Open source · Zero-knowledge · Audit-friendly

LastPass
was breached.
Here's one that can't be.

A password vault that lives entirely in your browser. No cloud. No account. No servers to target. One HTML file — free for individuals, licensed for teams.

Launch the Vault — Free Get Team License
AES-256Encryption
310KPBKDF2 rounds
0Network calls
<80 KBFile size
🔒AES-256-GCM
✓Zero-knowledge
🔐
PassForge
Local Zero-Knowledge Vault
Offline
🐙
GitHub
dev@studio.io
••••••••
🔵
Google Workspace
admin@company.com
••••••••
🎨
Figma
design@team.co
••••••••
💳
Chase Business
treasury account
••••••••
4 entries · encrypted🔒 AES-256-GCM
0PBKDF2 Iterations
0AES Key Length
0Network Calls
0Client-side Only
The uncomfortable truth

Every password manager
is a target. Most prove it.

Cloud vaults encrypt your data and put it on a server — a globally-accessible archive of everyone's most sensitive secrets. That's not a flaw in their implementation. It's the model. Attackers know it too.

Aug '22
LastPass source code stolen. Used to target developer credentials and access customer environments.
Breach
Dec '22
LastPass customer vaults exfiltrated. Millions of encrypted vaults in attacker hands, being cracked offline.
Breach
Jan '23
Norton credential stuffing. 6,450 password manager accounts compromised directly.
Breach
Ongoing
Cloud vaults remain high-value targets for nation-state actors. The target only grows.
Risk
☁️
Cloud Vault
Server exists · Can be breached
VS
💻
PassForge
No server · Nothing to breach
Cloud vaults require trusting a third party with your most sensitive data
Even encrypted vaults can be stolen and cracked offline at leisure
A vendor breach exposes every customer simultaneously
PassForge has no server — there is literally nothing to steal
Your vault lives only on your device, under your full control
Remote breach is architecturally impossible

The only vault that can't be breached is one with no server to breach.

That's not a workaround — it's the architecture. Your master key never leaves your head. Your vault never leaves your device. There's no cloud to attack.

How it works

Up and running
in 30 seconds.

No installation. No email confirmation. No loading screen. Open the file, set your key, start saving passwords.

🗝
01
Set your master password
One password. Never stored anywhere. It derives a 256-bit key through 310,000 PBKDF2 rounds — the hardest standard legally available.
🗂
02
Save your credentials
Every entry is AES-256-GCM encrypted before it touches disk. The built-in generator creates cryptographically random passwords in one click.
⚡
03
Access anywhere, always
Copy, autofill, or export. Works on any device with a browser — phones, air-gapped laptops, USB drives. No connectivity required.
Features

Everything you need.
Nothing you don't.

No telemetry. No upsell prompts. No features held hostage behind a higher tier. The free version is the full version.

AES-256-GCM Encryption
Authenticated encryption via the browser's native Web Crypto API. The same standard used by banks and governments — no custom crypto, no shortcuts.
310K-Round Key Derivation
PBKDF2-SHA256 at 310,000 iterations. The OWASP 2023 recommendation. Makes brute-forcing your master password computationally punishing.
Cryptographic Generator
Configurable length and character sets, seeded with crypto.getRandomValues. Generates stronger passwords than any human would invent.
Autofill Simulation
A built-in demo environment shows exactly how credentials populate login forms — useful for training, client demos, and product walkthroughs.
Encrypted Export & Import
Back up your vault as an encrypted JSON. Still protected by your master key — safe to sync over any channel you already trust.
Single-File Distribution
One HTML file. No server, no installer, no update daemon. Put it on a USB stick or an air-gapped machine. It works everywhere, forever.
Under the hood

Security you can
verify yourself.

No "trust us." Every line of crypto is in one HTML file you can open in a text editor right now.

Zero network requests. Verifiable.
Open DevTools → Network. The only outbound call is the Tailwind CDN for styling. Zero fetches with your data, ever.
Master password never persisted
Used once per session to derive the encryption key, then gone. Not in localStorage. Not in a cookie. Not anywhere.
Authenticated encryption (GCM)
Tampering with a single byte of the vault causes decryption to fail loudly. Bit-flip attacks and silent corruption are not possible.
Fresh IV on every save
Each encryption generates a new 96-bit IV. Saving identical vaults produces completely different ciphertexts — no pattern leakage.
Browser-native Web Crypto only
No third-party libraries. All primitives through window.crypto.subtle — hardware-accelerated, non-extractable keys.
passforge.html — Crypto.deriveKey()JavaScript
1// PBKDF2 → AES-GCM key (verbatim from source)
2const deriveKey = async (password, salt) => {
3 const keyMaterial = await
4 crypto.subtle.importKey(
5 'raw',
6 new TextEncoder().encode(password),
7 'PBKDF2', false, ['deriveKey']
8 );
9
10 return crypto.subtle.deriveKey(
11 {
12 name: 'PBKDF2', salt,
13 iterations: 310000, // OWASP 2023
14 hash: 'SHA-256'
15 },
16 keyMaterial,
17 { name: 'AES-GCM', length: 256 },
18 false, // non-extractable
19 ['encrypt', 'decrypt']
20 );
21};
How it stacks up

Different by design.

