Valid Vault Password Manager

Decentralized password manager with fingerprint authentication

Valid Vault is a local, encrypted password manager. Your vault is encrypted on your device and never leaves it unless you move it yourself, as ciphertext, to another device you own. No cloud. No accounts. No servers. No analytics. There is nothing to sign up for and nothing stored anywhere but your own browser. This is a beta release under active development. The project is open source. UNLOCK Fingerprint or device PIN Unlock with Windows Hello (fingerprint or your device PIN) through WebAuthn, or with your master password. One master key, no stored passwords A random 256-bit master key encrypts your vault. It is wrapped separately under each unlock method you set up, and unwrapping it is the check itself. There is no password hash stored anywhere to attack. Auto-lock The vault locks itself after the idle time you choose, from 10 seconds up to 2 hours. Only real mouse, scroll, click, and keyboard activity keeps it open. AUTOFILL Click-to-fill Login, password, and personal info fields get a small V tag. Click it and pick what to fill. Nothing is filled without your click. Save as you go Sign up or log in on a site and Valid Vault offers to save the login, including through sign-in redirects and multi-step forms. Password generator New password and change password fields get their own V that creates a strong random password and fills both the new and confirm boxes. It always mixes uppercase, lowercase, digits, and symbols, follows any rules the site sets, and lets you choose the length range in Settings, up to 64 characters. Previous password safety net When you change a password, the old one is kept as a labeled backup with one-click restore, in case the site never accepted the change. WHAT YOU CAN STORE Website logins, grouped by site, with multiple accounts per site. Misc credentials, such as Wi-Fi passwords and license keys. Personal info (name, phone, address, and ranked emails) used to fill forms. Crypto wallet seed phrases, organized by wallet and account, checked word by word against the standard 2048-word list, entirely offline. Seed words are only on screen while you choose to show them and are never filled into web pages. Encrypted bookmarks, saved from the popup and listed in a searchable side panel. HOW YOUR DATA IS PROTECTED Everything is encrypted with AES-256-GCM using the browser's built-in WebCrypto. Website logins, crypto wallets, and bookmarks are each sealed as a single encrypted blob, so not even a site name or wallet name is readable at rest. Web pages never see your master key. Autofill runs from the extension's background, and a page only ever receives the one value you clicked to fill. MOVING BETWEEN YOUR DEVICES Share Vault shows your encrypted vault as an animated QR code that another device scans with its camera. Export Vault saves the same encrypted vault as a file. Either way, it is useless without your master key. Your master key only leaves a device wrapped under a passphrase and three security questions you choose, and the receiving device must enter all of them before it can use the key. A photographed QR code or a stolen key file is useless on its own. There is no server in between, and devices merge changes by timestamp, so edits and deletes carry across. PRIVACY Valid Vault collects nothing, transmits nothing, and has no analytics or tracking. It makes no network requests at all. Your vault, your key, and your settings stay on your devices. Extensions for additional browsers and an Android app are in development.