Valid Vault Password Manager

Local encrypted password manager. Unlock by fingerprint or password. No cloud, no accounts. Sync by QR code or encrypted file.

NEW IN 0.9.4.5 - Opening a dropdown on a signup form, like a birthday picker, no longer brings up the save prompt early, so signups such as Discord's can be finished. - The save prompt closes when you click outside it or press Escape. NEW IN 0.9.4.4 - Every change now runs the full automated test suite in the open on GitHub, including fuzz tests that feed thousands of damaged vault files, key files, and QR codes to Valid Vault and confirm each one is refused without touching your vault. - A security policy explains how to report a vulnerability privately. NEW IN 0.9.4.3 - Locking the vault closes any fill list already open on a page, and nothing that finishes decrypting after a lock is filled. - Clear Vault removes the backup copy first and reports an error instead of success if anything is left, so a cleared vault never comes back. - Pages without https ask before anything is filled. - Key passphrases now need at least 16 characters, and the form helps you choose the questions whose answers no one else could know. - Third-party notices for the QR libraries, the BIP-39 word list, and the fingerprint icon now ship with the extension. Valid Vault is a local, encrypted password manager. Your vault is encrypted on your device and never leaves it unless you move it yourself, as ciphertext, to another device you own. No cloud, accounts, or servers. No analytics. There is nothing to sign up for and nothing stored anywhere but your own browser. Works in Chrome, Edge, and Brave on Windows, Linux, and ChromeOS. Fingerprint and device PIN unlock use Windows Hello on Windows; on Linux, unlock with your master password. The Android app runs on the same code, with autofill in other apps, a private browser, and home screen widgets. The source code is public on GitHub, and the User Guide and privacy policy are at validprivacy.github.io. UNLOCK Fingerprint, device PIN, or local password Unlock with Windows Hello (fingerprint or your device PIN) through WebAuthn, or with a local master password. Computers without Windows Hello work fully with a password. One master key, no stored passwords A random 256-bit master key encrypts your vault. It is wrapped separately under each unlock method you set up, and unwrapping it is the check itself. There is no password hash stored anywhere to attack. Auto-lock The vault locks itself after the idle time you choose, from 10 seconds up to 2 hours. Only real mouse, scroll, click, and keyboard activity keeps it open. Locking also closes any fill list open on a page. Confirm before sensitive changes Editing or removing an unlock method, clearing the vault, and every key or vault export, import, or QR transfer ask for your fingerprint, device PIN, or password first, even while the vault is unlocked. DAY AND NIGHT Ink for day and Platinum for night, switched with the sun and moon button. The popup, Manage, the bookmarks panel, the User Guide, and the pop-ups on websites all follow your choice. AUTOFILL Click-to-fill Login, password, and personal info fields get a small V tag. Click it and pick what to fill. Nothing is filled without your click, and pages without https ask first. Fields inside modern web components and multi-step forms are detected too, and tags clear away when a step slides out of view. Save as you go Sign up or log in on a site and Valid Vault offers to save the login when the form is sent, including through sign-in redirects and multi-step forms. Click Not now, click outside, or press Escape to skip it. Password generator New password and change password fields get their own V that creates a strong random password and fills both the new and confirm boxes. Choose a password with special characters, or letters and numbers only for sites that reject symbols. Special characters come from the set most sites accept. It follows any rules the site sets, and you choose the length range in Settings, up to 64 characters. Two-factor codes Add a login's 2FA code by typing the setup key the site shows when you turn on two-factor authentication. Manage shows the current code and the seconds left, and the V tag on a site's code box fills it. Codes follow the standard used by authenticator apps and are made on your computer. Previous password safety net When you change a password, the old one is kept as a labeled backup with one-click restore for 30 days, in case the site never accepted the change. WHAT YOU CAN STORE Website logins, grouped by site, with multiple accounts per site, each with its 2FA code if you add one. Misc credentials, such as Wi-Fi passwords and license keys. Personal info (name, plus ranked phone numbers, emails, and addresses) used to fill forms. Crypto wallet seed phrases, organized by wallet and account, checked word by word against the standard 2048-word list, entirely offline. Seed words are only on screen while you choose to show them and are never filled into web pages. Encrypted bookmarks, saved from the popup and listed in a searchable side panel. HOW YOUR DATA IS PROTECTED Everything is encrypted with AES-256-GCM using the browser's built-in WebCrypto. Website logins, crypto wallets, and bookmarks are each sealed as a single encrypted blob, so not even a site name or wallet name is readable at rest. An encrypted backup copy kept in the extension's own storage restores the vault if the browser clears site data. Web pages never see your master key or a 2FA setup key. Autofill runs from the extension's background, and a page only ever receives the one value you clicked to fill. ONE VAULT FOR EVERY BROWSER Uni-Vault links each browser on your computer to a single encrypted vault file. Changes reach the file within about a second, and other linked browsers pick them up automatically, with no exporting or importing after the first link. A damaged file, a replaced file, or a file made with a different master key is refused and never overwritten. MOVING BETWEEN YOUR DEVICES Share Vault shows your encrypted vault, bookmarks and crypto wallets included, as an animated QR code, as large as your window allows, that another device scans with its camera. Export Vault saves the same encrypted vault as a file you can carry by USB drive or any other transport. Either way, it is useless without your master key, and every transfer asks for your fingerprint, device PIN, or password first. Your master key only leaves a device wrapped under a passphrase of at least 16 characters, plus three additional answers you choose, and the receiving device must enter all of them before it can use the key. A photographed QR code or a stolen key file is useless on its own. When you import a key, fingerprint or device PIN is offered first to lock it on the new browser. Lost a key file or forgot its passphrase? While any device still unlocks your vault, Change Key Passphrase and a fresh Export Key replace it. There is no server in between, and devices merge changes by timestamp, so edits and deletes carry across. Every import is checked before anything is saved, the same login is never saved twice, and importing the same vault again changes nothing. IMPORT FROM ANOTHER APP Bring your logins over from another password manager's export: a CSV, a Samsung Pass file, Bitwarden JSON, a 1Password .1pux file, or Dashlane's zipped export. 2FA codes in Bitwarden, 1Password, and CSV exports come along. Bring your bookmarks straight from this browser or from another browser's bookmarks HTML file. Everything is read on your computer and encrypted into your vault as it comes in. Logins and bookmarks you deleted stay deleted, and links you already have are skipped. Valid Vault can't delete the export file for you, so it reminds you to delete it, since most exports hold your passwords unencrypted. USER GUIDE A full, searchable User Guide opens from the popup menu. It covers setup, every setting, autofill, importing from another app, backups, moving between devices, what can and cannot be recovered, recommended setups, and troubleshooting. PRIVACY Valid Vault collects nothing, transmits nothing, and has no analytics or tracking. It makes no network requests at all. Your vault, your key, and your settings stay on your devices. Extensions for additional browsers are in development.