user keys. This chain means that when a device or user is revoked, all keys further up the tree rotate automatically. Merkle trees prevent servers from tampering with or rolling back data. Every operation is auditable through signature chains. See Architecture for a deeper explanation.