The server keeps every box locked and not one key.
Your master password never leaves your device. Everything else hangs from it, one key opening the next step and nothing more. The server stores ciphertext it cannot open, and that is not a setting anyone can turn off.
Four steps, and none of them happens on the server.
- You type your master password. It is not sent anywhere, not even encrypted.
- It becomes a key through a function that is slow on purpose: annoying once, and for anyone trying millions of passwords it turns hours into centuries.
- That key opens your private key; your private key opens a collection key; the collection key opens the item key, and only then does the content appear in the clear.
- Sharing a collection of two thousand secrets means wrapping one key, not re-encrypting two thousand items. That is why there are three levels and not two.
Four surfaces over a single core.
The data format, the URL matching and the sync protocol live in one shared package. A second implementation is a second chance to get it wrong.
- Web application: organization administration, collections, permissions, audit and editing.
- Android app: look up, copy, generate TOTP, autofill and unlock with biometrics.
- Browser extension: the only surface that sees the address you are visiting, and it does not report it to the server.
- A CLI for automation, with no local replica: an unattended credential with a copy on disk is a leak waiting for the disk to be stolen.
Permission is granted on the collection, and you always see where it comes from.
Grants go to a person or to a group, and the effective permission is the higher of the two. There is no explicit deny: if a subset must not see something, that something belongs in another collection.
- “use” autofills, copies and generates the TOTP without showing the value on screen.
- “view” also reveals and exports.
- “edit” also creates, edits and deletes items in the collection.
- “manage” also grants and revokes permissions on that collection.
Four things Vault cannot do, and will not start doing.
- We cannot recover your master password. If you lose it and have no other way to unlock, the content is gone.
- The server does not search inside a secret or render one into an email. Everything that needs plaintext happens on your device.
- The “use” permission is an exposure barrier, not a cryptographic one: if the client can autofill, the client has the value. It reduces the glance over your shoulder and does not contain an adversary.
- An Owner can grant themselves a collection: that is organization administration, and preventing it would leave the organization with no way out. What we do instead is record it, notify the other Owners and flag the collection for rotation.
Musubi Vault
Vault Free
To try it properly with a small team, without cutting anything out of the cryptography.
Free
- Up to 3 people
- No cap on collections, items or devices
- Web, Android and browser extension
- 30 days of audit history
Vault Team
RecommendedFor a team that shares credentials and needs to know who reached what.
$3per person per month
- No cap on people
- Groups: joining or leaving is one operation, not twenty
- Share with someone outside, with an expiry and a view limit
- 3 service accounts for automation
- 365 days of audit history
- Email support, answered within 2 business days
Vault Business
For when the audit trail has to last years and automation carries its own credentials.
$6per person per month
- Everything in Vault Team
- No cap on service accounts
- 3 years of audit history
- Audit export
- Rotation and exposure notices
- Email support, answered within 1 business day