Skip to content
vauly

Introduction

vauly is a password manager for small teams, from two people to a handful, who want one place for the logins, API keys, SSH keys and notes they share, and want to run it themselves. It deploys to your own Cloudflare account, and every item is encrypted on your device before it’s saved: the server never sees your master password or anything inside an item, not even its name.

How it fits together

Section titled “How it fits together”
  • The web app is where your team keeps and shares items. Everyone gets a private vault; shared vaults are opened to people one by one.
  • The browser extension fills logins on the sites you sign in to, and offers to save new ones.
  • vauly run hands an item’s value to a command, so coding agents, scripts and CI jobs can use a secret without ever seeing it. A person approves each item once.
  • Your Cloudflare account runs the web app and its API as one Worker, with your data in a D1 database. Nobody else hosts it.

How your data is protected

Section titled “How your data is protected”
  1. Master passwordOnly in your head
    Never sent
    PBKDF2-SHA256 · 600,000 rounds
  2. Master keySplit in two by HKDF
    Never sent
    HKDF
  3. Auth keySigns you in
    A hash of ithashed with scrypt
  4. Wrap keyOpens your private key
    Never sent
    opens
  5. Your private keyECDH P-256
    Sealed private keysealed with the wrap key
    opens
  6. Vault keyAES-256-GCM, one per vault
    A wrapped copy per memberwrapped to each member
    opens
  7. Item keyAES-256-GCM, one per item
    Wrapped item keywrapped with the vault key
    encrypts
  8. Your itemName, username, password, notes
    CiphertextAES-256-GCM, fresh IV
The server holds only the right-hand column. Without your master password, none of it opens.

Your master password never leaves your device, and nobody can reset it, not even an admin. Security covers the whole design, what the server can and can’t see, and where the model stops protecting you.

Where to start

Section titled “Where to start”
  • Self-hosting: deploy vauly to your Cloudflare account and create your workspace.
  • Browser extension: install it, then fill and save logins.
  • Agents and scripts: let a coding agent, script or CI job use secrets without seeing them.
  • Security: how vauly keeps the server from reading your items.