Pyalm Vault
A zero-knowledge password manager built for developers. Keep your test, company, and personal credentials encrypted end-to-end and neatly segregated by type and company — from a web app and a Chrome extension that share one vault.
A zero-knowledge password manager built for developers. Keep your test, company, and personal credentials encrypted end-to-end and neatly segregated by type and company — from a web app and a Chrome extension that share one vault.
Test logins, staging accounts, company tools, and personal passwords all pile up. Pyalm Vault holds them securely and keeps them separated so the right credential is always one click away.
Your master passphrase never leaves your device. It derives a key (PBKDF2-SHA256, 250k iterations) that encrypts every entry client-side with AES-256-GCM — the server only ever stores ciphertext it cannot read.
Every credential is tagged Test or Real and grouped by Company, with tags and favorites. Jump to “Acme — Real” or “all Test accounts” in one click — filtering happens client-side after decryption.
Store a 2FA secret or otpauth:// URI on any entry and get live 6-digit codes with a countdown — in both the web app and the extension. Your logins and their one-time codes live in one place.
A vault health score plus weak, reused, no-password, and stale filters surface the credentials worth fixing, and a strength meter in the editor grades new passwords as you type.
Generate strong passwords with adjustable length and character classes, or switch to diceware passphrase mode — plus one-click throwaway test credentials that default to the Test tab.
Unlock the web vault with Touch ID or Windows Hello via the WebAuthn PRF extension — device-bound and entirely client-side, so you skip typing the passphrase without weakening the model.
Share a whole company or folder with another Pyalm Vault user over P-256 ECDH. They get a read-only “Shared with me” view and the server still never sees any plaintext.
Export the entire vault to a file sealed with a separate backup password, and import to restore. Deletions go to a Trash you can restore from or purge — nothing is lost to a slip.
A Manifest V3 extension gives you the vault beside your work: quick unlock, URL-matched entries floating to the top, and one-click autofill into login forms on the active tab.
A Bitwarden-style split keeps the server blind: it authenticates you and stores ciphertext, but it never sees your passphrase or your data.
Your master passphrase derives a key on your device. That key unwraps your vault key — held in memory only — so decryption happens entirely in your browser or extension.
Each entry's label, type, company, identity, password, URL, and notes are encrypted before they ever leave you. The server keeps only opaque ciphertext with no readable metadata.
Filtering, Test/Real tabs, company grouping, and search all run client-side after decryption — fast at personal scale, with no plaintext exposed to the backend.