Askrypt

No master password

Your memory is the master key.

Askrypt is a password manager with no master password: you unlock a vault by answering your own security questions. The first answer reveals the questions that follow; the rest of your answers, together, open the vault.

Create account or sign in

Master password

Tq7#vB!m92$Lp0Zx

strong enough

But could you remember it?

You already know a lot of secrets. Use them.

  • The street you lived on when you were ten?
  • Your first teacher’s name?
  • The town where your parents met?
  • What did your grandma use to call you?
  • How did you call your grandma?

Answers only you would give — and never have to write down.

AES-256

the cipher, start to finish

600,000

PBKDF2 iterations per key

0

master passwords to remember

The unlock sequence

Four steps to an open vault.

  1. 01

    Answer your first question.

    What you type is normalized — lowercased, whitespace and dashes stripped — never stored as you typed it.

  2. 02

    That answer unlocks the questions that follow.

    It is stretched through PBKDF2-HMAC-SHA256 at 600,000 iterations, and the key that comes out decrypts the rest of the questions. Until you get the first one right, a vault will not even say what it asks.

  3. 03

    The remaining answers, together, unlock the master key.

    They are joined and stretched once more through the same 600,000 iterations. Get one wrong, and the vault stays exactly as sealed as it was before you started — no hint, no recovery email.

  4. 04

    The master key decrypts your vault.

    AES-256, entirely on your device. Your vault travels as a single portable .askrypt file.

Everywhere, still sealed

Stored anywhere. Readable only by you.

Encrypted before it leaves your device

Vaults are AES-256 encrypted by the app you run. The server stores opaque bytes and a file name — nothing else.

Openable from a phone, if you need it

Open a vault unlocks one in your browser, on your device. The server still only ever holds encrypted bytes — but the page is code we sent you, so the apps remain the stronger option.

Same account everywhere

Desktop and mobile sign in with these credentials through the /api/v1 API. Every signed-in device shows up in your account and can be revoked from there.

Get Askrypt

Pick your platform.

LX Linux x86_64 tar.gz, a .deb package, or build from source with cargo
MA macOS Apple Silicon (ARM64) app bundle
WN Windows MSVC and GNU zip archives, or an Inno Setup installer
MB Android & iOS A pure-Dart mobile app, not yet on the App Store or Play Store in development

Every desktop release ships with SHA-256 checksums. Source and releases live on GitHub.