starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-26 00:16:03 +03:00

[GH-ISSUE #1774] FR: Security additions #1105

New issue

Open

opened 2026-03-02 11:55:03 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 11:55:03 +03:00

Owner

Originally created by @playtime-backrest on GitHub (Jul 24, 2025).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1774

Describe the feature you'd like

Allow for TTLs (time to live) on the login, with a fixed duration and a key to disable it, or a custom set time. How would this benefit users? If you're logged into Karakeep on your machine, your passwords are locked, which is great. However, your 10 GB of Linux ISOs are now exposed for everyone to see. Additionally, family members and enhanced security measures, such as the 2FA mentioned in #779, are important considerations.

And some more ideas, in no real order, and a quick explanation instead of the mess above. I already typed it out, so I'm not reformatting it. Oh well.
Idle timeout detection: Automatically lock after X minutes of inactivity, separate from TTL.
Screen lock integration: Lock Karakeep automatically when the system screen locks.
Local network restrictions: Restrict access to specific interfaces or IP ranges.
Port knocking: Require a sequence of connection attempts before the service becomes available.

Failed attempt lockouts: Temporarily disable login after X failed attempts, with exponential backoff.
Local user account integration: Optionally require OS-level authentication first.
Hardware token support (in addition to or as a replacement for 2FA): Use YubiKey, Bitwarden, or similar for local authentication.
Master password complexity enforcement: Set configurable strength requirements.
Password rotation reminders: Prompt users to change the master password periodically.

Describe the benefits this would bring to existing Karakeep users

Security 👍

Can the goal of this request already be achieved via other means?

Nope

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

Additional context

No response

Originally created by @playtime-backrest on GitHub (Jul 24, 2025). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1774 ### Describe the feature you'd like Allow for TTLs (time to live) on the login, with a fixed duration and a key to disable it, or a custom set time. How would this benefit users? If you're logged into Karakeep on your machine, your passwords are locked, which is great. However, your 10 GB of Linux ISOs are now exposed for everyone to see. Additionally, family members and enhanced security measures, such as the 2FA mentioned in #779, are important considerations. And some more ideas, in no real order, and a quick explanation instead of the mess above. I already typed it out, so I'm not reformatting it. Oh well. Idle timeout detection: Automatically lock after X minutes of inactivity, separate from TTL. Screen lock integration: Lock Karakeep automatically when the system screen locks. Local network restrictions: Restrict access to specific interfaces or IP ranges. Port knocking: Require a sequence of connection attempts before the service becomes available. Failed attempt lockouts: Temporarily disable login after X failed attempts, with exponential backoff. Local user account integration: Optionally require OS-level authentication first. Hardware token support (in addition to or as a replacement for 2FA): Use YubiKey, Bitwarden, or similar for local authentication. Master password complexity enforcement: Set configurable strength requirements. Password rotation reminders: Prompt users to change the master password periodically. ### Describe the benefits this would bring to existing Karakeep users Security 👍 ### Can the goal of this request already be achieved via other means? Nope ### Have you searched for an existing open/closed issue? - [x] I have searched for existing issues and none cover my fundamental request ### Additional context _No response_

kerem added the

feature request

status/untriaged

labels

2026-03-02 11:55:03 +03:00

kerem commented

2026-03-02 11:55:03 +03:00

Author

Owner

@Eragos commented on GitHub (Jul 24, 2025):

Hey!

I can only advise security-conscious users to look into OICD providers, especially for teams or families. Depending on the provider, you will receive a passkey and additional 2FA support and karakeep already support that.

Best, Michael

@Eragos commented on GitHub (Jul 24, 2025): Hey! I can only advise security-conscious users to look into [OICD](https://openid.net) providers, especially for teams or families. Depending on the provider, you will receive a passkey and additional 2FA support and [karakeep already support that](https://docs.karakeep.app/configuration/#authentication--signup). Best, Michael

kerem referenced this issue

2026-03-02 11:58:57 +03:00

[PR #1105] [CLOSED] build(deps): bump pdfjs-dist from 4.0.379 to 4.2.67 #1738

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#1105

No description provided.

Rows
Columns