Real site
Password generated for
This is your real password.
Free · No vault · No cloud
The password manager with no database to leak.
Vaultless Pass calculates every password on the spot, from your master password and the site’s real address. Nothing is stored, nothing is sent: there is no vault to break into.
Chrome Web StoreComing soon
See the demo
- Zero network connections
- No account, no sync
- PBKDF2 with 600,000 iterations
Same master password, two addresses
Master password (public, for this demo only)
correct horse battery staple
Fake site
Password generated for
A completely different password. The fake site never gets yours.
Calculated with the same code as the extension. Never type your real master password into a web page, including this one.
The problem
Every vault is a target.
Traditional managers keep your passwords in one place. It is convenient, and it is exactly what an attacker looks for.
Vaults become targets
All your passwords sit on one server or file. If it leaks, or the vault key is found, the loss is total and immediate.
Look-alike addresses fool people
paypa1.com instead of paypal.com fools people and, sometimes, even badly configured tools. The real password ends up handed to the scammer.
A reused password opens everything
Memorizing a strong password for every site is impossible. So almost everyone reuses them, and one leaked password starts opening several accounts.
How it works
Instead of storing the password, calculate the password.
Three steps, all inside your browser. Same input, same password, on any computer.
-
You type the master password
It goes only into the calculation and is wiped from the field right after. It never reaches disk, persistent memory or the network.
-
The extension reads the real address
The browser itself reports the site, not the page. The main domain is what counts (login.microsoftonline.com becomes microsoftonline.com), using the public suffix list.
-
Math returns the password
PBKDF2 with SHA-256 and HKDF, done by Chrome itself. Changed one letter of the address, like paypa1.com or g1thub.com? A different password comes out. Browsers also lowercase addresses, and the calculation uses what the browser reports.
master password + real site + version → strong password
Play with the address
Change one letter and watch the whole password change. This is a live calculation in your browser, with the demo’s public master password.
Generated password
Under the hood
Small on the outside, careful on the inside.
The real domain
Uses the registrable domain with the public suffix list (github.io does not share a password with its neighbors) and warns when the address mixes letters from other alphabets.
Master password seal
Three shapes that appear as you type. If they change, you typed something different from usual: the typo is caught before it turns into an account recovery.
Rules per site
Numbers only, at most 12 characters, no symbols, forbidden characters. Plus a version to rotate the password when a site asks or leaks.
Clears what it copied
Copies the password and wipes it from the clipboard after 30 seconds (or 1, 2 or 5 minutes). The screen forgets it too.
Rates the master password
Warns when it is weak and suggests a long phrase. It only warns: it never blocks or decides for you.
Backup with no passwords
Take your site rules to another computer in a file. It contains no password at all, only the rules.
Light, dark and 3 languages
Portuguese, English and Spanish, switched in the settings, and a theme that follows your system. Shortcut Alt+Shift+P.
No-library interface
Plain HTML, CSS and JavaScript, two screens and no third-party dependency in the interface. Less code to audit.
Honest comparison
Vault or calculation?
There is no perfect choice. Here is what each approach delivers, including what Vaultless Pass does worse.
| Criterion | Vault-based manager | Vaultless Pass |
|---|---|---|
| Where passwords live | In a vault, in the cloud or in a file, encrypted | Nowhere: they are calculated on the spot |
| If the server is breached | The encrypted vault may leak | There is no server or vault to leak |
| Fake address (phishing) | Depends on the setup | Generates a different password: the fake site never gets yours |
| Internet connection | Talks to the vendor’s server | None: Chrome blocks it by rule |
| New computer | Sign in and sync | Install and type the master password (rules travel in a file) |
| Filling in the login for you | Yes | No: it only copies, to ask for fewer permissions |
| Forgot the master password | Some offer recovery options | There is no way to recover it |
| Two-step codes (2FA) | Some store and generate the codes | Does not generate them: use a separate authenticator, on purpose |
| Bringing the passwords I already have | Imports from another manager | Does not import: you switch each site’s password, little by little |
Vaultless Pass trades convenience for a smaller attack surface. If you need autofill and recovery, a vault-based manager may serve you better.
Security and transparency
Don’t trust. Verify.
