Your vault is encrypted with keys only you hold. We store encrypted blobs — we cannot read your passwords even with full database access.
Go passwordless with FIDO2/WebAuthn passkeys. Works on any device with biometrics — Face ID, Touch ID, Windows Hello.
Built-in TOTP 2FA authenticator. Your second factor is stored encrypted alongside your passwords — one app, everything.
Generate hide-my-email aliases on signup, directly from the vault. Powered by 47mail — no additional account needed.
Real-time Have I Been Pwned integration monitors your stored emails and passwords for known data breaches.
E2EE vault sync across unlimited devices. Offline mode — your vault works without internet, syncs when you reconnect.
Your master passphrase is hashed client-side with Argon2id. It never leaves your device. We cannot recover it.
Your vault is encrypted with AES-256-GCM using a key derived from your master passphrase. Only encrypted blobs are synced.
Only ciphertext hits our servers. No plaintext, no keys, no metadata in the clear. Sync is end-to-end secure.
Your device decrypts the vault locally using your master passphrase. Biometric unlock is a local convenience layer.
No hidden fees. No automatic upsell. Cancel any time.
Zero-knowledge vault for individuals. Unlimited passwords, zero cost.
Shared vaults with granular permissions. Emergency access built in.
Run PassVault on your own server. Docker Compose or Kubernetes.
Get early access to PassVault — or explore the full 47Network ecosystem.
PassVault fits teams that have outgrown browser-saved passwords but aren't ready to deploy Bitwarden or 1Password for Business.
Teams where credentials are shared across contractors, part-time staff, and multiple timezones. PassVault's shared vault with granular access control means a contractor gets exactly the credentials they need — and loses access the moment their engagement ends.
Healthcare, legal, and finance organisations with audit requirements. Every credential access is logged, timestamped, and exportable. GDPR breach notifications can reference exactly which credentials were in scope.
Power users who have graduated from a single browser's password manager but don't need enterprise fleet management. PassVault's zero-knowledge sync works across all devices without trusting the server — ever.
PassVault integrates with 47mail to generate per-service alias email addresses from within the vault. One credential entry, one alias, zero email tracking across accounts.
Technical deep-dives on the architecture and decisions behind PassVault.
The exact cryptographic construction — Argon2id key derivation, AES-256-GCM encryption, and why no master key exists.
PassVault uses Argon2id with 256 MiB memory cost for master password derivation. Here's why Argon2id won and how to tune it.
Every PassVault credential access is logged in an append-only audit trail with SHA-256 chaining. How the forensic audit log architecture works across all 47Network products.
WebAuthn registration and authentication flows, cross-device passkeys, and how PassVault integrates device passkeys as a second factor alongside Argon2id vault encryption.
PassVault uses short-lived JWTs (15 min) issued by 47ID/Keycloak with RS256 signing — token validation against the JWKS endpoint, no secret sharing, and revocation for vault operations.