Zero-knowledge, cloud-synced vault. Your master password never leaves your browser in usable
form. It is stretched locally into two independent secrets: one used only to prove your identity to
the database, and one used only to encrypt/decrypt your vault with AES-256-GCM. The database only ever
stores the encrypted vault — never your master password, never a plaintext entry. There is
no password recovery of any kind: forgetting your master password means your vault can never
be decrypted again, by you or anyone else — there is deliberately no "forgot password" reset, since a
working one would mean the server could get you back in without your master password, which would
defeat zero-knowledge encryption entirely. This is an open-source educational project, not an
independently audited security product.
Unsupported browser
This tool needs the Web Crypto API (crypto.subtle), which requires a modern browser
and a secure (HTTPS) context. Please try a recent version of Chrome, Firefox, Edge, or Safari.
Firebase isn't configured yet
This page needs its own Firebase project (Authentication + Firestore) to store encrypted vaults.
Edit the firebaseConfig object near the top of the <script> in
password-manager.html with your project's values, and apply the Firestore security
rules in password-manager/firestore.rules. See
password-manager/README.md for step-by-step setup instructions.
Couldn't reach the sign-in service
Loading the Firebase SDK failed. This usually means there's no internet connection right now, or
something on this network (a firewall, ad-blocker, or content blocker) is blocking
www.gstatic.com. Check your connection and try again.
Forgot your master password? There is no self-service reset — that's what makes this
zero-knowledge. See the banner above.
Unlock your vault
Vault could not be decrypted
Your master password was correct, but the stored vault data didn't decrypt — this usually means
the encrypted record was corrupted or tampered with. You can start a brand-new empty vault under
this same password (this permanently erases the unreadable old data), or sign out and try again.
No entries yet. Click "Add entry" to save your first password.
Account & vault settings
This vault auto-locks after 5 minutes of inactivity. Copied passwords are cleared from your
clipboard automatically after 20 seconds. "Lock" keeps you signed in but re-asks for your master
password; "Sign out" ends the session entirely.
Add entry
Change master password
Restore from backup
This replaces your current cloud vault with the contents of an exported backup file, decrypted
with your current master password.
Delete account
This permanently deletes your account and your entire encrypted vault. This cannot be undone.