The vault for yourdigital existence.
Passwords, passkeys, notes, and secrets—encrypted on your device before they sync. Accessible everywhere, readable by no one but you.
AES-256-GCM
Every vault item sealed locally
Argon2id
Master key hardened on your device
Ciphertext only
Nothing readable reaches the server
01 / Sharing
Share access.Not exposure.
Enclave encrypts a copy for the recipient's public key. Add an expiry or view limit; the server still sees only ciphertext.
Encrypted sharing
Design system credentials
Protected objects
Password generator
Strong passwords and memorable passphrases, created locally.
Secure notes
Private keys, recovery phrases, and anything else worth protecting.
One-time links
Send a secret that expires or burns after it is opened.
Authenticator codes
Keep six-digit sign-in codes beside the accounts they protect.
Password health
Find weak, reused, and breached credentials without exposing them.
Import and export
Move in from leading password managers—and never get locked in.
02 / Everything together
More than passwords.One protected system.
Organize every sensitive object by type and tag. Generate, search, copy, and share without moving secrets outside the encrypted vault.
03 / Developer-ready
Secrets for infrastructure.Without the infrastructure risk.
Group credentials by project and environment. Fetch them with the CLI, inject them into a process, or call the API — everything is decrypted locally, so your server never sees plaintext.
See the developer tools$ enclave list
acme/api/production/STRIPE_KEY
acme/api/production/DATABASE_URL
$ enclave run -- npm start
# Injects env vars. Nothing written to disk.
04 / Zero knowledge
Built so we can never see your data.
Your master password derives the encryption key on your device—it never leaves it. Every item is sealed before it syncs, and sharing re-encrypts to the recipient's public key. Without your key, what we store is noise.
Your vault, your key