The password manageryour team owns.
End-to-end encrypted passwords and keys for small teams and their agents. One click to deploy, on your own Cloudflare.
"vaultId""vlt_4f9c2a7e""wrappedKey""""data"""
Even the name is encrypted. Type to see it change.
Everything your team shares.In one calm place.
Vaults for every team
A private vault for each person. Shared vaults for everything else.
⌘K to anything
Copy a password without opening it. The clipboard clears in 90 seconds.
Every kind of secret
Logins with one-time codes, API keys, SSH keys and notes.
Agents use your secrets.They never see them.
Coding agents, scripts and CI get values at runtime. Nothing sits in plain text.
bun test api · just now- 1
Reference, don't paste
Your .env holds vauly:// references. Nothing in it can leak.
DATABASE_URL=vauly://itm_7Gk2qXb9 - 2
Run through vauly
Values go straight into the process, masked in its output.
vauly run -- bun test api - 3
A person says yes
Each new item waits for someone to allow it, once or for an hour. Pause an agent anytime.
- How agents work →
Fills where you sign in.Saves what you type.
- Choose vauly's mark in any login field to fill.
- Sign in somewhere new and it offers to save.
- The site can't read the menu. It's vauly's own frame.
- Linearalex@acme.exampleFill
- Linear (admin)ops@acme.example
Forgot your password?
Small things,done properly.
- 2weak passwordsReview
- 1used in two placesReview
- 3seen by someone who leftReview
Password health
Weak, reused and exposed passwords, worked out on your device.
Two-step login
A code from your phone, with recovery codes for a bad day.
Share links
Send one item to anyone. It expires, and the server can't open it.
- Alex copied the password for GitHub2m
- Claude Code used Postgres · staging8m
- Riley revealed Office Wi-Fi1h
- Jordan shared Figma3h
- Alex removed Sam from Engineering1d
Every use, on the record
Reveals, copies, shares and agent runs, in one activity log.
Hard to lose things
Thirty days to undo a delete. Old passwords stay under Earlier.
Move in from anywhere
Import from 1Password, Bitwarden, LastPass, KeePass, your browser and more, on your device. Export any time.
Light and dark, ⌘K everywhere, and it installs on your phone.
The server can't read it.Not even the names.
Every item is sealed in your browser before it's saved. Your master password is the only key, and only you hold it.
- Master passwordNever leaves your deviceArgon2id · 64 MiB, 3 passes
- Master keySplit by HKDF into a sign-in key and a wrap keyWrap key opens
- Your private keyECDH P-256Opens what teammates shared
- Vault keyAES-256-GCM, one per vaultWraps
- Item keyAES-256-GCM, one per item
Encrypted, out of the server's reach
- Item names, usernames and passwords
- Notes, websites and one-time code secrets
- Vault names
- Your private key and every vault key
What the server does see
- Emails, names and roles
- Who can open which vault
- When items are used
Open source and small enough to read, but not independently audited yet.Read the model and its limits →
One click.On your Cloudflare.
No vauly cloud, no account with us. A small team fits in Cloudflare's free plan.
- 1Deploy to CloudflareConnect GitHub. Cloudflare copies vauly into a repository of yours and builds it.
- 2Choose a setup codeOnly you know it, so nobody claims your vauly before you do.
- 3Claim itOpen the setup link, create your workspace, invite your team.
- 4Stay currentRun Update vauly in your repository's Actions. Cloudflare deploys it.
Is vauly free?
Yes. It's open source under AGPL-3.0. You only pay for your own Cloudflare account, and a small team usually fits in the free plan.
Can anyone at vauly see our data?
There's no one to ask. There is no vauly cloud: it runs on your Cloudflare account, and even that server only ever stores ciphertext.
What if I forget my master password?
Nobody can reset it, not even an admin. It's the only key to your items. An admin can invite you again so you start over, which is why vauly asks you to print an Emergency Kit.
What happens when someone leaves?
Remove them and their copies of the vault keys are deleted. vauly then lists every item they could open, so you can change what matters.
How is vauly different from 1Password or Bitwarden?
1Password runs only in its own cloud, and hosting Bitwarden yourself means a server to look after. vauly runs on your own Cloudflare account with nothing to maintain, and it's free. They're older, with mobile apps, passkeys and audits vauly doesn't have yet. The docs compare all three.
Can we move from 1Password or Bitwarden?
Yes, and from a dozen others, browsers included. Choose Import from…, pick the app and drop in its export. One-time codes, notes and folders come along, and the file is read on your device. You can download a full backup any time, too.
Has it been audited?
Not yet. The design is small and documented, and every line of code is open to read.
Own your secrets.Deploy in one click.
Free, open source, and running on your own Cloudflare.