# Octa Pass

> Octa Pass is a free password manager for passwords, passkeys, one-time codes, cards and identities on every browser, phone and computer. End-to-end encrypted, synced for you, no ads. Open source, so anyone can check it.

Project status: public alpha. The hosted service is open for sign-ups in the web vault at https://vault.octap.app. The apps are built but not in any app store yet, and nothing has had its external audit. Pages carry a `status` of planned, in-progress, beta or stable.

The docs are also in Arabic under `/ar/docs/`. This index lists the English pages.

Every docs page is also available as raw Markdown by appending `.md` to its URL path, e.g. `/docs/security/encryption.md`.

An agent skill for querying these docs is published at `/skills/octapass-docs/SKILL.md`.

## Introduction

- [Octa Pass documentation](https://octap.app/docs.md): Documentation for Octa Pass, the free, open-source, end-to-end encrypted password manager for passwords, passkeys, TOTP codes, cards and identities. (status: stable)

## Getting started

- [Overview](https://octap.app/docs/getting-started/overview.md): What Octa Pass is, who it is for, how the free hosted service and self-hosting relate, and what you can expect before the first public release. (status: in-progress)
- [Quick start](https://octap.app/docs/getting-started/quick-start.md): The first-run flow for Octa Pass, from creating an account and saving your Recovery Kit to installing the browser extension and importing passwords. (status: in-progress)
- [Recovery Kit](https://octap.app/docs/getting-started/recovery-kit.md): What the Octa Pass Recovery Kit contains, why your Secret Key and recovery code matter, and how to store the kit safely so you never lose your vault. (status: in-progress)
- [Delete your account](https://octap.app/docs/getting-started/delete-account.md): How to permanently delete your Octa Pass account, every password and item in it, and all your devices, plus what happens to backups and shared vaults. (status: in-progress)

