$ loading▍
$ loading▍
// products/pumpkins-vault
Pumpkins Vault keeps your logins, payment cards, Wi-Fi passwords and notes behind a secret key only you know. Every card is encrypted in your browser, so the server stores nothing it can read.
Envelope encryption, done entirely with the browser's Web Crypto API. A wrong secret key doesn't get compared against anything — the data key simply fails to unwrap.
your secret key
PBKDF2-SHA256 · 600,000 rounds
key-encryption key
stays in your browser
random data key
wrapped with AES-256-GCM
wrapped data key
stored on the server
each card
sealed with the data key
iv + ciphertext
stored on the server
One exception you control: if you ask for a copy of your secret key by email when creating the vault, it passes through the server and the email provider once. It's off by default and comes with a clear warning.
Start from Login, Payment card, Wi-Fi, Secure note, Identity or Bank account — or a blank card. Pick from 19 icons and 8 colors so things are easy to spot.
Text, secret, link and note fields. Secrets stay masked until you reveal them, and every value is one click from your clipboard.
Search titles, labels and non-secret values — secret values are deliberately left out of search. Pin the cards you reach for most.
Download, copy or print your secret key when you create the vault. You can't finish setup until you confirm you understand it can't be recovered.
The unwrapped key lives in memory only and can't be exported. Refresh the page or hit Lock vault and it's gone until you enter your secret again.
Press N for a new card, duplicate a card in one click, and undo a delete straight from the toast.
Create an account, choose a secret key, save your recovery kit — and your vault is ready.
Lose your secret key and nobody can decrypt your cards — not even me. Keep the recovery kit.