Skip to main content
PassKee logoPassKee
Sign In Create Free Vault
Zero-Knowledge Cloud Password & Secrets Manager

Your Passwords Under Reliable Protection. Always Within Reach.

PassKee safely stores your logins, payment cards, SSH keys, and private notes. Synchronize seamlessly across all your devices with complete client-side privacy—unlocked only by your Master Password and 128-bit Secret Key.

Create Free Vault Sign In to Vault
  • Dual-Lock (Password + 128-bit Secret Key)
  • Client-Side Argon2id & AES-256-GCM
  • Native KeePass (.kdbx) Import & Export
PassKee logoPassKee
Password GUID

Cloud & DevOps

3 items

8 item types: Login • Secure Note • Card • Password • File • Database • SSH Key • Server

New Item

GitHub Organization

Login • Directory: Cloud & DevOps

Share Link

Username / Email

[email protected]

Password (AES-256-GCM)

••••••••••••••••••••

Strong

Website URL

https://github.com/organizations/passkee

Interactive Security Tool

Create Your First Uncrackable Password Right Now

Test our client-side cryptographic generator right on this page. PassKee creates and remembers high-entropy passwords like these for every site you use.

Bulletproof • 131 bits of entropy Crack time: > 500 billion years
k9#mP$9vL2!xR7@qW4&z
20 characters
8 chars 16 chars 32 chars 64 chars
Character Sets

How Long Would It Take Attackers to Crack?

Password1 / 123456 Less than 1 second

Exposed immediately by automated credential-stuffing dictionaries and leaked password lists.

Qwerty2026! ~3 hours

Human-picked patterns with a capital letter, year, and exclamation mark fall quickly to modern GPU clusters.

k9#mP$9vL2!xR7@q > 500 billion years

PassKee generates and remembers unique passwords like this for every account—so you only ever remember one Master Password.

Two-Key Security Model

A Dual Lock for Your Security: Master Password + Emergency Secret Key

A traditional password alone is often not enough. PassKee protects your account with two independent cryptographic secrets: a Master Password (minimum 10 characters with uppercase, lowercase, and digits) known only to you, and a high-entropy Emergency Secret Key generated directly on your device when you create your account.

Even if an attacker discovers your password—or even if encrypted server records were ever exposed—nobody can sign in from a new device or unwrap your Curve25519 (X25519) and AES-256-GCM key envelope without your Emergency Secret Key.

Explore Security Architecture How the Emergency Secret Key Works
Lock 01 • What You Know

Master Password

Minimum 10 characters (upper, lower, digits). Never transmitted to PassKee servers and used for fast Unlock Session after inactivity.

••••••••••••••••
Lock 02 • What You Have

Emergency Secret Key

Generated in your browser at registration (Save Your Emergency Secret Key) and required when signing in on new devices.

PK-NFT6-G4F7-LNRY-TJPU-V7GV-8K2M

256-Bit Master Key (In Browser RAM Only)

Unwraps your AES-256-GCM Vault Key and Curve25519 (X25519) private key locally in browser memory. Automatically zeroed out after 15 minutes of inactivity.

Zero-Knowledge Architecture

Complete Privacy: What You See vs. What Our Server Stores

Your directory names, usernames, passwords, notes, and attachments are encrypted before they leave your browser. Our cloud servers act strictly as blind ciphertext storage.

What You See (On Your Device)

Decrypted locally in volatile browser memory (RAM)

Human-Readable UI

Stripe Merchant Portal

[email protected] • Directory: Banking & Cards

v9$kL2#mP8!q

Production K8s Control Node

10.24.0.15:22 • Directory: Cloud & DevOps

R4!wX7@nQ3#z

Instant search, directory tree, tags, and one-click copy—available only while your session is unlocked.

What Our Server Stores

PostgreSQL blind storage (AES-256-GCM + X25519 bytea blobs)

Sealed Ciphertext

// Encrypted key envelope & credential record on server

"id": "0195f8a2-7c4b-7d3e-9a10-4b8c2e1f6a09",

"encryptedVaultKey": "8f9d2a7e4c1b09f3...7a6e5c4d",

"encryptedPrivateKey": "e19a4b7c0d2f83e1...9c4a7b2d",

"encryptedData": "c41e9b02f7a83d61e590...b28f19c4",

"ciphers": "AES-256-GCM + Curve25519 (X25519)"

Even Website URLs, directory names, and notes are encrypted—we cannot see which services you use.

