Y-Secret-PassAutofill without phishing
Fills only on an exact domain match and only when you click. Look-alike addresses and hidden trap fields get nothing.
Version 0.9.8 · Chrome and Edge
Your passwords stay with you
Your vault is encrypted on your computer. An account syncs it across your devices and with your colleagues, yet the server only ever sees ciphertext.
Coming soon to the Chrome Web Store
How it is protected
- The server never sees passwords
- No telemetry
- English and Russian interface
- 0
- passwords or keys the server can see
- 128 MiB
- of memory to derive the key with Argon2id
- AES-256
- GCM for every item and file
- 15
- item categories from templates
Features
Everything you need from a password manager
An email account with two-step verification; encryption happens only on your device. No ads, no telemetry.
15 item categories
Logins, cards and bank accounts, identities for forms, passports, Wi-Fi, servers, API keys, licenses, notes and your own templates.
Popup and big window
List and item side by side. The full-screen window adds vaults, tags, favorites, archive, a 30-day trash and bulk actions.
Security check
An overall score and issues: weak, reused and old passwords, missing 2FA, expired cards, addresses without HTTPS.
Passwords and passphrases
A generator of random passwords and passphrases from the EFF word list, with strength in bits.
2FA codes
One-time codes right in the item, and filling them on the sign-in page.
Vaults
“Personal”, “Work” and any others under one master password, each with its own key.
Fingerprint unlock
A fingerprint, device PIN or security key instead of the master password between its entries.
Move in, move out
Import from 1Password, Bitwarden, LastPass, Chrome, Edge and Firefox. Export to Bitwarden JSON or CSV.
Sync
One vault on all your devices. Changes from different computers merge item by item.
For teams
An organization with employees, offices and shared vaults. Each employee is confirmed by comparing five words, so nobody can swap their key unnoticed.
Rights and departures
An employees × vaults matrix, vault key rotation when someone leaves, access recovery and an organization audit log.
Popup
Everything you need in one window
List and item side by side. Search by title, site, username and tags finds an item from the first letters; passwords and notes never enter the search.
- 2FA codes refresh right in the item
- Fill on click or with Ctrl+Shift+L
- Fully usable from the keyboard
Security check
See what to fix first
An overall score from 0 to 100 and six kinds of issues. Click a kind to list only those items, click an item to open it.
- Weak, reused and old passwords
- Missing 2FA, expired cards and documents
- Computed on your device, without breach databases
Generator
Passwords you never have to remember
Random characters or a passphrase from the EFF word list — easy to type on any keyboard.
- Strength in bits for the chosen settings
- Cryptographic source of randomness
- Fills the password into sign-up forms
Security
Built so only you can read your data
Encryption happens on your device. The key lives only in memory, and only while the vault is open.
Argon2id + AES-256-GCM
The key is derived from your master password with Argon2id using 128 MiB of memory. The master password and keys are never stored.
Keyfile
Add a keyfile and the vault will not open without it, even with the right password.
A server without keys
The server stores only ciphertext and a hash of the sign-in key. The extension talks to it alone — the browser blocks everything else. No analytics, no remote code.
Snapshots and backup
Previous versions of the vault on disk, an encrypted backup and a Recovery Kit PDF — to get back in if you forget the master password.
Sync goes through your Y-Secret-Pass account: the server receives the same encrypted file — without the master password or keys. Sign-in is by email with two-step verification, and you can delete the account in settings.