Your passwords and API keys, encrypted before they leave your device.
nopwd is a vault for logins, API keys, TOTP codes and notes, for developers and small technical teams. Use it from the browser, the extension or the command line. The server only ever stores ciphertext.
GitHub
OpenAI API key
- TOTP
AWS root
Postgres production
Deploy runbook
GitHub
github.comOne vault, three ways in
Every surface opens the same encrypted vault. Nothing is synced in the clear between them.
Web
Search and edit items, import from 1Password, check passwords against known breaches and set up your recovery kit.
Send a credential as a one-time link that expires after a set number of views.
Stripe live key
nopwd.dev/s/Qm3xVt9aLk#k=Yx2r…
Browser extension
Fills logins on the site you are on and shows the TOTP code next to the password.
It also works as a passkey authenticator, so passkeys live in your vault.
GitHub
CLI
Read a secret in a script, or run a command with your items set as environment variables.
It signs in with the same master password and decrypts on your machine.
$ nopwd get "OpenAI API key"sk-proj-7f3aJ2c9…$ nopwd list --tag work
What the server stores, and what stays on your device
Keys are derived and used in your browser, extension or CLI. The server holds what it needs to sync and to check a login.
On your device
Never leaves it
- Master password
- Used locally to derive keys and to prove you know it. It is never sent.
- Master key and vault keys
- Derived with Argon2id (64 MiB, 3 passes, 4 lanes), then split with HKDF-SHA256.
- Decrypted items
- Logins, API keys, TOTP seeds and notes exist in plaintext only in memory here.
- Recovery code
- 160 random bits shown once. It lives on your paper kit.
- Share link key
- Sits after the # in the URL. Browsers don't send the fragment to servers.
On the server
Useless without your master password
- Encrypted items
- AES-256-GCM ciphertext, one blob per item, with an HMAC-SHA256 tag.
- Wrapped vault key
- Your vault key, encrypted under a key derived from your master password.
- SRP salt and verifier
- Lets the server check a SRP-6a login proof without learning the password.
- Email hash
- A SHA-256 hash of your email is the account lookup key.
- Recovery blob
- Vault keys encrypted under the recovery code, and a hash of the code's auth key.
If your device is compromised
Malware that can read your screen or memory sees what you see. Encryption doesn't help there.
If your master password is weak
Someone with a copy of the database can guess offline. Argon2id slows that down but doesn't stop it. Registration requires a password rated Strong.
If you forget the password
We can't reset it. The recovery kit you save at sign-up is the only way back in.
The client and server code is open source under the MIT license, so you can check all of this.
Secrets for scripts and CI
The CLI decrypts on your machine with the same master password. Pick the form that fits how your code reads secrets.
nopwd get prints one field. Use it in a pipeline or a shell function.
nopwd run starts your command with items injected as environment variables, or with nopwd:// references swapped for real values.
With --via-socketthe process asks for a secret when it needs it, so it doesn't sit in the environment where ps can show it.
$ nopwd login$ nopwd get "GitHub token"ghp_8Kd2…# other fields: nopwd get Postgres --field username$ nopwd list --json
How it compares
1Password and Bitwarden are mature, audited products with mobile apps and larger teams behind them. This is where nopwd is the same, different or behind, as of this writing.
| Feature | nopwd | 1Password | Bitwarden |
|---|---|---|---|
| Client-side encryption of the vault | Yes | Yes | Yes |
| Client source code available | Yes, MIT | No | Yes, GPL and AGPL |
| Independent security audit published | Not yet | Yes | Yes |
| Master password key derivation | Argon2id, 64 MiB, 3 passes | PBKDF2-HMAC-SHA256, plus a Secret Key | PBKDF2-SHA256 by default, Argon2id optional |
| Login protocol | SRP-6a, password hash not sent | SRP | Derived hash of the password sent to the server |
| Command-line tool | Yes | Yes | Yes |
| Run a command with secrets in its environment | Yes, nopwd run | Yes, op run | Separate product (Secrets Manager) |
| Browser extension and passkeys | Yes | Yes | Yes |
| Mobile apps | No | Yes | Yes |
| SSO, SCIM and enterprise admin | No | Yes | Yes |
Pricing
Free while paid plans are in the works.
Free
€0
Create your vault- Unlimited vault items
- Sync across all devices
- Chrome extension
- Team vault for up to 3 members
- Open source