Side-by-Side Comparison

Why Users Choose PassKee Over Browsers and Offline Files

Combine the uncompromising cryptography of KeePass with the effortless multi-device sync and sharing of a modern cloud workspace.

Capability Browser / Plain Notes Standalone KeePass (.kdbx) PassKee Cloud Vault
Access Across All Devices Keep 8 credential types updated everywhere Tied to one browser ecosystem Manual file syncing & conflicts Instant encrypted cloud sync
Dual-Lock Protection Master Password + Emergency Secret Key No Optional manual keyfile Master Password + Emergency Secret Key
Secure Item Link Sharing 1h / 1d / 7d / 30d expiry & one-time view Plaintext copy in chats Not built-in One-click #fragment links
KeePass (.kdbx) Compatibility Preserve nested directories, tags, and attachments Unencrypted CSV only Native .kdbx file KDBX 3/4 Import & KDBX 4 Backup
Protection Against Forced Reset or Breach Full ownership of cryptographic keys Vulnerable to OS/account profile Yes (Offline file) 100% Zero-Knowledge client keys
KeePass (.kdbx) Import & Backup

Import or Back Up Your KeePass Database in Browser

Already using KeePass or KeePassXC? Open the ⋮ menu next to Current Vault and choose Import — From KeePass (.kdbx). PassKee supports KDBX 3 and KDBX 4 files up to 100 MB while preserving your nested directories, credentials, tags, and file attachments.

  1. 1 Select your .kdbx file & password: Decrypted locally via WebAssembly—your KDBX database password is only used to unlock the file during import.
  2. 2 Re-encrypt with your Vault Key: Every directory, entry, and attachment is sealed with your PassKee AES-256-GCM key.
  3. 3 Backup to KDBX 4 anytime: Use Backup — Export to KeePass (.kdbx) to download an encrypted KDBX 4 backup (archived items are exported into an Archive folder).
Create your vault and import .kdbx
Share a Link to This Item

Share Credentials Safely Without Plaintext Chats

Need to send a login, database credential, or secure note to a colleague or family member? Click Share on any item to generate an end-to-end encrypted link instead of pasting plaintext secrets into Slack, Telegram, or email.

URL Fragment (#) Zero-Knowledge Format

https://passkee.org/share/0195f8a27c4b#8f9d2a7e4c1b09f3a5d6e7f8...
  • The 64-character hex key after # is never transmitted to PassKee servers.
  • Set expiry (1 hour, 1 day, 7 days, 30 days) and optional Can be viewed only once.
  • Attached files are never included in shared links.
Read how #fragment encryption works

Essential Answers

Frequently Asked Questions

Straightforward answers on how your Emergency Secret Key, device sign-in, and KeePass (.kdbx) backups work.

What is the Emergency Secret Key and when is it generated?

Your Emergency Secret Key is a unique 128-bit cryptographic code (formatted as PK-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX) generated directly in your browser when you create your PassKee account. It combines with your Master Password via Argon2id so no one can sign in to your vault from a new device using your password alone. During registration, you copy and confirm that you have saved this Secret Key before proceeding to sign in.

What should I do if I forgot my Master Password or lost my Secret Key?

Because PassKee is built on strict zero-knowledge encryption, our servers never store your Master Password or Secret Key and cannot reset or recover them. If you lost your Secret Key but still have an unlocked session on an authorized device, immediately open Vault Actions (⋮) -> Backup -> Export to KeePass (.kdbx) to save your data, then create a new account. If both your Master Password and Secret Key are lost with no active session, your encrypted vault cannot be decrypted by anyone.

Do I have to enter my Emergency Secret Key every time I unlock my vault?

No. When signing in, check 'Remember Secret Key for quick unlock in this session'. PassKee encrypts your Secret Key in isolated browser sessionStorage using a key derived from your Master Password and Auth Salt via Argon2id. When your session locks after inactivity, the 'Unlock Session' screen only asks for your Master Password.

Ready to Lock Down Your Digital Life?

Create your encrypted vault in under a minute, or browse our full Knowledge Base to learn more about Zero-Knowledge security.

Create Free Vault Open Full Help Center & FAQ