core
zero-knowledge password, secret and .env manager
Your passwords and your .env files, encrypted before they leave your browser.
The server stores what it cannot read. That is not a policy it promises to follow — it is the only thing it is ever given.
what it holds
logins
usernames, passwords, one-time codes, recovery codes
notes
stored exactly as typed, never rendered as markup
cards
number, expiry, CVV and PIN, masked in the list
identities
the details forms ask for over and over
ssh keys
private keys with their line breaks intact
.env files
per project, per environment — import and export whole
how it works
- 01
you type a master password
It is never sent. Not hashed and sent — not sent.
- 02
the browser derives your keys
Memory-hard by design, so each guess costs an attacker real time and RAM.
- 03
everything is encrypted here
The server receives blobs, stores blobs, and returns blobs.
what the server can and cannot see
cannot see
- passwords, notes, card numbers, SSH keys
- item titles, usernames and URLs
- folder names, tags and project names
- environment variable names — not only their values
can see
- your email address, so it can send you a login link
- how many items you have, and when each last changed
- when you sign in, from roughly where
the part to read twice
no password reset
Nobody here can open your vault, and that includes when you want them to. Lose your master password and your Emergency Kit and the vault is gone — not locked, gone.
The Emergency Kit is shown once, when you create the vault. Print it, or write it down. It is the only way back.