7 Free Local-First Windows Apps for Passwords, Notes, Budgets and AI

How-To Geek's Nimrah Chaudhry rounded up seven free, open-source desktop apps built this way: KeePassXC, Joplin, LibreOffice, Actual Budget, Handy, Calibre and Jan. All seven run on Windows. The catch is that "keeps data out of the cloud" is a default, not a guarantee. Below is what each app does locally, where it can connect to the internet, and what you should set up before moving over.

What "local-first" does and doesn't mean​

None of these apps is a sealed box. Some need an initial model download. Some have optional sync that sends copies elsewhere. Installing open-source software doesn't back up your data, secure it or stop all network traffic. It only means the app's core function doesn't require an account or a hosted service, and that you decide where your files go.

KeePassXC: password vault in a file​

KeePassXC's documentation says it uses a local, encrypted database, which suits people who don't want a hosted vault. Its native formats are KDBX 3.1 and KDBX 4. Windows, macOS and Linux are supported, and the How-To Geek roundup also lists BSD.

• Sync is your choice. KeePassXC has no built-in cloud sync. The project says you can sync by putting the database in a Dropbox, Google Drive, OneDrive, ownCloud or Nextcloud folder. It prefers that approach because it isn't tied to one provider.
• KeeShare is not a cloud service. It shares credential groups through a file location you choose. If that location is a cloud-synced folder, your credentials leave the device.
• Network use is limited. The FAQ says network access is used for downloading website icons. The feature is opt-in, and the project says the app won't touch the network without your prior consent.
• Key files need care. If you sync the database through a cloud provider, the FAQ says to sync only the KDBX file. Distribute any key file separately, for example on a thumb drive.
• Windows runtime error. If you see a "VCRUNTIME140_1.dll was not found" error at launch, the docs say you're missing the Microsoft Visual C++ Redistributable.

The tradeoff is that you are now the support desk. Lose the file or forget the master password and there's no recovery link. Test a backup before you delete anything from your old manager.

Joplin: notes that stay put unless you say otherwise​

Joplin describes itself as "offline first," which means you always have your data on your phone or computer. The app runs on Windows, Linux, macOS, Android and iOS. Notes are Markdown, organised in notebooks, with full-text search. Evernote exports can be imported.

Sync is optional. The documented targets include Nextcloud, Dropbox, OneDrive and Joplin Cloud. If you turn sync on, enable end-to-end encryption first. The documented procedure goes like this:

1. On your first device, open the Encryption Configuration screen and click "Enable encryption".
2. Enter a Master Key password. Joplin says it can't be recovered if you forget it.
3. Sync so the encrypted data reaches your sync target. Joplin warns this can take a long time on large collections.
4. On each other device, sync and enter the master key password when asked.
5. Don't enable encryption on several devices at once. Joplin warns you can end up with multiple keys.

With no sync configured, notes stay on the device. With sync, copies live wherever you point it, though end-to-end encryption means the provider can't read them.

LibreOffice: the familiar office suite, offline​

LibreOffice's help says it can open and save Microsoft Office formats, including Office Open XML. Word, Excel and PowerPoint files open in Writer, Calc and Impress. You can set default save formats under Tools > Options > Load/Save > General, and a Document Converter Wizard can batch-convert Office files to OpenDocument.

Format support is not the same as perfect fidelity. The documentation says Microsoft Office and LibreOffice generally can't run the same macro code. Office uses VBA and LibreOffice uses Basic based on its own API, so macros need editing to move between them. LibreOffice can load VBA-containing files and preserve the macros if you only edit ordinary content and save back in an Office format. If you swap files with Microsoft 365 users, test your important documents first. Layout shifts are the usual complaint.

Actual Budget: local budgeting, with a server boundary​

Actual's desktop app works offline with manual entry or file imports. A server comes into play for multi-device sync and bank sync. The line is easy to blur:

• Bank sync needs an actual-server. You supply your own API credentials from a supported provider. The docs list Akahu, Enable Banking, GoCardless, SimpleFIN Bridge and Pluggy.ai.
• Bank tokens aren't covered by end-to-end encryption. The docs say the keys and secrets are stored on the server and are not covered by end-to-end encryption. They add that administrators or hosting providers with database access can read those tokens, and suggest self-hosting if that worries you.
• Release 26.11.0 is current. The release notes show it adds a setting to sync linked accounts automatically at an interval you choose. The notes also say it requires explicit server-config approval for private SimpleFIN bridges. Automatic syncing is off by default.

To keep the whole workflow local, skip bank linking and import files from your bank instead.

Handy: dictation without uploading your voice​

Handy is a free, MIT-licensed push-to-talk dictation app. You press a shortcut, speak, and the transcript is pasted into the focused text field. The project's GitHub page says the process is entirely local. It uses Silero voice activity detection and your choice of Whisper models or Parakeet V3, with GPU acceleration for Whisper when available.

Practical Windows details from the project and third-party coverage:

• Install options. Handy can be installed with winget, though the project notes that package isn't maintained by the Handy developers. A Spokenly review lists Windows 10 and 11 x64 and says the installer fetches WebView2. That review is third-party, so check the download page for current requirements.
• Model downloads need the network once. The GitHub page lists Small at 487 MB and Turbo at 1,600 MB. The project's documentation, as relayed in the research notes, says network use is limited to updates, model downloads and optional services.
• Optional AI post-processing. If you turn on cloud-AI cleanup, the project documentation says the transcribed text goes to that provider. Leave it off if you want everything local.
• Limits. The FAQ says it takes microphone input, not system audio. It doesn't offer real-time live captions yet. One reviewer reported a delay of a couple of seconds, which is a single opinion, not a benchmark.

Speed and accuracy will vary with your hardware, model and language. Treat names, figures and specialist terms with suspicion whatever you run.

Calibre: one library for your e-books​

Calibre is a free, open-source e-book manager that works offline. It catalogs books, edits metadata, converts formats and transfers files to compatible readers. Some features do use the internet: fetching metadata, downloading news, and the content server that exposes your library through a browser. Skip those and it's a local library. The sources reviewed don't address DRM, so don't assume Calibre removes restrictions on books bought from storefronts.

Jan: a local AI assistant​

Jan's documentation says local models run on your machine without an API key or internet connection once downloaded. Cloud providers are an optional alternative and need their own credentials. Choosing a cloud provider changes where your prompts are processed.

Hardware is the real constraint. Smaller models are easier to run but may be less capable than the biggest hosted models. Jan's documentation also notes that as of v0.8.5 its bundled local engine doesn't load models on Intel Macs. That doesn't affect Windows, but it undercuts any blanket claim that local Jan works on every machine.

Before you switch​

How-To Geek suggests starting with one or two apps, such as KeePassXC and Joplin, and moving your most sensitive data first. Good advice. A few additions:

1. Back up first. Local control means local responsibility. Keep a tested copy of your KeePassXC database, Joplin data and budget files.
2. Test import and export before deleting anything from the old service.
3. Decide on sync deliberately. Encrypt Joplin sync. Remember that a cloud-synced KeePassXC folder is still a cloud copy, even if it's encrypted.
4. Check compatibility with collaborators before replacing Microsoft 365 or Google Docs.
5. Treat optional features as the boundary. Bank sync, cloud AI providers, metadata fetching and cloud post-processing are where your data can leave the PC.

Open source also isn't a security audit. Each app still needs updates and sensible settings. Keeping a few files on your own drive beats having them in someone else's data center, provided you also keep backups.