Otter Vault

Catches one-time API keys and passwords as you create them and saves them to an encrypted local vault, only when you say so.

Ever created an API key, clicked away, and realised the site will never show it again? Otter Vault is a small otter that watches for that moment. When a developer console reveals a brand-new API key, the otter offers to tuck it into an encrypted vault before it disappears. It does the same for password fields. You stay in control • Nothing is saved until you click "Keep it safe". • Credentials are filled only on the exact website they were saved for (same protocol, host and port), never on lookalike domains, and never on insecure http pages. Get a key back when you need it • Open the popup, search by label, site or key hint, and switch between API keys and passwords. • Copying asks for your passphrase again, and the clipboard clears itself 5 minutes later (1 minute for passwords) if it still holds that secret. Private by design • Everything stays on your device: no servers, no accounts, no analytics, no network requests. • Your vault is encrypted with AES-256-GCM using a key derived from your passphrase (PBKDF2-SHA-256, 600,000 iterations). The passphrase is never stored. • Labels, usernames and website addresses are encrypted too, not just the secrets. • The vault locks itself after 5, 15 or 30 minutes of inactivity. You choose. Early preview Otter Vault has not yet had an independent security audit. If you forget your passphrase, the vault cannot be recovered.