## Features

- [Item types](https://octap.app/docs/features/item-types.md): Every item type Octa Pass can store, from logins, passkeys and payment cards to SSH keys, Wi-Fi networks, environments and ID documents, and the fields each one holds. (status: in-progress)
- [Attachments and documents](https://octap.app/docs/features/attachments.md): Keep files with any Octa Pass item, or store them as Document items. Files are encrypted on your device; the server stores ciphertext and its size only. (status: in-progress)
- [Autofill](https://octap.app/docs/features/autofill.md): How Octa Pass fills logins, cards and identities in browsers and apps, how domain matching works, and the safety rules that stop phishing and clickjacking. (status: in-progress)
- [Passkeys](https://octap.app/docs/features/passkeys.md): How Octa Pass creates, stores, syncs and uses passkeys in browsers, iOS, macOS, Android and Windows, and how to move passkeys with the FIDO CXF format. (status: in-progress)
- [TOTP codes](https://octap.app/docs/features/totp.md): How Octa Pass stores and generates two-factor authentication codes (TOTP, Steam Guard), adds them from QR codes and Google Authenticator exports, links them to logins, and fills them after the password. (status: in-progress)
- [One-time codes on a watch](https://octap.app/docs/features/watch.md): Show your one-time codes on Apple Watch or Wear OS. Your phone makes the codes and sends the next 15 minutes; the secrets never leave the phone. (status: in-progress)
- [Password generator](https://octap.app/docs/features/password-generator.md): Generate strong random passwords and memorable passphrases in Octa Pass, with per-site password rules, ambiguity filters and the EFF large wordlist. (status: in-progress)
- [Security dashboard](https://octap.app/docs/features/security-dashboard.md): The Octa Pass security dashboard finds breached, reused and weak passwords, missing 2FA and passkeys, insecure URLs and expiring cards, entirely on your device. (status: in-progress)
- [Sharing](https://octap.app/docs/features/sharing.md): Share passwords safely with Octa Pass using shared vaults with roles, free family plans for up to 6 people, and expiring one-time share links. (status: in-progress)
- [Masked email](https://octap.app/docs/features/masked-email.md): Create a unique forwarding email alias for each account with Octa Pass, using SimpleLogin, addy.io, Firefox Relay, Fastmail, DuckDuckGo or Forward Email. (status: in-progress)
- [Organisations](https://octap.app/docs/features/organisations.md): Run a team on Octa Pass with organisations, groups, policies and shared vaults, while the server and your admins still can't read anyone's passwords. (status: in-progress)
- [Recovery info](https://octap.app/docs/features/recovery-info.md): Record each account's recovery email, recovery phone, backup codes and security questions in Octa Pass, and see your recovery map to spot weak links. (status: in-progress)
- [Single sign-on](https://octap.app/docs/features/single-sign-on.md): Connect Octa Pass to your identity provider with OpenID Connect. SSO adds a sign-in step, and your master password and Secret Key still unlock your vault. (status: in-progress)
- [Emergency access](https://octap.app/docs/features/emergency-access.md): Let a trusted person access your Octa Pass vault in an emergency after a waiting period you control, with view-only or takeover access you can deny at any time. (status: in-progress)
- [Biometric unlock](https://octap.app/docs/features/biometric-unlock.md): Unlock Octa Pass with Face ID, Touch ID, fingerprint, Windows Hello, or your device passcode, PIN or password, using hardware-backed keys on trusted devices. (status: in-progress)
- [Offline access and sync](https://octap.app/docs/features/offline-and-sync.md): How Octa Pass keeps an encrypted local copy of your vault for offline use, syncs changes across devices in real time, and handles edit conflicts safely. (status: in-progress)
