# Octa Pass: Everything sensitive, in one place only you can open. > Octa Pass keeps everything sensitive in one end-to-end encrypted vault: passwords, passkeys and one-time codes, and also SSH keys, API secrets, .env files, cards, IDs, Wi-Fi, crypto wallets and encrypted folders. Free, synced to every device, no ads. Open source, so anyone can check it. Source: https://octap.app/ Web vault: https://vault.octap.app Code: https://github.com/octap-app/octapass (MIT) Docs: https://octap.app/docs.md LLM index: https://octap.app/llms.txt Passwords and passkeys, yes. And SSH keys, API secrets, cards, IDs, Wi-Fi, crypto wallets and whole folders of files. Synced to every device, encrypted so only you can read them. Free, with no ads. Public alpha: sign-ups are open in the web vault. The apps are coming to the stores. [Create a free account](https://vault.octap.app) ## We store it. We can’t read it. Everything in your vault is encrypted on your device before it syncs. Here’s one login twice: once as you see it, once as our server keeps it. An SSH key, a passport scan or a .env file looks the same to us. ## Signing in, handled. Every login, passkey and code. - **Passkeys**: Create and use passkeys in your browser, and on your phone as its passkey provider. They sync, encrypted, to every device. - **One-time codes**: Filled right after your password. - **Autofill that checks the address**: Only on the exact site a login belongs to, and only when you ask. - **Breach checks that never see your password**: Your device sends only the first 5 characters of a hash, and compares the matches itself. [How it works](https://octap.app/docs/security/breach-checks.md) - **Masked email**: A different forwarding address for every site, through the alias service you choose. - **Recovery info**: See which email and phone can reset each account, and how many backup codes you have left. If one email is compromised, you know exactly what’s at risk. - **Cards and identities**: Checkout and sign-up forms, filled. Nothing is processed, only stored encrypted. - **Bring everything with you**: And leave whenever you want, passkeys included. ## Free. For everyone. Not a trial. - Unlimited items of every kind: logins, keys, cards, IDs and more - Unlimited devices, synced in real time - Autofill in browsers, on iPhone, Android, Mac, Windows and Linux - An SSH agent and secrets for your scripts - Breach, reuse and weak-password checks - Encrypted Safes and file encryption - Family sharing for up to 6 people - Emergency access and recovery tools - 1 GB for files and documents - Export everything, any time Nothing to set up. Create an account in the web vault today, and the apps sync with it as they reach the stores. ### How can it be free? - **Your vault is tiny.** A whole vault of 500 logins, keys and notes is about a megabyte of encrypted data, so hosting it costs very little. - **No ads, and nothing to sell.** We can’t read your vault, so there’s no data to profit from even if we wanted to. - **Funded in the open.** Donations, sponsors and grants will pay for the servers, with the costs published every month. ## Sealed before it leaves your hands. 1. **Two secrets unlock it**: Your master password, plus a 128-bit Secret Key that lives only on your devices and in your printed Recovery Kit. 2. **Your device makes the key**: Argon2id turns them into your Account Unlock Key. That key never leaves the device. 3. **Every item gets its own lock**: Each item is encrypted with XChaCha20-Poly1305 under its own random key, sealed by your vault key. 4. **Only ciphertext travels**: Sign-in uses OPAQUE, so your password never crosses the network. Our server only ever holds sealed items. ### Our server can see - Your account email - How many items you have, and their sizes - When items change - Which accounts share a vault ### Our server never sees - Titles, websites or usernames - Passwords, passkeys, SSH keys or secrets - Notes, cards, IDs, files or file names - Your master password or Secret Key [Everything the server stores, in full](https://octap.app/docs/security/what-the-server-sees.md) ## On every device you own. Where the operating system lets a password manager fill passwords, Octa Pass uses it. Where it doesn’t, the browser extension and an auto-type shortcut fill the gap. The web vault is open now; the apps are built and coming to the stores. - **Web vault**: Your vault in any browser, with nothing to install. [Open web vault](https://vault.octap.app). [Source](https://github.com/octap-app/octapass/tree/main/apps/web) - **Chrome, Edge, Brave**: Fills and saves logins in the page. Passkeys too. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/extension) - **Firefox**: The same extension on desktop and Android. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/extension) - **Safari**: The same extension in Safari on Mac, iPhone and iPad. