diff --git a/README.md b/README.md
index 694c697d..a0877a6e 100644
--- a/README.md
+++ b/README.md
@@ -126,6 +126,7 @@ This now has created the following structure, either on disk or as an in memory
 │   └── _README
 ├── config
 ├── datastore
+├── keys
 └── version
 ```
 
@@ -145,6 +146,7 @@ Arguments:
   * `storageBackends` (object, optional): may contain the following values, which should each be a class implementing the [datastore interface](https://github.com/ipfs/interface-datastore#readme):
     * `root` (defaults to [`datastore-fs`](https://github.com/ipfs/js-datastore-fs#readme) in Node.js and [`datastore-level`](https://github.com/ipfs/js-datastore-level#readme) in the browser). Defines the back-end type used for gets and puts of values at the root (`repo.set()`, `repo.get()`)
     * `blocks` (defaults to [`datastore-fs`](https://github.com/ipfs/js-datastore-fs#readme) in Node.js and [`datastore-level`](https://github.com/ipfs/js-datastore-level#readme) in the browser). Defines the back-end type used for gets and puts of values at `repo.blocks`.
+    * `keys` (defaults to [`datastore-fs`](https://github.com/ipfs/js-datastore-fs#readme) in Node.js and [`datastore-level`](https://github.com/ipfs/js-datastore-level#readme) in the browser). Defines the back-end type used for gets and puts of encrypted keys at `repo.keys`
     * `datastore` (defaults to [`datastore-level`](https://github.com/ipfs/js-datastore-level#readme)). Defines the back-end type used as the key-valye store used for gets and puts of values at `repo.datastore`.
 
 ```js
diff --git a/src/default-options-browser.js b/src/default-options-browser.js
index f7f73895..c9c85b1f 100644
--- a/src/default-options-browser.js
+++ b/src/default-options-browser.js
@@ -6,6 +6,7 @@ module.exports = {
   storageBackends: {
     root: require('datastore-level'),
     blocks: require('datastore-level'),
+    keys: require('datastore-level'),
     datastore: require('datastore-level')
   },
   storageBackendOptions: {
@@ -17,6 +18,10 @@ module.exports = {
       sharding: false,
       db: require('level-js')
     },
+    keys: {
+      sharding: false,
+      db: require('level-js')
+    },
     datastore: {
       db: require('level-js')
     }
diff --git a/src/default-options.js b/src/default-options.js
index 7115490c..e9322d67 100644
--- a/src/default-options.js
+++ b/src/default-options.js
@@ -6,6 +6,7 @@ module.exports = {
   storageBackends: {
     root: require('datastore-fs'),
     blocks: require('datastore-fs'),
+    keys: require('datastore-fs'),
     datastore: require('datastore-level')
   },
   storageBackendOptions: {
@@ -15,6 +16,8 @@ module.exports = {
     blocks: {
       sharding: true,
       extension: '.data'
+    },
+    keys: {
     }
   }
 }
diff --git a/src/index.js b/src/index.js
index 2258bd52..1ffbc055 100644
--- a/src/index.js
+++ b/src/index.js
@@ -104,6 +104,19 @@ class IpfsRepo {
         this.blocks = blocks
         cb()
       },
+      (cb) => {
+        log('creating keystore')
+        const keysBaseStore = backends.create('keys', path.join(this.path, 'keys'), this.options)
+        blockstore(
+          keysBaseStore,
+          this.options.storageBackendOptions.keys,
+          cb)
+      },
+      (keys, cb) => {
+        this.keys = keys
+        cb()
+      },
+
       (cb) => {
         this.closed = false
         log('all opened')
@@ -169,7 +182,7 @@ class IpfsRepo {
       (cb) => this.apiAddr.delete(ignoringNotFound(cb)),
       (cb) => {
         each(
-          [this.blocks, this.datastore],
+          [this.blocks, this.keys, this.datastore],
           (store, callback) => store.close(callback),
           cb)
       },
diff --git a/test/browser.js b/test/browser.js
index e3ba51d8..f5490093 100644
--- a/test/browser.js
+++ b/test/browser.js
@@ -24,4 +24,5 @@ describe('IPFS Repo Tests on the Browser', () => {
   require('./repo-test')(repo)
   require('./blockstore-test')(repo)
   require('./datastore-test')(repo)
+  require('./keystore-test')(repo)
 })
diff --git a/test/keystore-test.js b/test/keystore-test.js
new file mode 100644
index 00000000..a04e1695
--- /dev/null
+++ b/test/keystore-test.js
@@ -0,0 +1,15 @@
+/* eslint max-nested-callbacks: ["error", 8] */
+/* eslint-env mocha */
+'use strict'
+
+const chai = require('chai')
+chai.use(require('dirty-chai'))
+const expect = chai.expect
+
+module.exports = (repo) => {
+  describe('keystore', () => {
+    it('exists', () => {
+      expect(repo).to.have.property('keys')
+    })
+  })
+}
diff --git a/test/node.js b/test/node.js
index 1750cb58..1deb6ddb 100644
--- a/test/node.js
+++ b/test/node.js
@@ -60,6 +60,7 @@ describe('IPFS Repo Tests onNode.js', () => {
     require('./repo-test')(repo)
     require('./blockstore-test')(repo)
     require('./datastore-test')(repo)
+    require('./keystore-test')(repo)
     if (!r.init) {
       require('./interop-test')(repo)
     }
diff --git a/test/options-test.js b/test/options-test.js
index f276b155..c452fa25 100644
--- a/test/options-test.js
+++ b/test/options-test.js
@@ -40,12 +40,14 @@ function expectedRepoOptions () {
       // equivalents via package.browser
       root: require('datastore-fs'),
       blocks: require('datastore-fs'),
+      keys: require('datastore-fs'),
       datastore: require('datastore-level')
     },
     storageBackendOptions: {
       root: {
         extension: ''
       },
+      keys: {},
       blocks: {
         sharding: true,
         extension: '.data'
@@ -55,6 +57,8 @@ function expectedRepoOptions () {
 
   if (process.browser) {
     options.storageBackendOptions.root.db = require('leveldown')
+    options.storageBackendOptions.keys.db = require('leveldown')
+    options.storageBackendOptions.keys.sharding = false
     options.storageBackendOptions.blocks.db = require('leveldown')
     delete options.storageBackendOptions.blocks.extension
     options.storageBackendOptions.blocks.sharding = false