Every promise below has a test that proves it. In a password manager, “trust me” is not enough.
Zero network, enforced by Chrome
The extension’s security policy forbids any connection. In a real Chrome test, a local server lying in wait received 0 requests.
Minimal permissions
Active tab (read the address only when you click), storage (the rules), clipboard, alarms and a background page (copy and wipe). No site permission at all.
Frozen, cross-checked algorithm
13 reference passwords and a second, independent implementation in Python: both arrive at the same passwords, byte for byte.
Open source, built to audit
The code will be public at launch: few files, no third-party libraries, so the community can check the function that generates the passwords.
content_security_policy.extension_pages:
default-src 'none'; script-src 'self'; connect-src 'none'What it does not do
A security tool has to state its own limits.
- If you forget the master password, there is no way to recover it: there is no vault and no recovery email.
- The master password is your only defense. If a site stores your password in plain text and leaks it, someone can try to guess the master on their own computer. That is why each guess is made expensive and why a long phrase is recommended.
- It only copies the password; it does not fill in the field. On Windows, clipboard history (Windows + V) may keep a copy.
- It does not generate two-step verification codes (2FA). That code comes from a key the site itself picks, which cannot be calculated: use an authenticator app or a security key, kept separate, so the two factors stay independent.
- It does not import passwords from another manager: you switch each site’s password to the one it calculates, little by little, and delete the old vault only when you are done.
- Tested on Chrome, on Windows. Other browsers and systems have not been tested yet.
Frequently asked questions
What people ask most
What if I forget the master password?
There is no way to recover it, because there is no vault and no recovery email. That is the price of having nothing to leak. Pick a long phrase you can remember, like four unrelated words.
A site asked me to change my password. Now what?
Raise the password version in the site’s rules. Same master password, same address, version 2: a new password comes out. The version is kept in your browser, never the password.
How do I use it on another computer?
Install the extension and type the master password: your passwords come back on their own. Customized rules (length, version) travel in a file you save in the settings and open on the other computer.
What about the passwords I already have in another manager?
Vaultless Pass does not import passwords: it only calculates new ones. The way in is to switch each site’s password to the one it generates, little by little, starting with your email and your bank, because whoever gets into your email can reset the other passwords. Each switch leaves the old password, the one in the old vault, worthless. Delete the old vault only after you have switched everything and moved the two-step codes, cards and notes elsewhere: it keeps things Vaultless Pass does not.
Can I store the master password somewhere?
Please don’t. A master password written in a file, a notes app or the browser defeats the idea: whoever finds that place gets every password, which is exactly what Vaultless Pass is built to avoid. It is meant to live only in your head. Pick a phrase you can remember, type it every day for the first weeks and check it against the three-shape seal, which is always the same for the same master password. Since nothing can recover it, switch your sites’ passwords only when you are sure you know it by heart. The master password is what matters: each site’s rules (length, version) are not secret and travel in the backup file.
Does it work with two-step codes (2FA)?
It coexists with them but does not generate them. The two-step code comes from a key the site itself picks, so it cannot be calculated like the passwords, and storing it here would mean building a vault. Everything would also sit in one place: whoever found out the master password would get both factors. Use an authenticator app or a security key, kept separate, and the second factor stays a different thing.
Which browsers does it work on?
Chrome. Chromium-based browsers such as Edge should work, but they have not been tested yet.
Why not use Argon2?
Argon2 would need WebAssembly and a looser security policy for the extension. PBKDF2 is native to the browser and runs at 600,000 iterations. Argon2 may become a future version without touching current passwords.
Is it really free?
Yes. No account, no ads and no data collection. If it helps you, a voluntary contribution is very welcome, and you can make it through Buy Me a Coffee.
Free, and made with care.
Vaultless Pass is free and has no ads, no account and no data collection. If it helped you protect your accounts, a contribution is very welcome and helps keep the project alive.
Support on Buy Me a Coffee Voluntary contribution. Nothing changes in how the extension works.
Stop storing passwords. Calculate them.
The extension is not on the Chrome Web Store yet. Meanwhile, watch the demo and check the tests.
Chrome Web StoreComing soon
See the demo