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/safari) - **Mac**: System AutoFill in Safari and every app. Touch ID. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/macos) - **Windows**: Extension plus auto-type. Windows Hello. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/desktop) - **Linux**: Extension plus auto-type, on X11 and Wayland. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/desktop) - **iPhone and iPad**: A native app with system AutoFill and passkeys. Face ID. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/ios) - **Android**: A native app with autofill, keyboard suggestions and Credential Manager. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/android) - **Terminal**: A CLI for developers: read items, get codes, run commands with secrets. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/cli) - **VS Code**: Insert secret references, and run commands with the secrets filled in. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/vscode) - **JetBrains IDEs**: The same tools in IntelliJ IDEA and the other JetBrains IDEs. Coming soon. [Source](https://github.com/octap-app/octapass/tree/main/apps/jetbrains) [Platform details and limits](https://octap.app/docs/platforms/support-matrix.md) ## Open source, so you don’t have to trust us. - **Anyone can check the code.** The service you use runs the same MIT code that’s published, and it gets an independent security audit before 1.0. - **Your own server, if you want one.** Companies and tinkerers can run Octa Pass themselves. The same apps connect to it: pick “Self-hosted” at sign-in and enter its address. - **No ads. No trackers.** Not on this website, not in the apps. [How the apps connect to your own server](https://octap.app/docs/self-hosting/connect-apps.md) ### Project links - [GitHub repository](https://github.com/octap-app/octapass) - [MIT licence](https://github.com/octap-app/octapass/blob/main/LICENSE) - [Contributing](https://github.com/octap-app/octapass/blob/main/CONTRIBUTING.md) - [Security policy](https://github.com/octap-app/octapass/blob/main/SECURITY.md) - [Issues](https://github.com/octap-app/octapass/issues) - [Self-hosting guide](https://octap.app/docs/self-hosting/overview.md) ## Built in the open, one phase at a time. - **Foundations**: Mostly done - **Core and server**: Built - **Browser extensions**: Built - **Desktop apps**: Built - **Mobile apps**: Built - **Sharing**: Built - **Teams and more**: In progress - **Developer tools and file safe**: In progress - **Audit and 1.0**: Last step [The full roadmap](https://octap.app/docs/reference/roadmap.md) ## Questions. ### Is Octa Pass a password manager? Yes, and more. It does what you’d expect from a password manager, and keeps the rest of what’s sensitive in the same encrypted vault: SSH keys with an SSH agent, API keys and .env files, certificates, crypto wallets, passports and IDs, Wi-Fi networks, and Safes, folders whose files are encrypted one by one. One master password, one Secret Key, one place to look. ### Is Octa Pass really free? Yes. Unlimited items and devices, family sharing for up to 6 people and 1 GB for files, with no trial period and no ads. It’s funded by donations, sponsors and grants. ### Can you see what I store? No. Your vault is encrypted on your device before it syncs, and the keys never reach our server. That goes for every item and every file, not only passwords. A stolen copy of our database would also need your Secret Key, which we never receive. ### What if I forget my master password? You recover with the recovery code in your Recovery Kit, or through an emergency contact you set up. We can’t reset it for you. That’s the price of a server that can’t read your data. ### Why no ads? Ad code next to your secrets would be a security hole, and an app that holds everything sensitive has to be trusted completely. Octa Pass is funded by donations, sponsors and grants. ### Can I use it today? Yes, as a public alpha: create a free account in the web vault. The apps are built and coming to the stores. The independent security audit comes before 1.0, so don’t rely on Octa Pass alone for anything important yet. ### Can I run my own server? Yes, it’s optional. The server is open source, and the same Octa Pass apps connect to it: choose “Self-hosted” when you sign in and enter your server’s address. Autofill, passkeys and Face ID work the same way. ### Can I bring my passwords from another app? Yes. Octa Pass imports from Chrome, Edge, Firefox, Safari, Bitwarden, 1Password, LastPass, Proton Pass, Dashlane, Keeper, KeePass, authenticator apps and the FIDO Credential Exchange Format. SSH keys come in from ~/.ssh, and .env files from your projects. Octa Pass is a free, encrypted home for everything sensitive, funded by donations, sponsors and grants. No ads. No trackers. Its code is open source under the [MIT License](https://github.com/octap-app/octapass/blob/main/LICENSE).