Everything Padlock does
Padlock features & functionality
Everything built into the Padlock password manager website and its browser extension — all of it running on the same zero-knowledge encrypted vault.
Core security
Zero-knowledge encryption
AES-256-GCM with a key derived via PBKDF2-SHA-256. New vaults use 600,000 iterations, while each vault keeps its stored iteration count. Your master password never leaves your browser.
Google Sign-In
Identity only — proves who you are, has nothing to do with your encryption key.
Master password + verifier
A known value is encrypted at setup so returning visits can check your password locally, without ever storing it.
Change master password
Re-authenticates, then re-encrypts every saved entry under a new key in one atomic database transaction.
Auto-lock
The decryption key is cleared from memory after a configurable idle period, on logout, or when the tab closes.
Session controls
Sign out other active sessions while keeping the current device signed in, or sign out everywhere when you need a complete reset.
Escalating unlock lockout
Repeated incorrect master-password attempts trigger a temporary, doubling lockout — a soft deterrent against guessing.
Vault management
Add / edit / delete entries
Site name, URL, username, password — soft-deleted, never hard-removed, so nothing vanishes by accident.
Search
Live filtering by site name, URL, or username as your vault grows.
TOTP / 2FA codes
Save a site's base32 TOTP secret and Padlock generates the live 6-digit code with a countdown, right on the dashboard.
Secure notes
A second entry type for anything that isn't a login — Wi-Fi passwords, recovery codes, PINs — encrypted the same way.
Vault health check
Flags weak, reused, and outdated (1+ year) passwords, computed entirely from data already decrypted in your browser.
Password expiry reminders
A dismissible dashboard banner nudges you to rotate passwords that haven't changed in over a year.
Export & import
Download your full vault as CSV or JSON, or bulk-import from either format — passwords are encrypted client-side either way.
Account & preferences
Profile
Account summary — email, sign-in provider, vault creation date, entry count, current lock status.
Settings
Auto-lock interval, dashboard display preferences, extension autofill behavior, and security controls — synced through your account.
Light / dark theme
Switch themes instantly from the header with one toggle; the system theme is the default and follows your device preference.
Browser extension
Autofill
Fill a login form from the popup with one click, matched to the exact site you're on so subdomains never mix up credentials.
Automatic single-login autofill
When exactly one credential matches the current HTTPS hostname, Padlock fills empty login fields automatically as the page loads — no popup click required.
Autofill safety controls
Automatic autofill is limited to HTTPS pages and exact hostnames, never overwrites fields you already filled, and can be disabled for any individual site.
Lock status indicator
The extension header clearly shows whether your vault is locked or unlocked before any credential action is available.
Update notifications
The extension notifies you when a new version is available so you can reload and use the latest security and compatibility fixes.
Right-click "Fill with Padlock"
A live context menu scoped to the current tab — autofill without opening the popup at all.
Click-a-field suggestions
Focusing a username/password field shows a dropdown of saved logins for that site.
Save-on-submit prompt
Submitting a new or changed login shows an in-page "Save this password?" banner after the redirect.
Password generator
Length slider, charset toggles, and a live strength meter, built with crypto.getRandomValues.
Copy to clipboard
Copies a password with a 20-second auto-clear, checked both live and on next popup open.
Draft recovery
Typing in the Add/Edit form autosaves a draft, restored if the popup closes before you hit Save.