- [Use without an account](https://octap.app/docs/features/local-vault.md): Use Octa Pass on one device with no account, no email and no server. Your vault stays on the device, with encrypted backup files and an option to turn on sync later. (status: in-progress)
- [QR codes](https://octap.app/docs/features/qr-codes.md): Show Wi-Fi passwords, contacts, one-time codes and other items as QR codes for other devices to scan, and scan QR codes to add items, all on your device. (status: in-progress)
- [Languages](https://octap.app/docs/features/languages.md): Octa Pass apps come in English and Arabic, laid out right to left in Arabic. They follow your system language, or the one you choose for each device. (status: beta)
- [Two-step sign-in](https://octap.app/docs/features/two-step-sign-in.md): Ask new devices for a code from an authenticator app, a security key or a recovery code after your master password, so a stolen password and Secret Key aren't enough. (status: in-progress)
- [Pinned, recent and frequently used items](https://octap.app/docs/features/quick-lists.md): The lists above your vaults in the sidebar, Recently created, Pinned, Favourites, Frequently used, Recently used and Recently modified, and how Octa Pass counts a use without the server knowing. (status: beta)
- [Sorting and grouping items](https://octap.app/docs/features/sorting-and-grouping.md): Sort item lists by name or date, group them by type, first letter or vault, and show several logins for one website as one row. Each list remembers its choice on each device, in English and Arabic. (status: beta)
- [Website icons](https://octap.app/docs/features/website-icons.md): Items with a website show that site's icon instead of a coloured letter. Icons come through your Octa Pass server, never from other companies, and you can turn them off on each device. (status: beta)
- [Wi-Fi networks](https://octap.app/docs/features/wifi.md): Keep Wi-Fi networks in Octa Pass, see which one you're on and which are in range, import the networks your computer saved, and what each platform allows. (status: in-progress)
- [Environments](https://octap.app/docs/features/environments.md): Keep .env files and environment variables in the vault, give them to Docker, CI, Node, Python and plain shells, and load them in your shell as you move between projects. (status: in-progress)
- [SSH keys](https://octap.app/docs/features/ssh-keys.md): Keep SSH keys in Octa Pass, generate Ed25519, ECDSA or RSA keys, import OpenSSH, PEM and PKCS#8 files, and export private and public keys safely. (status: in-progress)
- [Developer toolkit](https://octap.app/docs/features/developer-toolkit.md): Generate and inspect TLS certificates, keys, JWTs, hashes and encodings on your own device, from the CLI and the Tools section of the apps. (status: in-progress)
- [Encrypting files](https://octap.app/docs/features/file-encryption.md): Encrypt files and folders in the age format for yourself, other Octa Pass users or a passphrase, from the CLI, the desktop app or your file manager, and what secure delete can and can't promise. (status: in-progress)
- [Octa Pass Safe](https://octap.app/docs/features/octa-pass-safe.md): An encrypted folder that locks with your vault, with file contents and names encrypted per file, optional sync through your server, and what each system can show. (status: in-progress)
- [Service accounts](https://octap.app/docs/features/service-accounts.md): Give CI jobs and servers read-only access to one shared vault with a token that never reaches the server, is revocable at any time, and shows every use in your security log. (status: in-progress)
- [Octa Pass Connect](https://octap.app/docs/features/connect.md): A local helper that gives approved programs a secret by octapass:// reference, with per-client approval, a session token, and every secret recorded in your security log. (status: in-progress)

