Vault

Vault is a local-first, zero-knowledge password manager that keeps your entire digital life encrypted on your own device and synced privately across all of them. Your master password never leaves your device — it's used to derive your encryption key locally, and only encrypted data is ever stored or synced. Even we can't read your vault. That's the point.

Why Vault

- True zero-knowledge. Everything is encrypted before it ever touches the cloud. The servers only ever hold unreadable ciphertext, never your master password, never your plaintext.
- Works completely offline. Your vault lives on your device first. No signal, no server, no problem. Vault is fully functional with or without a connection. Sync is a backup, not a dependency.
- Bank-grade encryption. AES-GCM 256-bit encryption with keys hardened by 600,000 rounds of PBKDF2-SHA256, following modern OWASP guidance. A fresh, never-reused nonce protects every save.
- No tracking. No ads. No telemetry. Vault makes zero third-party network requests. There's no analytics, no trackers, and no remote code, just your encrypted vault.

Everything in one secure place

Store and organize far more than just passwords, with purpose-built fields for each type:

- Logins: usernames, passwords, websites, and notes
- Credit & debit cards: card numbers, expiry, CVV, and PINs
- Software licenses: license keys, versions, and order details
- Identities: names, addresses, emails, and phone numbers
- Secure notes: for anything that needs to stay private
- API keys & secrets: for developers and power users

Find anything instantly with fast search and category filters across your whole vault.

Built-in 2FA

- Time-based one-time codes (TOTP) generated right inside Vault for any login, complete with a live countdown, so you never reach for a separate authenticator app.
- Scan a setup QR code straight from an image, decoded entirely on-device, your 2FA secret never goes online.
- Backup recovery codes stored as a masked, copyable block, kept out of plaintext exports so your 2FA safety net can't leak.

Encrypted attachments

Attach files to any entry, recovery kits, scanned documents, key files. Attachments are individually encrypted and synced securely across your devices, never stored in the clear.

Private sync across your devices

Edit on your laptop, open on your phone, and your changes are there. Sync moves only encrypted data, never your master password, never plaintext. Smart change detection keeps sync fast, and when two devices edit at once, Vault detects the conflict and lets you decide which version wins. Nothing is ever silently overwritten.

Switching is easy, and leaving is, too

- Import from 1Password (.1pif) or any CSV file in a few taps, with a preview before anything is added.
- Export an encrypted backup for safekeeping, plus a standalone, dependency-free recovery tool that can decrypt your backup with your master password, even if the app ever goes away. Your data is never held hostage.

Privacy by design, everywhere

- Auto-lock clears your keys from memory after a period of inactivity.
- Copy-and-auto-clear wipes sensitive values from your clipboard after use.
- Private favicons for your logins are fetched without ever exposing which sites you use to a third party.

Vault gives you the convenience of a modern password manager with the uncompromising privacy of true zero-knowledge encryption — no accounts to trust, no data to leak, no strings attached.