Passkeys
Create and use passkeys in your browser, and on your phone as its passkey provider. They sync, encrypted, to every device.
Everything sensitive, in one place only you can open.
Passwords and passkeys, yes. And SSH keys, API secrets, cards, IDs, Wi-Fi, crypto wallets and whole folders of files. Synced to every device, encrypted so only you can read them. Free, with no ads.
Public alpha: sign-ups are open in the web vault. The apps are coming to the stores. Follow along
Not just a password manager.
A vault for everything sensitive.
If losing it would hurt, or someone reading it would, it belongs here. Every kind of item is encrypted on your device the same way, syncs the same way and shares the same way.
22 kinds of secret, one master password, one Secret Key, one place to look.
- Passwords
- Passkeys
- One-time codes
- Recovery codes
- Masked email
- Wi-Fi networks
- Secure notes
- Payment cards
- Bank accounts
- Crypto wallets
- Licences
- Identities
- Passports and IDs
- Documents
- Safes
- Encrypted files
- SSH keys
- API keys and tokens
- .env files
- Databases
- Certificates
- Your own types
- kinds of secret
- 22
- platforms, one vault
- 8
- key per item, never reused
- 1
- ads or trackers
- 0
We store it.
We can’t read it.
Everything in your vault is encrypted on your device before it syncs. Here’s one login twice: once as you see it, once as our server keeps it. An SSH key, a passport scan or a .env file looks the same to us.
- Website
- github.com
- Username
- [email protected]
- Password
- Lantern-ruby-T7#qv-42
- One-time code
- ––– –––
- Passkey
- github.com, saved 12 Oct 2026
- id
- itm_7f3c9a1e52b84d60
- revision
- 41
- item_key
- AXnq0v3Kc2HcWmZ8yN1pQe7rT4uB0aLsFgD9kJ5xVhR6oI2tYwE
- overview
- AQtR8pW3mZ0yLc5vN2bXh7KdF4sJ9gE1aU6oTqYi3rVwHn8eMx
- details
- AWk2fH9sQ4zR7xLm1cV8bN3pT6yG0dJ5aE2uKoWi9tYhSr4nMe
Signing in, handled.
Every login, passkey and code.
One-time codes
––– –––
Filled right after your password.
Autofill that checks the address
Only on the exact site a login belongs to, and only when you ask.
Breach checks that never see your password
Your device sends only the first 5 characters of a hash, and compares the matches itself. How it works
Masked email
A different forwarding address for every site, through the alias service you choose.
Recovery info
See which email and phone can reset each account, and how many backup codes you have left. If one email is compromised, you know exactly what’s at risk.
Cards and identities
Checkout and sign-up forms, filled. Nothing is processed, only stored encrypted.
Bring everything with you
1Password Bitwarden LastPass Chrome Safari Firefox Proton Pass Dashlane KeePass Authenticator apps
And leave whenever you want, passkeys included.
For developers
Secrets in your code.
Not in your repo.
An SSH agent that asks
Your keys stay in the vault. ssh and git use them through the desktop app, and every signature asks Touch ID, Windows Hello or your password first.
.env files, without the file
Keep environments in the vault and hand them to one command with octapass run. Values can point at other items, so a password lives in one place.
CI that can’t leak your vault
Service accounts give a pipeline read-only access to one shared vault, with a token our server never sees. There’s a GitHub Action and a GitLab template.
A toolkit that stays local
Make certificates and a local CA, sign and read JWTs, hash and encode. Every tool runs on your device.
$ ssh-add -l
256 SHA256:Xq3vR8…k9Rw GitHub signing key (ED25519)
256 SHA256:p0LmT2…7aZe Deploy key (ED25519)
$ octapass run --env "Shop API (production)" -- ./migrate.sh
migrate: 3 applied, database is up to date
$ git commit -S -m "Rotate the billing key"Whole folders, locked.
Not just the password to them.
A Safe is a folder that locks with your vault. While you’re unlocked it’s a folder like any other. Lock, and every file and every name on disk is ciphertext.
- One key per file. Each file is encrypted on its own, and each change gets a new key.
- Names hidden too. On disk a Safe is a flat set of blobs with random names.
- Send files to anyone. Encrypt in the open age format for another Octa Pass user, a passphrase or yourself.
- 2026/return.pdf1.2 MB
- 2026/payslips-q3.pdf640 KB
- passport-scan.jpg3.4 MB
- lease-agreement.pdf860 KB
- receipts.zip18 MB
- accountant.md4 KB
Free. For everyone.
Not a trial.
Octa Pass
$0 forever
- Unlimited items of every kind: logins, keys, cards, IDs and more
- Unlimited devices, synced in real time
- Autofill in browsers, on iPhone, Android, Mac, Windows and Linux
- An SSH agent and secrets for your scripts
- Breach, reuse and weak-password checks
- Encrypted Safes and file encryption
- Family sharing for up to 6 people
- Emergency access and recovery tools
- 1 GB for files and documents
- Export everything, any time
Nothing to set up. Create an account in the web vault today, and the apps sync with it as they reach the stores.
How can it be free?