## Import & export

- [Import overview](https://octap.app/docs/import-export/overview.md): Import passwords, passkeys and TOTP codes into Octa Pass from 1Password, Bitwarden, LastPass, browsers, KeePass, Proton Pass and 20+ other sources. (status: in-progress)
- [Import from 1Password](https://octap.app/docs/import-export/from-1password.md): Move from 1Password to Octa Pass with a 1PUX or CSV export, keeping item types, tags, TOTP secrets and notes, and learn what each format preserves. (status: in-progress)
- [Import from Bitwarden](https://octap.app/docs/import-export/from-bitwarden.md): Move from Bitwarden or Vaultwarden to Octa Pass with a JSON, password-protected JSON or CSV export, including folders, cards, identities and TOTP secrets. (status: in-progress)
- [Import from LastPass](https://octap.app/docs/import-export/from-lastpass.md): Move from LastPass to Octa Pass with a CSV export, including secure notes in LastPass's special note formats, then rotate passwords affected by the LastPass breach. (status: in-progress)
- [Import from browsers](https://octap.app/docs/import-export/from-browsers.md): Import saved passwords into Octa Pass from Chrome, Edge, Brave, Opera, Vivaldi, Arc, Firefox and Safari or Apple Passwords using their CSV exports. (status: in-progress)
- [Import from authenticator apps](https://octap.app/docs/import-export/from-authenticator-apps.md): Move TOTP two-factor codes into Octa Pass from Google Authenticator, Aegis, 2FAS, Raivo, andOTP, Ente Auth and other apps, matched to your existing logins. (status: in-progress)
- [Import from KeePass and KeePassXC](https://octap.app/docs/import-export/from-keepass.md): Move from KeePass 2 or KeePassXC to Octa Pass by importing the .kdbx database with its password or key file, or an XML or CSV export. (status: in-progress)
- [Import from Proton Pass](https://octap.app/docs/import-export/from-protonpass.md): Move from Proton Pass to Octa Pass with the ZIP, JSON or CSV export, keeping logins, notes, cards, identities, TOTP secrets, passkeys and alias addresses. (status: in-progress)
- [Import from Dashlane](https://octap.app/docs/import-export/from-dashlane.md): Move from Dashlane to Octa Pass with the CSV export (a ZIP of CSV files) or an older JSON export, keeping logins, notes, cards, IDs and personal info. (status: in-progress)
- [Import from Enpass](https://octap.app/docs/import-export/from-enpass.md): Move from Enpass to Octa Pass with the JSON export, keeping logins, cards, identities, notes, tags, TOTP secrets, password history and custom fields. (status: in-progress)
- [Import from Keeper](https://octap.app/docs/import-export/from-keeper.md): Move from Keeper to Octa Pass with a JSON or CSV export, including folders, shared folders, one-time codes, payment cards, contacts and other record types. (status: in-progress)
- [Import from NordPass](https://octap.app/docs/import-export/from-nordpass.md): Move from NordPass to Octa Pass with a CSV export, including folders, extra websites, custom fields, credit cards, personal info and secure notes. (status: in-progress)
- [Import from RoboForm](https://octap.app/docs/import-export/from-roboform.md): Move from RoboForm to Octa Pass with a CSV export, including folders, extra form fields, TOTP keys, bookmarks and safenotes. (status: in-progress)
- [Import from Aegis](https://octap.app/docs/import-export/from-aegis.md): Move two-factor codes from Aegis Authenticator to Octa Pass with a plain or password-protected vault export, matched to the logins you already have. (status: in-progress)
- [Import from 2FAS](https://octap.app/docs/import-export/from-2fas.md): Move two-factor codes from 2FAS Authenticator to Octa Pass with a plain or password-protected .2fas backup, matched to the logins you already have. (status: in-progress)
- [Import from andOTP](https://octap.app/docs/import-export/from-andotp.md): Move two-factor codes from andOTP to Octa Pass with a plain or password-encrypted JSON backup, matched to the logins you already have. (status: in-progress)
- [Import a CXF file](https://octap.app/docs/import-export/from-cxf.md): Move logins, passkeys, one-time codes, notes, cards and identities into Octa Pass from any password manager that exports the FIDO Credential Exchange Format (CXF). (status: in-progress)
- [Import from Raivo OTP](https://octap.app/docs/import-export/from-raivo.md): Move two-factor codes from Raivo OTP to Octa Pass with its password-protected ZIP export, or the JSON inside it, matched to the logins you already have. (status: in-progress)
- [Import from Ente Auth](https://octap.app/docs/import-export/from-ente-auth.md): Move two-factor codes from Ente Auth to Octa Pass with the plaintext export or the password-encrypted JSON, matched to the logins you already have. (status: in-progress)
- [Export](https://octap.app/docs/import-export/export.md): Export your full Octa Pass vault at any time as an encrypted file with your attachments, plaintext JSON, CSV or the FIDO Credential Exchange Format, with no lock-in and no fees. (status: in-progress)
- [Import from Zoho Vault](https://octap.app/docs/import-export/from-zoho-vault.md): Move from Zoho Vault to Octa Pass with a General CSV or Zoho Vault CSV export, including custom fields, folders, tags and one-time codes. (status: in-progress)
- [Import from Avira](https://octap.app/docs/import-export/from-avira.md): Move from Avira Password Manager to Octa Pass with a CSV export, including both of Avira's username columns. Everything is read on your device. (status: in-progress)
- [Import from Norton](https://octap.app/docs/import-export/from-norton.md): Move from Norton Password Manager to Octa Pass with its CSV export of logins and notes. Everything is read on your device and nothing is uploaded. (status: in-progress)
- [Import from McAfee True Key](https://octap.app/docs/import-export/from-mcafee.md): Move from McAfee True Key to Octa Pass with its CSV export, including logins and, where the file has them, cards and notes. Read on your device. (status: in-progress)
- [Import from Kaspersky](https://octap.app/docs/import-export/from-kaspersky.md): Move from Kaspersky Password Manager to Octa Pass with its text export or a CSV, including websites, applications, other accounts and notes. (status: in-progress)

