A password manager that can’t read your passwords
Vault is a free, open-source, self-hosted password manager. Every password is encrypted with AES-256-GCM on your own device before it ever reaches a server — your master password never leaves your browser.
Client-side encryption
Passwords are encrypted with AES-256-GCM on your device using a key derived from your master password via Argon2id. The server only ever sees ciphertext.
Import in one click
Bring your existing passwords over from Chrome, Bitwarden, LastPass, or any similar CSV export — parsed entirely in your browser, never uploaded raw.
No ads, no tracking
No advertising, no analytics, no third-party trackers. Your data is never sold or shared.
Open source & self-hostable
Fork the source on GitHub and deploy your own fully private instance, free for any noncommercial use.
Frequently asked questions
What is Vault?
Vault is a free, open-source, self-hosted password manager. It stores your passwords, usernames, and notes, encrypting everything on your own device before any of it reaches a server.
Is Vault free?
Yes. Vault is free to use, and free to self-host under a noncommercial license — you can deploy your own private instance with your own Supabase project at no cost.
How does Vault encrypt my passwords?
Your master password and a random per-account salt are run through the Argon2id key-derivation function entirely in your browser to produce an AES-256-GCM encryption key. Every vault item is encrypted with that key before it is ever sent to the server — the server only ever stores unreadable ciphertext, never your master password and never your data in plaintext.
Can I self-host Vault?
Yes. Vault's source code is publicly available on GitHub. You can deploy your own fully private instance — your own database, your own data, isolated from everyone else's — by following the setup guide in the repository.
What happens if I forget my master password?
You can reset it via a one-time email code, but the previously saved vault items cannot be recovered — they were encrypted with a key derived from the password you forgot, and there is no server-side copy of that key. The reset clears the unreadable items so the vault is usable again afterward.
Does Vault use ads or tracking?
No. Vault has no advertising, no analytics, and no third-party trackers, and does not sell or share your data.