Valid Vault - local, encrypted password manager

Overview

Most password managers keep your vault on their servers. That makes their servers a target, and your passwords are only as safe as someone else's infrastructure.

Valid Vault keeps everything on your own device, encrypted. There is no account to create and no company holding a copy, so there is nothing to breach, subpoena, or sell. When you want your vault on another device, you move it yourself, as ciphertext, over a QR code or an encrypted file.

It runs as a browser extension for Chromium browsers, with an Android app built from the same code. Logins, personal details, private notes, crypto wallet seed phrases, and bookmarks all live in one encrypted vault.

Core Features

Password Generator

New password fields get an inverted V. One click fills both the new and confirm boxes with a random password that follows the site's rules. Length ranges from 16 up to 64, set in Settings.

Click-to-Fill Autofill

Login, password, and personal info fields get a small V tag. Click it and pick what to fill. Nothing is ever filled without your click.

Fingerprint Unlock

Windows Hello fingerprint or device PIN on the extension, hardware-backed biometrics on Android, with your master password as the fallback.

Previous Password Safety Net

Change a password and the old one is kept as a labeled backup with one-click restore, in case the site never took the change.

Save As You Go

Personal Info

Name, phone, address, and ranked emails, filled into signup and address forms from one encrypted profile.

Crypto Wallets

Seed phrases by wallet and account, checked word by word against the standard 2048-word list, fully offline. Words only show while you choose to show them.

Encrypted Bookmarks

Save a page from the popup and find it in a searchable side panel. Unlike browser bookmarks, nothing about them is readable at rest.

Misc Credentials

Wi-Fi passwords, license keys, and other secrets, organized by category.

Auto-Lock

Locks itself after the idle time you choose, from 10 seconds to 2 hours. Only real mouse, scroll, click, and key activity keeps it open.

How it Works

One random 256-bit master key encrypts your vault. That key is never stored as is. It is wrapped separately under each unlock method you set up: your password (PBKDF2-SHA256 at 600,000 iterations), your fingerprint or device PIN, and on Android a hardware-backed Keystore key.

Unlocking is the act of unwrapping. A wrong password simply fails to open the key, because the AES-GCM authentication tag is the only check. There is no password hash stored anywhere for an attacker to test guesses against.

Sealed at rest

Website logins are sealed as one AES-256-GCM blob, so no site name, username, or timestamp is readable from the database
Crypto wallets and bookmarks are each sealed the same way, with a fresh random IV on every write
A damaged or unrecognized vault row is refused outright, never treated as empty and written over

Kept away from web pages

The master key lives only in the extension's background, in memory, and is cleared on lock
Web pages only ever receive the one value you clicked to fill, never the key and never the vault
Unlocking from a page opens a separate Valid Vault window, so your password and fingerprint are never typed into the site
Seed phrases and bookmarks are never sent to any web page at all

Valid Vault makes no network requests. Every script ships inside the extension, with no remote code, no analytics, and no tracking.

Moving Between Your Devices

There is no sync server. You carry your vault from one device to another yourself, and it travels as ciphertext the whole way.

Share the key once. The first device shows your master key as a QR code, wrapped under a passphrase and three security questions you choose, stretched with 1,000,000 PBKDF2 rounds.
Unlock it on the new device. The receiving device scans it and must enter the passphrase and all three answers before the key can be used.
Share the vault. Share Vault streams your encrypted vault as an animated QR code, or Export Vault saves it as a file.
Merge. The receiving device merges by timestamp. The newest edit wins, and deletes carry across.

A photographed vault QR is ciphertext. A photographed key QR is useless without the passphrase and answers. A stolen key file is inert on its own.

The Mission

Your passwords should belong to you. Valid Vault keeps them with you.

A cloud password manager asks you to trust a company, its servers, its staff, and every future owner of its business. Valid Vault removes that trust from the picture entirely.

Local First: the vault is created, encrypted, and stored on your own device
Nothing to Breach: no servers and no accounts means no central pile of vaults for anyone to steal
Nothing to Sell: no analytics, no telemetry, no advertising, no data of yours ever sent anywhere
Open Source: every line of code is public and can be audited, forked, and built yourself
Self-Contained: no Google SDKs, no CDNs, no outside services in the code path

Into the Future

Phone parity (v0.8.x): the Android app gains the protected key format, Personal Info, bookmarks, crypto wallets, and the password generator
Scanner reliability (v0.8.2): faster, steadier QR scanning across real cameras, plus a bookmarks QR share
Autofill hardening: broader matching across more sites and form styles

Every release keeps the same rule: your data stays encrypted on your devices, and nothing about new features changes how it is protected.

Install

Chrome Web Store: listing coming soon.

From a release: works today in Chrome, Brave, Edge, and other Chromium browsers.

Download the latest release from GitHub and unzip it.
Open your browser's extensions page (chrome://extensions) and turn on Developer mode.
Load unpacked and choose the extension folder.
Open the popup and set a master password to create your vault.

Build from source

# Clone and build the web bundle
git clone https://github.com/HiImRook/valid-vault-password-manager.git
cd valid-vault-password-manager
node build.js

# Android (optional)
npm install
npx cap sync
npx cap open android

Beta: Valid Vault is under active testing. Keep an Export Vault backup and your key file somewhere safe. A lost master key, passphrase, and answers cannot be recovered by anyone.