Your vault is tiny. A whole vault of 500 logins, keys and notes is about a megabyte of encrypted data, so hosting it costs very little.
No ads, and nothing to sell. We can’t read your vault, so there’s no data to profit from even if we wanted to.
Funded in the open. Donations, sponsors and grants will pay for the servers, with the costs published every month.
Sealed before it leaves your hands.
- 1
Two secrets unlock it
Your master password, plus a 128-bit Secret Key that lives only on your devices and in your printed Recovery Kit.
- 2
Your device makes the key
Argon2id turns them into your Account Unlock Key. That key never leaves the device.
- 3
Every item gets its own lock
Each item is encrypted with XChaCha20-Poly1305 under its own random key, sealed by your vault key.
- 4
Only ciphertext travels
Sign-in uses OPAQUE, so your password never crosses the network. Our server only ever holds sealed items.
Our server can see
- Your account email
- How many items you have, and their sizes
- When items change
- Which accounts share a vault
Our server never sees
- Titles, websites or usernames
- Passwords, passkeys, SSH keys or secrets
- Notes, cards, IDs, files or file names
- Your master password or Secret Key
On every device you own.
Where the operating system lets a password manager fill passwords, Octa Pass uses it. Where it doesn’t, the browser extension and an auto-type shortcut fill the gap. The web vault is open now; the apps are built and coming to the stores.
Web vault
Your vault in any browser, with nothing to install.
Chrome, Edge, Brave
Fills and saves logins in the page. Passkeys too.
Coming soonSourceFirefox
The same extension on desktop and Android.
Coming soonSourceSafari
The same extension in Safari on Mac, iPhone and iPad.
Coming soonSourceMac
System AutoFill in Safari and every app. Touch ID.
Coming soonSourceWindows
Extension plus auto-type. Windows Hello.
Coming soonSourceLinux
Extension plus auto-type, on X11 and Wayland.
Coming soonSourceiPhone and iPad
A native app with system AutoFill and passkeys. Face ID.
Coming soonSourceAndroid
A native app with autofill, keyboard suggestions and Credential Manager.
Coming soonSourceTerminal
A CLI for developers: read items, get codes, run commands with secrets.
Coming soonSourceVS Code
Insert secret references, and run commands with the secrets filled in.
Coming soonSourceJetBrains IDEs
The same tools in IntelliJ IDEA and the other JetBrains IDEs.
Coming soonSource
Open source,
so you don’t have to trust us.
Anyone can check the code. The service you use runs the same MIT code that’s published, and it gets an independent security audit before 1.0.
Your own server, if you want one. Companies and tinkerers can run Octa Pass themselves. The same apps connect to it: pick “Self-hosted” at sign-in and enter its address.
No ads. No trackers. Not on this website, not in the apps.
$ docker build -f apps/server/Dockerfile -t octapass-server .
$ docker run -d -p 8080:8080 \
-v octapass-data:/data \
-e OCTAPASS_PUBLIC_URL=https://vault.example.com \
octapass-serverBuilt in the open, one phase at a time.
- Mostly doneFoundations
- BuiltCore and server
- BuiltBrowser extensions
- BuiltDesktop apps
- BuiltMobile apps
- BuiltSharing
- In progressTeams and more
- In progressDeveloper tools and file safe
- Last stepAudit and 1.0
Questions.
Is Octa Pass a password manager?
Yes, and more. It does what you’d expect from a password manager, and keeps the rest of what’s sensitive in the same encrypted vault: SSH keys with an SSH agent, API keys and .env files, certificates, crypto wallets, passports and IDs, Wi-Fi networks, and Safes, folders whose files are encrypted one by one. One master password, one Secret Key, one place to look.
Is Octa Pass really free?
Yes. Unlimited items and devices, family sharing for up to 6 people and 1 GB for files, with no trial period and no ads. It’s funded by donations, sponsors and grants.
Can you see what I store?
No. Your vault is encrypted on your device before it syncs, and the keys never reach our server. That goes for every item and every file, not only passwords. A stolen copy of our database would also need your Secret Key, which we never receive.
What if I forget my master password?
You recover with the recovery code in your Recovery Kit, or through an emergency contact you set up. We can’t reset it for you. That’s the price of a server that can’t read your data.
Why no ads?
Ad code next to your secrets would be a security hole, and an app that holds everything sensitive has to be trusted completely. Octa Pass is funded by donations, sponsors and grants.
Can I use it today?
Yes, as a public alpha: create a free account in the web vault. The apps are built and coming to the stores. The independent security audit comes before 1.0, so don’t rely on Octa Pass alone for anything important yet.
Can I run my own server?
Yes, it’s optional. The server is open source, and the same Octa Pass apps connect to it: choose “Self-hosted” when you sign in and enter your server’s address. Autofill, passkeys and Face ID work the same way.
Can I bring my passwords from another app?
Yes. Octa Pass imports from Chrome, Edge, Firefox, Safari, Bitwarden, 1Password, LastPass, Proton Pass, Dashlane, Keeper, KeePass, authenticator apps and the FIDO Credential Exchange Format. SSH keys come in from ~/.ssh, and .env files from your projects.