Private by design.
Honest about limits.
Security preview · 0.2.0
This release has not been independently audited. Use test credentials until review is complete. No password manager is hack proof.
Your vault stays in your browser
Vault contents are encrypted with AES-256-GCM using a key derived from your passphrase with PBKDF2-SHA-256, 600,000 iterations and a random salt. Encryption happens on your device. There are no analytics or third-party scripts.
Backups are essential
Browser storage can be cleared or lost. Download encrypted backups after changes, store them separately, and test restoration. Your master passphrase cannot be recovered or reset. Old backups retain the passphrase used when they were created.
Know what encryption protects
Encryption protects a locked vault file. Malware, malicious browser extensions, a compromised website or an unlocked device can expose passwords. Clipboard history may retain copied secrets. Clipboard clearing is best effort. A malicious update can compromise an unlocked vault.
Available in this preview
Logins, secure notes, favorites, search, random passwords, encrypted backups, passphrase changes, and automatic locking. Explicit exact-origin browser autofill and desktop app packaging are included in this release candidate. Passkeys, live sync, recovery, sharing and publisher-signed installers are not included.
Local use and free distribution
Standalone desktop installers include their runtime. The developer source release requires Node.js 22 or newer. The MIT license allows free distribution. Independently reviewed, signed releases and a secure update channel are required before a public stable launch.