KalmPass
A password manager that cannot read your passwords.
Your vault is encrypted in your browser, using a key made from a master password we never receive. What arrives on our servers is ciphertext. There is no copy of your key in our database, no override, and nothing worth stealing.
Free for 50 items. No card needed. Import from LastPass in about a minute.
Two keys open your vault. We hold neither.
Everything you save is encrypted under one random vault key. That key is then wrapped twice, and only the wrapped copies are stored. Either secret below unlocks it. Nothing on our side does.
- You knowMaster password
- Stretched through a million rounds of PBKDF2 in your browser. Never transmitted, in any form.
- You keepRecovery Key
- 125 bits of randomness, issued once when you sign up. Save it offline. It is how you get back in if the password goes.
- ResultYour vault key
- Unwrapped in your browser by either secret, used to decrypt your items there, and discarded when you close the tab.
- We storeCiphertext
- Two wrapped copies of a key we cannot unwrap, and a pile of encrypted blobs. Item names, addresses and usernames are all inside them.
What you get.
A generator worth trusting
Passwords and passphrases drawn from the browser's cryptographic random source. Rejection sampling removes the modulo bias that quietly weakens most generators, and you see the real entropy rather than a coloured bar.
Authenticator codes
Keep your two-factor codes next to the password they belong to. Seeds are encrypted with everything else and codes are computed on your device, so we never hold either half of a login.
Vault health
Finds weak passwords, reused ones, and anything untouched for over a year. Pro adds breach checking against Have I Been Pwned using k-anonymity, so no password is ever sent anywhere.
Leaving is easy
Import a CSV from LastPass, Bitwarden, 1Password or Chrome. Export an encrypted backup whenever you like. Your data is yours and we do not make the door hard to find.
It locks itself
Idle for a while and the keys are dropped from memory. Copied passwords clear from the clipboard on a timer. Nothing is written to disk, so closing the tab really is the end of it.
Nothing borrowed
Zero runtime dependencies. No CDN, no analytics, no tracking, not one line of third-party code. A great many breaches of this kind begin inside somebody else's package. There is no somebody else here.
Pricing.
The encryption is the same on both plans. Pro buys capacity, not safety. We are not going to sell you your own security.
Free
£0
- 50 items
- 2 devices
- Authenticator codes
- Password generator
- Encrypted import and export
- Weak and reused password report
- Breach monitoring
Pro
£2 a month
- Unlimited items
- Unlimited devices
- Breach monitoring
- Everything in Free
- Priority support
Cancel any time. Your vault stays readable on Free. We never delete items.
The awkward questions.
What if I forget my master password?
You use your Recovery Key. It opens your vault and lets you set a new password with nothing lost. If you lose the password and the Recovery Key, your data is genuinely gone: no key exists anywhere that can decrypt it. That is the direct cost of us not holding one, and we would rather say so than pretend otherwise.
Could you be forced to hand over my passwords?
We can be compelled to produce what we hold, which is encrypted blobs and an account email. We cannot be compelled to produce a key we have never had. Your master password is not ours to give up.
What if KalmPass is breached?
Someone with our entire database gets ciphertext. Your items are encrypted in your browser under your key, then encrypted again by our servers under a key kept outside the database. Even email addresses are stored as keyed hashes rather than in the clear.
What if KalmPass disappears?
Export an encrypted backup. It is one file, protected by a passphrase you choose, and it restores without us. We would rather you had one than depended on us being here forever.
Is there a browser extension?
Not yet. The web vault works on every device, installs as an app from your browser, and copies to the clipboard with an auto-clear timer. Autofill is the next thing we want to build.