KalmPass
A password manager that cannot read your passwords.
Your vault is encrypted in your browser, using a key made from a master password we never receive. What arrives on our servers is ciphertext. There is no copy of your key in our database, no override, and nothing worth stealing.
Unlimited passwords, free, forever. No card needed. Import from LastPass in about a minute.
Two keys open your vault. We hold neither.
Everything you save is encrypted under one random vault key. That key is then wrapped twice, and only the wrapped copies are stored. Either secret below unlocks it. Nothing on our side does.
- You knowMaster password
- Stretched through a million rounds of PBKDF2 in your browser. Never transmitted, in any form.
- You keepRecovery Key
- 125 bits of randomness, issued once when you sign up. Save it offline. It is how you get back in if the password goes.
- ResultYour vault key
- Unwrapped in your browser by either secret, used to decrypt your items there, and discarded when you close the tab.
- We storeCiphertext
- Two wrapped copies of a key we cannot unwrap, and a pile of encrypted blobs. Item names, addresses and usernames are all inside them.
What you get.
A generator worth trusting
Passwords and passphrases drawn from the browser's cryptographic random source. Rejection sampling removes the modulo bias that quietly weakens most generators, and you see the real entropy rather than a coloured bar.
Authenticator codes
Keep your two-factor codes next to the password they belong to. Seeds are encrypted with everything else and codes are computed on your device, so we never hold either half of a login.
Vault health
Finds weak passwords, reused ones, and anything untouched for over a year. Pro adds a check against Have I Been Pwned's list of passwords exposed by other websites, using k-anonymity, so no password is ever sent anywhere.
Leaving is easy
Import a CSV from LastPass, Bitwarden, 1Password or Chrome. Export an encrypted backup whenever you like. Your data is yours and we do not make the door hard to find.
It locks itself
Idle for a while and the keys are dropped from memory. Copied passwords clear from the clipboard on a timer. Nothing is written to disk, so closing the tab really is the end of it.
Nothing borrowed
Zero runtime dependencies. No CDN, no analytics, no tracking, not one line of third-party code. A great many attacks on software begin inside somebody else's package. There is no somebody else here.
Pricing.
Free is not a trial. Keep as many passwords as you like, for as long as you like, with the same encryption Pro gets. What Pro buys is more devices and the exposed password check. We are not going to ration your safety and charge you for the rest.
Free
$0
- Unlimited passwords
- 3 devices
- Authenticator codes
- Password generator
- Encrypted import and export
- Weak and reused password report
- Exposed password check
Pro
$12 a year
- Unlimited devices
- Exposed password check
- Everything in Free
- Priority support
A dollar a month. Cancel any time and your vault stays exactly as it is.
The awkward questions.
What if I forget my master password?
You use your Recovery Key. It opens your vault and lets you set a new password with nothing lost. If you lose the password and the Recovery Key, your data is genuinely gone: no key exists anywhere that can decrypt it. That is the direct cost of us not holding one, and we would rather say so than pretend otherwise.
Could you be forced to hand over my passwords?
We can be compelled to produce what we hold, which is encrypted blobs and an account email. We cannot be compelled to produce a key we have never had. Your master password is not ours to give up.
What is stored on your servers?
Nothing anyone can read. Your items are encrypted in your browser under your key, then encrypted again by our servers under a key kept outside the database. Even email addresses are stored as keyed hashes rather than in the clear.
Can I get my data out?
Whenever you like, in one click. An export is a single encrypted file, protected by a passphrase you choose, and it restores anywhere. Your passwords are yours. Nothing about KalmPass is built to make leaving difficult.
Is there a browser extension?
Yes, for Chrome, Edge, Brave and Firefox, with Safari to follow. It fills the login on the page in front of you, copies authenticator codes, and warns you before filling a site the login was not saved for. Out of the box it can reach kalmpass.net and nothing else, so it runs no code on a page until you press Fill. If you want it to offer to save new logins, you switch that on and your browser asks you to allow it. Store listings are on the way. Until then, install it from the repository.