No. Everything is encrypted on your device with a key derived from your master password before it's ever synced. We only store ciphertext and could not decrypt it even if compelled to.
Use your 28-character recovery key, generated when you signed up, to regain access. If you've also lost that, your data is unrecoverable by design — no one, including us, holds a backdoor. We strongly recommend storing your recovery key offline.
Exclusively in ISO 27001-certified data centres within the European Union (Frankfurt and Sofia), under GDPR. We never transfer vault data outside the EU.
Yes. Our cryptographic core and infrastructure undergo independent penetration testing, and we align with SOC 2 Type II and ISO 27001. Summary reports are available to Business customers under NDA.
Devices & sync
Native apps for iOS, Android, macOS, Windows and Linux, plus browser extensions for Chrome, Firefox, Safari, Edge and Brave, and a full web app. Every plan includes unlimited devices.
Yes. Your vault lives on-device, so you can read and edit items with no connection. Changes sync automatically, encrypted, when you're back online.
Absolutely. We support one-click import from 60+ apps and browsers, plus CSV and JSON. You can also export your full vault anytime — no lock-in.
Sharing & teams
Shares are end-to-end encrypted. You can share individual items or whole collections, set expiry dates, and revoke access at any time. Recipients don't even need an account for one-off links.
Yes, on the Business plan: SAML and OIDC single sign-on, SCIM user provisioning, an admin console, and detailed audit logs.
Billing
Yes — free forever, unlimited passwords and devices, with the same encryption as paid tiers. See the pricing page for details.
We offer a 30-day money-back guarantee on all paid plans, no questions asked. Just email us within 30 days of purchase.