SecureVault
Zero-Knowledge AES-256-GCM Password Manager
AES-256-GCM
Face ID & Fingerprint
Local Vault
Zero-Knowledge AES-256-GCM Password Manager
Your vault is decrypted in memory and ready. Add your first login, payment card, or secret note.
Protects against forgotten passwords & accidental deletion
Your vault is encrypted with a random data key that is wrapped separately by your Master Password and by this 20-character Emergency Recovery Key. If you ever forget your Master Password, the Recovery Key can independently decrypt your vault and let you set a new password.
Manage Biometrics, Unlock PIN, Sync, Migration, Sharing & Event Log
Biometric unlock uses your device's platform authenticator (Face ID, Touch ID, Windows Hello or Android biometrics) with the WebAuthn PRF extension to derive a hardware-bound key. Browsers or devices without PRF support cannot enroll.
The Unlock PIN is mixed into the master-password key derivation, so the vault cannot be decrypted without it. Changing it requires your current master password.
A web page cannot read or fill forms on other websites, so real auto-fill and auto-capture require a browser extension. Until then, use Copy & Open on any login card: it copies the password (auto-cleared after 30 seconds) and opens the site.
Copy your encrypted Sync Payload to move this vault to another device. Pasting a payload replaces the vault on this device (the current one is kept as a previous-version backup).
Import CSV exports from Chrome, Firefox, Bitwarden, 1Password or SecureVault (columns are detected from the header row). CSV exports are unencrypted — delete them after use.
After every save, delete, restore or settings change, the encrypted vault is written to your device. The backup location also gets HOW-TO-DECRYPT-SecureVault-Backup.txt and an Offline Decrypter page, so you can open your backup with your Master Password or Recovery Key even if this website no longer exists.
Folder mode keeps SecureVault-AutoBackup-latest.vault.json plus one file per day. Auto-Download saves a new file after each change. Keep your Recovery Key somewhere else, never in the backup folder.
Stored unencrypted on this device only; it contains no site names or usernames.
Updated when you run Breach Scan in the Security Center.
Send the bundle and the passphrase over two different channels. The recipient opens it in SecureVault → Security Center → Open a Shared Credential.
Face ID, Touch ID, Windows Hello or Android biometrics
To prevent accidental deletion of your entire vault, type DELETE below or download a backup first.