Vault.
Encrypted credentials. TOTP. Breach check. Browser extensions.
- →Per-tenant master key. AES-256-GCM + PBKDF2. Never plaintext at rest.
- →TOTP management built in. Browser extensions for Chrome / Firefox / Safari autofill.
- →Breach check against HaveIBeenPwned. Scheduled rotation.
Core capabilities.
Per-tenant encryption
Master key per-tenant. Optional HSM-backed. User secrets over PBKDF2.
Folder hierarchy
Credentials organized by client / purpose. Per-folder access.
TOTP management
Time-based OTP seeds stored encrypted. UI shows the code alongside the credential.
Breach check
Bulk + single-credential check against HaveIBeenPwned k-anon API.
Key rotation
Scheduled or on-demand rotation of encryption keys. Audited.
Password generator
Configurable length / character set / pronounceable.
Time-bound sharing
Share a credential with an expiry. Auto-revoke.
Browser extensions
Chrome, Firefox, Safari. Autofill with audit trail per autofill.
Import / export
CSV / JSON. Import from 1Password, Bitwarden, etc.
Health widget
Weak / expired / compromised passwords surfaced on the dashboard.
Audit per credential
Every view, copy, edit, share, autofill logged with operator + time.
AES-256-GCM with per-tenant master keys. PBKDF2 for user secrets. Master keys in HSM (if configured) or encrypted env. Browser extensions talk to the vault API over OAuth + device attestation.
FAQ.
Where are the keys stored?+
Master keys in HSM (if configured) or encrypted-at-rest env. Never plaintext. User-side PBKDF2-derived for any operation.
Safari extension?+
Yes — iOS and macOS.
Can I enforce rotation?+
Yes, per-folder rotation schedule. Alerts on overdue.