Your authenticator codes should not die with your phone

VaultKeep started with my frustration with authenticator apps. They were tied to a phone, so without your phone you could not reach your codes. Several authenticator apps do not store your data in the cloud at all, which means that when you lose your phone, you lose everything with it.

Two-factor authentication is supposed to protect your accounts. It should not be the thing that locks you out of them. I built VaultKeep to solve that one problem, and it has since grown into a complete zero-knowledge password manager.

A zero-knowledge password manager: the rule behind it all

Backing up your authenticator codes only helps if you do not have to trust someone else with them. So everything in your vault is encrypted on your device before it is uploaded, and the server only ever stores ciphertext. Your master password never leaves your device, and we cannot read your vault.

• Vault items are encrypted with AES-256-GCM.
• Encryption keys are derived with PBKDF2-SHA256 at 600,000 iterations.
• The server verifies a proof derived from your password, never the password itself.

An authenticator app with encrypted cloud backup

If you have ever searched for how to back up an authenticator app, or how to recover 2FA codes after losing a phone, this is the part I built first. Your two-factor codes sync across your devices in encrypted form, so a lost phone no longer means a lost set of codes. Sign in on a new device and they are there.

• Add a code by scanning a QR code with your camera, uploading a photo of one, or entering the key by hand.
• Use it as a Google Authenticator alternative by importing its export QR code.
• Store the one-time backup codes that sites give you, and mark them off as you use them.
• Restore authenticator entries and backup codes you deleted by mistake.

From authenticator to complete password manager

Once your two-factor codes live in one encrypted vault, keeping your passwords somewhere else stops making sense. So the vault grew.

• Logins and secrets. Each item holds a username, password, and website, plus a secrets field for things like API keys, license keys, and recovery phrases. An item can also hold only secrets.
• Browser autofill. The Chrome, Edge, and Firefox extension suggests your logins when you press Alt+V (Option+V on Mac) or click the VaultKeep mark inside a login field. It can also save new logins as you use them, if you turn that on, and generate strong passwords on sign-up forms.
• Android app. System-wide autofill, the built-in authenticator, and biometric unlock.
• Web app. Your full vault in any browser, installable on your device.
• Password health. Finds weak, reused, and old passwords, with the analysis running on your device. The optional breach check sends only the first five characters of a password hash.

Account recovery: how you get back in

The original problem was being locked out, so recovery got as much attention as encryption.

• Passkeys. Unlock on the web and in the extension with your fingerprint, face, or device PIN.
• Approve from your phone. Sign in on a browser by confirming a short code on your signed-in phone.
• Recovery kit. A 24-word kit, shown once when you register, can reset your master password if you forget it. A passkey can do the same.
• Automatic lock. Your vault locks itself after a period of inactivity.

Zero knowledge has one honest trade-off: we cannot reset your account for you. If you lose your master password and every recovery option, nobody can open your vault, including us. Keep your recovery kit safe.

How to share passwords and secrets securely

Passwords get shared whether we like it or not, usually over a chat app where they stay forever. In VaultKeep you can share a login, with its password and secrets, or an authenticator entry through an encrypted link.

• Auth code. The link alone unlocks nothing. The recipient also needs an auth code you choose, so you can send the two separately.
• One-time links. The link stops working after the recipient views it once.
• Viewing windows. Close access a set number of minutes after the first view, and the page clears itself.
• Full control. Set an expiry date, see your active links, change the auth code, or revoke a link at any time.

Sharing an authenticator entry means a contractor can get a working two-factor code for one job, without you reading codes out over a call every time they log in. They can also import the secret from the link, so reset two-factor on that account once the job is done. The full walkthrough is in how to share passwords, secrets, and authenticator codes.

A password manager for families and teams

Share links work for one-off handovers. For people you share with all the time, create a family or business organization. Invite members, give them an admin or member role, and keep shared logins and authenticator codes in a vault you all use, so your team can share 2FA codes without passing a phone around. Those items autofill just like your own.

Secret folders keep things need-to-know. Each folder has its own encryption key, sealed individually to the members you assign. When someone leaves a folder, its key is rotated and its contents are re-encrypted, so their access is actually revoked and not just hidden from view.

A few ways this gets used:

• Families: the Wi-Fi password, streaming logins, and the household bills account, with a private folder for the things only the adults need.
• Startups: one company social account with its two-factor code, available to the whole marketing team, so a login no longer depends on whose phone it was set up on.
• Engineering teams: a folder of production credentials for only the people on call. When someone changes roles, remove them and the folder is re-encrypted.
• Agencies: one folder per client, assigned only to the people working on that account.

Shared inboxes for team sign-in codes

Some services only send sign-in codes and magic links by email, which is a problem when one person owns that inbox. A shared inbox gives you a forwarding address that keeps only the senders you allow and shares those emails with the people you invite.

• Allow a whole domain or a single address. Everything else is dropped.
• Forward only those senders from your mailbox, so your team never sees the rest of your email.
• Each message is encrypted on arrival, so only you and the people you invite can read it.
• Messages delete themselves after 1 hour, 24 hours, 7 days, or 30 days, whichever you choose.

Try VaultKeep for free

VaultKeep is free. Create an account, then get the extension and the Android app from the downloads page. You can also read exactly what we can and cannot see in our privacy policy. If you have a question or something does not work the way you expected, tell me about it.

This started as a fix for one frustration of mine. If you have ever lost a phone and spent a week getting back into your own accounts, I hope it fixes yours too.

Frequently asked questions