Valid Vault
A password manager for Chromium browsers and Android that works without a cloud service, an account, or a sync server.
Your logins and other secrets are encrypted on your device under a key only you can unlock. When you move them to another device, they travel as ciphertext over a QR code or an encrypted file, and both sides merge the changes.
Get Valid Vault
Android
The Android app is built from the same code as the extension. A Google Play release is in preparation, and the app can be built from source today.
Several browsers, one vault
Uni-Vault links every browser on a computer to one encrypted vault file, so a login saved in one appears in the others.
Features
Unlock
Fingerprint or device PIN through the browser's platform authenticator or the Android Keystore, with a master password as the fallback. The vault locks itself after the idle time you choose, and on the phone also when you leave the app.
Autofill
Login and personal info fields get a small V tag. You pick what to fill, and only that value is placed in the field. Nothing is ever copied to the clipboard.
Two-factor codes
A login can hold its 2FA code. Valid Vault shows the live code and fills it into the site's code box, on the site the login belongs to.
Password generator
New password fields get their own V that fills a strong random password into both boxes, following the site's length and character rules.
QR transfer
One device shows an animated QR code and the other scans it. The receiver can join at any frame and finishes shortly after it has read enough of them.
Backups
You are the custodian. Every device is a live copy, and the vault and the protected key export as separate encrypted files you can keep on a USB drive as cold copies, with no server holding anything.
Import
Brings logins and 2FA codes from CSV exports and from Bitwarden, 1Password, Dashlane, and Samsung Pass files, read entirely on the device.
Crypto wallets
Seed phrases have their own section with a separate unlock and offline word checking, and they are never filled into web pages.
Private browser
On Android, a Chromium browser with tracker blocking, link cleaning, an optional Tor mode, and a full wipe when it closes. Its own phishing and malware protection stands in for Google Safe Browsing.
Security model
The complete model, including the reasoning behind each design choice, is published with the source code.
- A random 256-bit master key encrypts the vault with AES-256-GCM, and it is wrapped separately under each unlock method.
- Unwrapping the key is the check itself. No password hash is stored anywhere to attack.
- Passwords are stretched with PBKDF2-SHA256 at 600,000 rounds, and new master passwords are checked against common passwords.
- A key leaving a device is wrapped under a passphrase, plus three additional answers, at 1,000,000 rounds.
- Web pages never receive the master key or a 2FA setup key, only the single value you chose to fill.
- Logins, wallets, and bookmarks are each sealed as one encrypted blob, so storage reveals no site names or usernames.
- Logins fill only on the site address they were saved for, so a look-alike phishing site gets nothing, with no block list needed.
- Every change runs the full test suite in the open on GitHub, including fuzz tests of the vault file, key file, and QR parsers.
For organizations
Valid Vault keeps every password on your own devices, with no vendor server holding a copy. For clinics, contractors, and any team that treats cloud-stored credentials as a liability, your data stays under your control.
Deployment help
Setting up Valid Vault across your staff's browsers and Android phones, with a plan for backups and for moving vaults between devices.
Direct support
Questions and issues go straight to the engineer who wrote the code.
Free for internal use
The license lets any organization run Valid Vault internally at no cost. Deployment help and support are available on top of that.