XYZ Passwords — Zero-Knowledge Password Manager

XYZ Passwords stores your logins in an encrypted vault that lives on your device. It's zero-knowledge: your passwords are encrypted before they're stored, your master password never leaves your device, and xyz.am cannot read, decrypt, or recover your vault.

The app runs at passwords.xyz.am, on its own isolated address — separate from the rest of the site for security.

• xyz.am cannot see your passwords.
• Your vault is encrypted before it is stored.
• Your master password never leaves your device.

When you unlock, your master password is run through a slow, memory-hard function (Argon2id) on your device to derive an encryption key. That key decrypts your vault locally with an authenticated cipher (XChaCha20-Poly1305) and is erased from memory when the vault locks. The only thing ever written to storage is the sealed, encrypted blob.

• Local Only (default) — the vault is stored only on this device, in this browser. No cloud, no sync, no xyz.am storage.
• Bring Your Own SQL — your own database stores the encrypted blob; it never sees plaintext or keys. Configure it in Settings → Storage.
• XYZ Encrypted Sync (Premium) — xyz.am stores only the encrypted blob, on Cloudflare R2, and cannot decrypt it. If Premium lapses, your vault stays downloadable but stops syncing until renewed.

In every mode, only the encrypted blob ever leaves your device — never your passwords, never your keys.

Guide: use your own SQL database →

Your safety net is a recovery kit you control: an encrypted export of your vault plus your master password, kept somewhere safe. From Settings you can export an encrypted copy and import it on any device.

• Save logins with title, URL, username, password, notes and tags.
• Generate strong random passwords locally, with length and character options.
• Copy usernames and passwords, with automatic clipboard clearing.
• Auto-lock after inactivity and manual lock.
• Encrypted export and import for backups and moving devices.
• A browser extension (Chrome & Firefox) and a mobile app that unlock the same encrypted vault and fill logins after you click.

Is my master password the same as my xyz.am login?

No — they're completely separate. Your xyz.am login is for the website and your account; your master password only ever exists on your device and encrypts your vault.

What happens if xyz.am gets hacked?

For Local Only vaults, xyz.am stores nothing about your vault at all. With sync enabled, all xyz.am ever holds is the encrypted blob, which is useless without your master password.

Can I use it on more than one device?

Yes. Turn on sync in Settings → Storage — either Bring Your Own SQL (a database you run) or XYZ Encrypted Sync (Premium). Only the encrypted blob ever syncs. You can also always export an encrypted copy from one device and import it on another.

Does it cost anything?

The app and Local Only storage are free. XYZ Encrypted Sync (the option where xyz.am keeps your encrypted blob in sync across devices) is a Premium feature.

Where are the technical details?

See the Security & Technical Specification for the encryption design (Argon2id, XChaCha20-Poly1305), the vault format, and the threat model.