PassForge isn't trying to replace 1Password for large enterprise teams. It's for everyone who wants a vault they actually control.

FeaturePassForgeLastPass1PasswordBitwarden
No server to breach✓✕✕Self-host
No account required✓✕✕✕
Fully offline✓✕✕Self-host
Single auditable file✓✕✕✓
AES-256 encryption✓✓✓✓
Free forever✓Limited✕Limited
Custom white-label build✓✕✕✕
Seamless cloud syncManual✓✓✓

Honest take: if you need SSO and shared vaults for 200 people, use 1Password. If you want a vault you fully control, can audit in an afternoon, and can run anywhere with nothing to breach — that's PassForge.

Pricing

Free for you.
Priced for your company.

The vault will always be open-source and free. What teams pay for is the branded build, commercial license, and direct support.

Community
For individuals, developers, and privacy-minded humans.
$0
Free forever · MIT licensed · No limits
Launch the Vault
  • Full AES-256-GCM vault — zero limits
  • Password generator included
  • Encrypted export & import
  • Full source, fully auditable
  • Community support via email
Most Popular for Teams
Team License
For startups and internal teams. Branded, licensed, supported.
$299
One-time · No per-seat · No renewals
Get Team License
  • Everything in Community
  • Your logo & brand colors applied
  • Commercial license for internal use
  • Email support · 48h SLA
  • Delivered in 5 business days
Custom Builds

Your brand. Your rules.
Built on PassForge.

Need something tailored? We take the PassForge engine — the encryption, the zero-knowledge architecture, the single-file deployment — and wrap it in your brand's identity. Your logo, your colors, your product name. Ship it to your team or clients. Still no server. Still nothing to breach.

Full white-label — logo, palette, fonts, name
Custom features — SSO stubs, audit logs, policies
Source handoff — you own the code outright
Security brief — threat model & crypto rationale
Compliance docs — SOC 2, GDPR, DPA on request
Fast turnaround — most builds ship in 5–7 days
Custom builds from $1,500. Most projects land between $1,500–$4,000 depending on scope. Reply to every inquiry within 1 business day.

Request a Quote

We reply within 1 business day.
✓ Request received — we'll reply within 1 business day.
Why teams choose PassForge over cloud vaults
No vendor lock-in
Full source handoff included
One-time cost, not recurring
No "what if they get breached?"
Common Questions

The questions
worth asking.

How is this different from just forking the open-source repo?
You can fork it — MIT permits that. What companies pay for isn't the code, it's everything around it: a commercial license removing attribution requirements, a branded build that doesn't look like a dev project, compliance docs your CISO can hand to auditors, and a named human who responds in four hours. That's the gap between "cool open-source tool" and "vendor we can actually deploy."
Will this pass our security review?
Honestly — better than most products do. Reviewers love PassForge because there's almost nothing to review: no servers, no APIs, no third-party SDKs, no network egress. The entire codebase is one file any engineer can read in an afternoon. We provide a security brief, threat model, and cryptographic rationale on request.
Is this actually as secure as 1Password or LastPass?
Cryptographically, yes — they all use the same primitives. The difference is attack surface. Those services have servers, support portals, and API endpoints, any of which can fail. PassForge has none. What you trade in convenience, you gain in blast radius: there's nothing remote for attackers to compromise.
What if I forget my master password?
Your vault is unrecoverable. That's not a design flaw — it's the security model. If there were a reset mechanism, there'd be a backdoor. Write your master password somewhere physical until it's memorized. Use a memorable passphrase (four random words) rather than a random string.
How do I sync between my laptop and phone?
Manually — export encrypted JSON from one device, import on the other. Because the export is still encrypted with your master password, you can pass it over any channel you already trust: iCloud Drive, Dropbox, email, USB. Building a sync layer would require a server, and that breaks the threat model.
Does clearing browser data delete my vault?
Yes — clearing site data removes the vault from localStorage. Always export an encrypted backup before clearing. Private/incognito windows also don't persist data between sessions, so use PassForge in a regular browser window.

Take your passwords
off the cloud.

Free for you. Licensed for your team. White-labeled for your company. Same architecture — no servers, no compromises, no monthly invoice.

Launch PassForge — Free Custom Builds →
Free tier: no signup, no email, no card  ·  Custom builds: reply within 1 business day