Zero-Knowledge Credential Vault
A password manager that cannot read your passwords.
Padlock encrypts every credential in your browser with a key only you hold. Our servers only ever see ciphertext — not your master password, not your data.
Loading…
Zero-Knowledge Credential Vault
Padlock encrypts every credential in your browser with a key only you hold. Our servers only ever see ciphertext — not your master password, not your data.
Identity only. Signing in with Google proves who you are — it never touches your passwords or your encryption key.
Chosen once, known only to you. It's never sent to our servers, never stored anywhere — not in the database, not in a cookie, not in local storage.
Every saved password is encrypted in your browser with a key derived from your master password before it ever leaves your device.
Our database only ever stores ciphertext. Even with full access to it, nobody — including us — can read your saved passwords.
Your decryption key lives only in memory and is automatically cleared after 5 minutes of inactivity, on logout, or when you close the tab.
Autofill on any site, right-click "Fill with Padlock," a save prompt when you log in somewhere new, and a built-in password generator.
Sign in with Google
Verifies your identity through Supabase Auth. This step has nothing to do with encryption.
Create your master password
Done once. This password derives your personal encryption key — write it down somewhere safe, because it cannot be recovered.
Add your saved logins
Site name, URL, username, and password. Everything is encrypted in your browser before it's saved.
Unlock anytime
Re-enter your master password whenever your session locks. It's checked locally — never sent anywhere.
Install the browser extension
Same vault, same encryption. Get autofill, a right-click fill menu, and a password generator on top.
Your master password never leaves your browser. Instead, it's run through PBKDF2 with 250,000 iterations and a random salt to derive an AES-256 encryption key — entirely on your device, using the browser's native Web Crypto API.
On your next visit, we re-derive the same key from your password and try to decrypt a small stored “verifier” value — if it matches, your password was correct. Your master password itself is never compared, stored, or transmitted at any point.