## Platforms

- [Platform support matrix](https://octap.app/docs/platforms/support-matrix.md): Which browsers, operating systems and devices Octa Pass supports today, with autofill, passkey, one-time code and unlock capabilities, and what each app can do. (status: in-progress)
- [Browser extension](https://octap.app/docs/platforms/browser-extension.md): The Octa Pass browser extension for Chrome, Edge, Firefox and other browsers, covering autofill, passkeys, TOTP, unlocking, building it from source and reproducible builds. (status: in-progress)
- [Desktop apps](https://octap.app/docs/platforms/desktop.md): The Octa Pass desktop apps, a native app on macOS with system AutoFill and a Tauri app on Windows and Linux with auto-type, device unlock, quick access, a tray icon and sharing. (status: in-progress)
- [Mobile apps](https://octap.app/docs/platforms/mobile.md): The Octa Pass apps for iPhone, iPad and Android, with system autofill, passkey providers, Wi-Fi Connect, QR codes and Face ID or fingerprint unlock. (status: in-progress)
- [CLI](https://octap.app/docs/platforms/cli.md): The octapass command-line tool for reading items, one-time codes and generated passwords, managing SSH keys, keeping .env files and environment variables, passing secrets to scripts with octapass:// references, and importing and exporting, with a session kept in the OS keyring. (status: in-progress)
- [IDE extensions](https://octap.app/docs/platforms/ide-extensions.md): The Octa Pass extensions for VS Code and JetBrains IDEs browse your references, insert octapass:// links, and run commands with secrets injected, without ever reading a secret value. (status: in-progress)

## Security

- [Security overview](https://octap.app/docs/security/overview.md): How Octa Pass protects your vault with zero-knowledge, end-to-end encryption, a Secret Key, OPAQUE login and phishing-safe autofill, and how it is audited. (status: in-progress)
- [Encryption and keys](https://octap.app/docs/security/encryption.md): The Octa Pass key hierarchy and algorithms in detail, including Argon2id, HKDF, XChaCha20-Poly1305, X25519, Ed25519, the Secret Key and per-item keys. (status: in-progress)
- [Authentication](https://octap.app/docs/security/authentication.md): How signing in to Octa Pass works with OPAQUE so the server never sees your password, plus sessions, two-step sign-in, new-device alerts and rate limits. (status: in-progress)
- [Account recovery](https://octap.app/docs/security/account-recovery.md): How to change your Octa Pass master password, or reset a forgotten one with the recovery code from your Recovery Kit, without any backdoor. (status: in-progress)
- [Threat model](https://octap.app/docs/security/threat-model.md): The Octa Pass threat model, covering database breaches, malicious servers, phishing, clickjacking, lost devices, supply chain attacks and quantum computing. (status: in-progress)
- [What the server sees](https://octap.app/docs/security/what-the-server-sees.md): An honest list of the metadata the Octa Pass server can see, such as email, item counts and timestamps, and everything it can never see, like passwords and notes. (status: in-progress)
- [Breach checks](https://octap.app/docs/security/breach-checks.md): How Octa Pass checks your passwords against known data breaches with k-anonymity and padding so no password leaves your device, plus opt-in email breach alerts. (status: in-progress)
- [Post-quantum sharing and the key log](https://octap.app/docs/security/post-quantum-and-key-log.md): How Octa Pass seals shared keys with hybrid X25519 and ML-KEM-768, how the key log shows a swapped public key, and what neither protects against. (status: in-progress)

## Self-hosting

- [Self-hosting overview](https://octap.app/docs/self-hosting/overview.md): Run your own Octa Pass server with every feature of the hosted service, using a single Docker container with SQLite or PostgreSQL and S3-compatible storage. (status: in-progress)
- [Connect the apps to your server](https://octap.app/docs/self-hosting/connect-apps.md): Self-hosted Octa Pass uses the same official apps and extensions. Choose Self-hosted at sign-in, enter your server address, and optionally enable push sync. (status: in-progress)
- [Run with Docker](https://octap.app/docs/self-hosting/docker.md): Run the Octa Pass server and web vault in one Docker container behind your own HTTPS proxy, with Docker Compose, invites, backups and health checks. (status: in-progress)
- [Configuration](https://octap.app/docs/self-hosting/configuration.md): Configure a self-hosted Octa Pass server with OCTAPASS_* environment variables, covering URLs, data directory, database, email, signups, CORS, security keys and the admin CLI. (status: in-progress)
- [Backups](https://octap.app/docs/self-hosting/backups.md): Back up and restore a self-hosted Octa Pass server safely, why encrypted backups can be stored anywhere, and how users can keep their own vault exports. (status: in-progress)
- [Masked email relay](https://octap.app/docs/self-hosting/relay.md): Run the Octa Pass masked email relay, an optional mail forwarder that passes mail through without storing it. Setup, DNS records, limits and what it can see. (status: in-progress)

