Password Vault

A local, encrypted password vault with keyboard-shortcut autofill, save, and Touch ID unlock.

Password Vault keeps your logins in an encrypted vault on your own computer and fills them into sign-in forms for you. Nothing is uploaded, synced, or sent anywhere — there is no account to create and no server involved. FILLING • Click into a username box and pick from your saved logins, or press the fill shortcut (Cmd+Shift+L / Ctrl+Shift+L). • Works on ordinary forms, single-page apps, forms inside iframes, and inputs built with web components — the places autofill usually gives up. • When several logins match a site, a picker appears next to the field. Arrow keys and Enter, or click. SAVING • Sign in as usual and accept the "Save password?" prompt, or press Cmd+Shift+Y at any time. • "Never here" stops the prompt for a site you do not want saved. SECURITY • Your vault is encrypted with AES-GCM-256. The key is derived from your master password using PBKDF2-SHA256 at 600,000 iterations. • Your master password is never stored anywhere, in any form. • The vault locks on inactivity, when your computer goes idle, and whenever Chrome quits. • Copied passwords are cleared from the clipboard automatically — and only if the clipboard still holds them. • Repeated wrong master-password attempts trigger an escalating delay. TOUCH ID (macOS) Unlock with your fingerprint instead of typing your master password. This uses the Secure Enclave through WebAuthn: the key that opens your vault is stored wrapped under a secret that only exists after a successful fingerprint check. BRINGING YOUR PASSWORDS ACROSS Chrome does not let any extension read its built-in password manager. To move your existing passwords in, export them from Chrome (Settings → Autofill and passwords → Google Password Manager → Settings → Export passwords) and import the file in this extension's settings. Delete the exported file afterwards — it is not encrypted. SECURITY CHECK Find reused and weak passwords across your vault. The check runs entirely on your machine; no password is ever sent anywhere, not even in hashed form. WHAT THIS IS NOT There is no sync between devices and no cloud backup. If you forget your master password, your vault cannot be recovered — export an encrypted backup and keep it somewhere safe. While the vault is unlocked, anyone using your computer can see your saved logins, so lock it when you step away.