Secret Box

No company holds
your passwords. You do.

Secret Box is an offline, encrypted password manager and private-data vault. No account. No cloud. No telemetry. Your vault is a file on your device that only your master password can open — and there is no server that could leak it, because there is no server.

100% offline AES-256-GCM No account Mac · Windows · Linux · Android · iOS
Get Secret Box — $9.99 Free browser extension

Free up to 12 entries on every platform · one-time payment unlocks unlimited + sync · lifetime v1 licence · unlimited devices · launch price, going to $19.99 · buying for someone else? Enter their email at checkout and the licence arrives in their name

Secret Box vault in dark theme, showing entries with folders and 2FA badges

Everything in one encrypted place

Passwords are the start. Secret Box is built for the whole drawer of things you can't afford to lose.

🔑

Passwords & a serious generator

Length 4–128, per-class rules, exclude look-alikes, no repeats, no sequences — with honest explanations when your rules are impossible instead of quietly weakening them.

🕐

Offline 2FA codes

Store TOTP secrets and generate the six-digit codes right in the vault, with a countdown. Works with no signal at all.

🪪

Documents & photos

Licence numbers, API keys, PINs, recovery codes — plus scans and photos. Images are downscaled automatically and stripped of GPS and camera metadata before they're stored.

🩺

Password health

Finds weak, short, reused, old and expired passwords entirely on your device. No hashes are sent anywhere — because nothing is sent anywhere.

🧯

Recovery Kit

A one-time recovery code, printable as an emergency sheet, resets a forgotten master password. Without it, nobody — including us — can open your vault.

🔄

Sync through your own cloud

Point the desktop app at a folder iCloud Drive, Google Drive, OneDrive or Dropbox already syncs. Devices merge entry by entry. Your provider holds ciphertext it cannot read — there is no Secret Box server.

📦

Backups you control

Encrypted .secretbox backups you can verify without restoring, and a portable copy that carries your vault to any machine.

See it

Entry detail with a live 2FA code and countdown
Live 2FA codes, concealed fields, password history
Password generator with rules
Generator with every rule you'd expect
Password health report
Offline password-health report
Vault in light theme
Light and dark, following your system

Why this is different

Most password managers ask you to trust a company. This one asks you to trust math you can verify yourself.

Free browser extension

Save and fill logins in Chrome, Edge, Firefox and Safari — free, no licence needed. It lives in the side panel next to the page you're logging into.

Chrome Edge Firefox Safari

The extension keeps your vault inside one browser profile. The apps make it a file you own — on your desktop, your phone, a USB stick.

One price. Once.

No subscription. No account. Install on every device you own.

LAUNCH PRICE
$19.99$9.99
one-time · lifetime v1 licence
  • Apps for macOS, Windows, Linux, Android and iPhone/iPad
  • All v1 updates, forever
  • Unlimited installs — no device counting, no activation server
  • Encrypted backups & portable copies
  • Works permanently offline
Buy Secret Box

Your licence key is emailed instantly and verified offline — it never phones home.

Questions worth asking

What happens if I forget my master password?

Your one-time recovery code opens the vault and lets you set a new password. If you have neither the password nor the code, the vault is mathematically unrecoverable — not by support, not by us, not by anyone. That is the direct consequence of nobody but you holding the key. Print the recovery sheet.

How does it sync between my devices?

The desktop apps sync through your cloud: point Secret Box at a folder iCloud Drive, Google Drive, OneDrive, Dropbox or Syncthing already syncs, and devices merge changes entry by entry. Your provider only ever holds ciphertext it cannot read. Elsewhere — extensions, phones — move data with an encrypted backup or a portable copy. There will never be a Secret Box server holding your vault.

Is it open source?

The application ships as readable JavaScript — you can inspect exactly what it does, which is the point. See the repository link in the footer for the current source and licence terms.

Why should I trust a small independent product with my passwords?

Trust the design, not the vendor: there is no server to breach, no account database to leak, and no network traffic to intercept. Verify it in DevTools in ten seconds. A breach of us cannot expose your vault, because we never have it.

Does it replace my browser's built-in password manager?

It runs alongside it. Secret Box cannot read your browser's password database (no extension can), and it never disables or modifies it. Move your data in with the built-in CSV importer for Chrome, Edge, Firefox, Safari/Apple Passwords, Brave, Opera and Vivaldi.

What if you disappear tomorrow?

Nothing breaks. The apps keep working offline forever, your licence verifies without a server, and your data exports in an open, documented encrypted format you already have on disk.