Enclave
Zero-knowledge architecture

The vault for yourdigital existence.

Passwords, passkeys, notes, and secrets—encrypted on your device before they sync. Accessible everywhere, readable by no one but you.

How it protects you

AES-256-GCM

Every vault item sealed locally

Argon2id

Master key hardened on your device

Ciphertext only

Nothing readable reaches the server

01 / Sharing

Share access.Not exposure.

Enclave encrypts a copy for the recipient's public key. Add an expiry or view limit; the server still sees only ciphertext.

Encrypted sharing

Design system credentials

VIEW × 1
Re-encrypted for the recipient
Expires automatically
Plaintext never uploaded

Protected objects

01

Password generator

Strong passwords and memorable passphrases, created locally.

02

Secure notes

Private keys, recovery phrases, and anything else worth protecting.

03

One-time links

Send a secret that expires or burns after it is opened.

04

Authenticator codes

Keep six-digit sign-in codes beside the accounts they protect.

05

Password health

Find weak, reused, and breached credentials without exposing them.

06

Import and export

Move in from leading password managers—and never get locked in.

02 / Everything together

More than passwords.One protected system.

Organize every sensitive object by type and tag. Generate, search, copy, and share without moving secrets outside the encrypted vault.

03 / Developer-ready

Secrets for infrastructure.Without the infrastructure risk.

Group credentials by project and environment. Fetch them with the CLI, inject them into a process, or call the API — everything is decrypted locally, so your server never sees plaintext.

See the developer tools

$ enclave list

acme/api/production/STRIPE_KEY

acme/api/production/DATABASE_URL

$ enclave run -- npm start

# Injects env vars. Nothing written to disk.

CLIREST APIMachine tokensFolder paths

04 / Zero knowledge

Built so we can never see your data.

Your master password derives the encryption key on your device—it never leaves it. Every item is sealed before it syncs, and sharing re-encrypts to the recipient's public key. Without your key, what we store is noise.

Argon2id key derivationAES-256-GCM sealingRSA-4096 sharingk-anonymity breach checks
Read the security model

Your vault, your key

Protect what belongs only to you.