Your passwords are encrypted on your phone before they reach us. We keep them safe, sync them across your devices, and cannot read a single one of them.
10 EUR / year
Coming soonNot yet independently reviewed
Taken from the running app. Every entry in them was invented for the picture: no real vault was opened to make this page.
Encryption happens on your device, before anything is sent. Titles, usernames, web addresses, notes, card numbers, attachments: all of it is sealed by the time it reaches us. What arrives is a blob of ciphertext and the order it arrived in. That is the whole of our knowledge.
This matters because of how breaches actually go. When a password manager is compromised, the question is never whether the passwords were encrypted, because they always are. It is whether the attacker learned which sites each entry belonged to, and could then go after the ones worth going after. Here they cannot, because the site name is inside the envelope with everything else.
Changes merge field by field with a logical clock, so two phones editing the same entry both keep their edit.
Each sync is checked against a manifest your device signed. A server that alters, reorders or rolls back your vault fails the check and the app locks, including when that server is ours.
Six digits, released by your phone's security chip. On a device without one, no PIN is offered rather than a weak one.
Android autofill, which gives an app nothing until the website itself has vouched for that app's signature.
One thing is for sale here, and it is hosting: a server, its backups and its upkeep, for as many of your devices as you care to use.
cancel any time
The source is public under the AGPL-3.0-or-later, so running the server yourself is something you are free to do and always will be. It is simply not what is sold or supported here.
Every one of these is a feature other managers ship. Each was left out because building it would have meant sending something away.
A security page that lists only strengths is telling you half the story. These are the cases where the design does not help, stated plainly so you can decide whether they matter to you.
Nothing recovers the vault. Not us, not a support ticket, not anyone. That is the direct consequence of nobody but you holding a key, and it is why the app makes you confirm you have written the Secret Key down before it will open. Recovery codes cover a forgotten password on its own.
Once your phone is running someone else's code while the vault is open, the encryption is beside the point, because they can read what you read. The five attempt lockout and the idle lock narrow the window; they do not close it.
Each code opens the vault on its own, exactly like the master password. Ten printed codes are ten ways in. Treat the sheet the way you would treat the password itself.
Argon2id at 256 MiB makes guessing expensive, not impossible. It buys time against a stolen device; it cannot rescue a password that appears in a word list.
Sync stops, but nothing is taken from you: the vault stays on every device you own and still exports in full. We keep the server copy for 90 days, so a failed card or a forgotten renewal costs you nothing, and then we delete it. The app counts the days down every time you unlock, so you are never told about this only after the fact.
This is a small operation. If the hosting stops, your vault is still on your devices and still exports in full, and the server is open source, so you or anyone else can stand one up without us. That stays true whatever happens to this shop, which is the point of the licence.
| Android | Windows | iOS | |
|---|---|---|---|
| Vault, sync, attachments | Yes | Yes | - |
| Recovery codes | Yes | Yes | - |
| PIN unlock | Yes, in the security chip | No keystore | - |
| Autofill | Yes | Not built | - |
iOS needs a Mac to build, and has an unresolved question besides: an autofill extension there is capped near 120 MB of memory, and the key derivation asks for 256 MiB. There is no browser extension, because that is a second codebase and a second place for your passwords to pass through, for a convenience the phone already covers.
The building blocks are standard and well worn: Argon2id for key derivation, XChaCha20-Poly1305 for encryption, HKDF, Ed25519, all from the most reviewed libraries available. Nothing here invents a cipher. The overall shape follows a published design that has been audited elsewhere.
It is still 0.1.0 because the joints between those parts have only ever been checked by the person who made them. Eleven defects surfaced during the first build, and the two that mattered most were found by using the app rather than by any test. Some would have stayed invisible until the day they cost something: a recovery that locked every device out, a PIN that opened the vault and then could not sync.
That count is not a confession of sloppiness, it is what an honest first pass over a system like this looks like. But you are being asked to put your passwords in it, so you should know exactly where it stands before you do.