Bramble

Local-first, encrypted password manager. No server, no sync service.

Bramble is a password manager that lives in your browser and keeps your secrets on your own machine. No account, no server holding your vault, no company to get breached and leak everything. You hold the file, you hold the password, and that's it. Works in Chrome, Edge, Brave, Arc, and other Chromium browsers. Install it and you're running in about a minute. WHAT IT DOES Your passwords are encrypted on your device and written to a single vault file, wherever you choose to put it. Drop it in a Dropbox or Drive folder and it syncs across your machines: Bramble never sees that folder, it just reads and writes one strongly encrypted file. FEATURES - Local-first, always. One encrypted file on disk, in a location you pick. - Serious crypto. Argon2id for your key, AES-256-GCM for data, envelope encryption so every entry has its own key. Secrets wiped from memory after use. - Everything encrypted. Site names, usernames, notes — all of it. - Domain-smart autofill. www.example.com, ca.accounts.example.com, and example.com all match one login. One entry, several URLs. - More than logins. Logins, payment cards, secure notes, and SSH keys, each with their own fields. - Built-in password generator. - Hardware-key unlock. Register a YubiKey, Touch ID, or Windows Hello and unlock with a tap via WebAuthn PRF. Use it alongside your master password, or make it your only way in. - Recovery codes. Every vault gets a secure recovery code at setup: a printable backup that unlocks it independently of your master password. - TOTP / 2FA codes. Paste an otpauth:// URI or secret and Bramble generates the codes. - Optional breach checking. Have I Been Pwned lookup using k-anonymity, so nothing about your password leaves your machine. Off by default. - Auto-lock after 15 minutes idle (configurable). - Import from KeePass, Bitwarden, Proton Pass and 1Password WHY LOCAL-FIRST Cloud managers keep everyone's vaults on their servers, which is one giant target. When one is breached, it isn't one vault that leaks but millions at once, often disclosed months later. Bramble flips that around: - No server to breach. Your vault never leaves your control. - No account, no subscription, no telemetry. Nothing to sign up for. - You own the file. Back it up, sync it, or keep it off the internet entirely. - Nothing to trust but the code. The code is open source and runs entirely on your device. HOW THE ENCRYPTION WORKS Bramble uses LUKS-style key slots and envelope encryption. One random Vault Key protects your data. Each unlock method (master password, security key, recovery code) derives its own Key-Encryption Key that unwraps a copy of that same Vault Key. so adding or revoking an unlock method never re-encrypts a single entry. The Vault Key then unwraps a fresh per-entry key for every item. Everything is AES-256-GCM. COMING FROM KEEPASS? You'll feel at home: your encrypted database, your control, no cloud middleman -- and Bramble imports your KDBX4 files. The differences: it lives in your browser (no separate desktop app or plugin bridge), autofill is built in with domain matching and an on-page dropdown, and it ships one modern build with Argon2id and AES-256-GCM rather than a sprawl of plugins. Clean UI, dark mode included. Read the full privacy policy linked on this page.