Everything you need. Nothing you don't.
A complete password manager that respects your privacy. Every feature built with security-first architecture.
Smart Autofill
Fills your credentials in one click. Detects login forms, multi-step flows (Google, Apple), credit cards, and identity fields.
Password Generator
Generate strong random passwords or memorable passphrases. Configurable length, character sets, inline in any form.
TOTP Authenticator
Built-in 2FA code generator with animated countdown. Auto-fills OTP fields. No separate authenticator app needed.
Zero-Knowledge
Your master password never leaves your device. OPAQUE protocol means even our servers never see your credentials.
Device Management
See all connected devices, revoke access instantly. Trusted devices skip 2FA for 30 days. Full control.
Cards & Identities
Store credit cards, secure notes, and identity info. Autofill payment forms securely (HTTPS only).
Import & Export
Migrate from Bitwarden, 1Password, or Chrome in seconds. Export your data anytime — it's yours.
Breach Detection
Check passwords against HaveIBeenPwned using k-anonymity. Your password never leaves your device — not even a hash.
6 layers of defense in depth
Security isn't a feature — it's the architecture. Every layer is designed so that compromising one doesn't compromise the rest.
OPAQUE (RFC 9807)
Password-authenticated key exchange. Your master password is never transmitted — not even hashed.
AES-256-GCM
Military-grade authenticated encryption. Every vault item encrypted with a unique IV.
Argon2id KDF
Memory-hard key derivation (64 MiB, 3 iterations). Resists GPU/ASIC brute-force attacks.
Dual-Wrap Keys
Symmetric key encrypted under both device key and account key. Lose one, keep the other.
HMAC-SHA256 Sessions
Sessions are signed server-side. Even if Redis is compromised, sessions can't be forged.
Replay Protection
Monotonic request counter per session. Prevents replay attacks even with intercepted tokens.
287 automated tests · 161 backend (pytest) + 126 extension (Vitest) · 0 known vulnerabilities · Security score: 9.5/10
How we compare
| Feature | SandPass | Bitwarden | 1Password | LastPass |
|---|---|---|---|---|
| Zero-knowledge encryption | — | |||
| OPAQUE protocol (no password transmitted) | — | — | — | |
| Open-source extension | — | — | ||
| Built-in TOTP authenticator | ||||
| Breach detection (HIBP) | ||||
| Smart autofill (multi-step) | — | |||
| No data breaches | — | |||
| Free tier | — |