## Developers

- [Architecture](https://octap.app/docs/developers/architecture.md): How Octa Pass is built, with a shared Rust core compiled to WebAssembly and native bindings, TypeScript and React interfaces, Tauri apps and an axum sync server. (status: in-progress)
- [Sync API](https://octap.app/docs/developers/sync-api.md): The Octa Pass sync API v1: OPAQUE login, tokens, master password changes and resets, revision-based sync, item writes, live notifications, sharing, families, organisations, single sign-on, share links and emergency access. (status: in-progress)
- [Octa Pass Connect API](https://octap.app/docs/developers/connect-api.md): The local HTTP API tools use to ask Octa Pass for a secret by reference, with per-client approval and a session token. (status: in-progress)

## Contributing

- [Contributing](https://octap.app/docs/contributing/overview.md): How to contribute to Octa Pass through design review, documentation, code, translations and security research, plus the DCO sign-off and the MIT licence terms. (status: stable)
- [Development setup](https://octap.app/docs/contributing/development-setup.md): Set up the Octa Pass monorepo locally with Node.js, pnpm and Rust, run the documentation website, and learn where each part of the project lives. (status: in-progress)
- [Writing docs](https://octap.app/docs/contributing/writing-docs.md): How to write and structure Octa Pass documentation, including front matter, status badges, asides, link style, Markdown twins, llms.txt and changelog entries. (status: stable)
- [Docs for AI agents](https://octap.app/docs/contributing/ai-agents.md): How AI agents and LLM tools can read the Octa Pass docs through llms.txt, Markdown twins and the octapass-docs agent skill, and the rules agents follow in the repo. (status: stable)
- [Translations](https://octap.app/docs/contributing/translations.md): How Octa Pass is translated, where the strings and Arabic docs live, how Weblate fits in, the rules for right-to-left text, and how to add a new language. (status: in-progress)

## Reference

- [FAQ](https://octap.app/docs/reference/faq.md): Answers to common questions about Octa Pass, covering cost, why there are no ads, privacy, forgotten master passwords, self-hosting, platforms and audits. (status: stable)
- [Glossary](https://octap.app/docs/reference/glossary.md): Definitions of the terms used in the Octa Pass documentation, from Account Unlock Key and Secret Key to OPAQUE, passkeys, TOTP, CXF and k-anonymity. (status: stable)
- [Roadmap](https://octap.app/docs/reference/roadmap.md): The Octa Pass roadmap to 1.0, with what is built today, what each phase delivers, how long the rest should take, and the public alpha, beta and audit milestones. (status: stable)
- [Licence](https://octap.app/docs/reference/license.md): Octa Pass is licensed under the MIT License, which covers the core, apps, server and website; contributions are signed off under the DCO. (status: stable)

## Documentation Sets

- [Abridged documentation](https://octap.app/llms-small.txt): a compact version of the documentation for Octa Pass, with non-essential content removed
- [Complete documentation](https://octap.app/llms-full.txt): the full documentation for Octa Pass

## Notes

- The complete documentation includes all content from the official documentation
- The content is automatically generated from the same source as the official documentation

## Optional

- [Changelog](https://octap.app/changelog/): Dated project changes
- [Agent skill](https://octap.app/skills/octapass-docs/SKILL.md): Skill that teaches AI agents to search and cite these docs
- [Web vault](https://vault.octap.app): The hosted service, open as a public alpha
- [Source code](https://github.com/octap-app/octapass): MIT monorepo