Zero-Knowledge Credential Vault
A password manager that cannot read your passwords.
Padlock encrypts every credential in your browser with a key only you hold. Our servers only ever see ciphertext — not your master password, not your data.
Loading…
Zero-Knowledge Credential Vault
Padlock encrypts every credential in your browser with a key only you hold. Our servers only ever see ciphertext — not your master password, not your data.
Identity only. Signing in with Google proves who you are — it never touches your passwords or your encryption key.
Chosen once, known only to you. It's never sent to our servers, never stored anywhere — not in the database, not in a cookie, not in local storage.
Every saved password is encrypted in your browser with a key derived from your master password before it ever leaves your device.
Our database only ever stores ciphertext. Even with full access to it, nobody — including us — can read your saved passwords.
Your decryption key lives only in memory and is automatically cleared after 5 minutes of inactivity, on logout, or when you close the tab.
Autofill on any site, right-click "Fill with Padlock," a save prompt when you log in somewhere new, and a built-in password generator.
Sign in with Google
Verifies your identity through Supabase Auth. This step has nothing to do with encryption.
Create your master password
Done once. This password derives your personal encryption key — write it down somewhere safe, because it cannot be recovered.
Add your saved logins
Site name, URL, username, and password. Everything is encrypted in your browser before it's saved.
Unlock anytime
Re-enter your master password whenever your session locks. It's checked locally — never sent anywhere.
Install the browser extension
Same vault, same encryption. Get autofill, a right-click fill menu, and a password generator on top.
Your master password never leaves your browser. Instead, it’s run through PBKDF2 with 600,000 iterations and a random salt to derive an AES-256 encryption key — entirely on your device, using the browser’s native Web Crypto API.
On your next visit, we re-derive the same key from your password and try to decrypt a small stored “verifier” value — if it matches, your password was correct. Your master password itself is never compared, stored, or transmitted at any point.
It means Padlock's servers never receive your master password or any readable version of your saved passwords. Encryption and decryption happen entirely in your browser, so the database only ever holds ciphertext that we have no key for.
Your vault cannot be recovered. Because your master password is never transmitted or stored, there is no reset link and no support process that can decrypt your data. Write it down and keep it somewhere safe.
Yes. Both the website and the browser extension are free, and there is no paid tier, no advertising, and no selling of user data.
Any Chromium-based browser with Manifest V3 support, including Google Chrome, Microsoft Edge, and Brave.
Yes. Padlock includes a built-in TOTP generator following RFC 6238, so you can store a site's 2FA setup key and generate live six-digit codes without a separate authenticator app.