VAULT / 1.0PRIVATE BY DESIGN. YOURS BY DEFAULT.
Passwords, keys, and the things you keep to yourself. Encrypted on your device. Available offline.
AFTERCURVE VAULT
Enter your master password. It never leaves this extension.
AES-256-GCM · Argon2id
No account. No cloud sync. No network connection.
YOUR PRIVATE WORKSPACE
Add your first login, key, or private note.
Only encrypted data is saved. Export a backup before uninstalling or changing devices.
GENERATED ON YOUR DEVICE
Random passwords, without a network request.
Clipboard contents can be read by other applications. Paste only where you intend to use this password.
CHECKED LOCALLY
Find reused, short, or obviously patterned login passwords.
These checks are heuristics. A clean result is not proof that a password is unguessable or absent from a breach.
VERIFIED / POST-QUANTUM KEY TRANSFER
Transfer files offline. Verify both fingerprints through a trusted separate channel.
Do this on the device receiving your entries. Requests expire after 30 minutes and can be used once.
Send the request file to your other device. Compare this fingerprint directly on this device, or send it through a trusted separate channel.
Obtain it independently. Do not copy a fingerprint from the request file itself.
Send the encrypted package file to the receiving device. Communicate this fingerprint separately so it can verify the sender's package.
Review the import before accepting it. Existing entries are never overwritten. Identical entries are skipped.
ML-KEM-768 establishes the transfer key. HKDF-SHA256 and AES-256-GCM protect the payload. Verification relies on comparing the complete fingerprints independently. This does not alter Ethereum wallet signing.
PORTABLE BY DESIGN
Keep an encrypted copy somewhere you control.
Your master password protects this file. The file includes your entries and settings, but excludes active device-transfer keys.
Changing your password later does not update existing backup files. Each backup needs the password used when it was created.
Import adds entries to this vault. It does not replace your current settings or overwrite existing entries.
CONTROL THE DETAILS
The vault also locks when this tab is hidden, closed, or reloaded. Active receive requests remain encrypted and can be resumed after unlocking.
SECURITY BOUNDARIES
A compromised device, browser, extension update, or website receiving a filled password can expose secrets. This release has not received an independent security audit. Backups are essential: uninstalling the extension deletes its local storage. There is no password-reset service.
Read the implementation and threat model ↗