The command line, an SSH agent, and logins for AI agents
- The vallkey command: secrets for scripts and CI by reference, with run and inject, on the same core as every app.
- An SSH agent that signs with the Ed25519 and ECDSA keys in your vault, on macOS and Linux.
- Service accounts: a token for a build that opens only the vaults you share with it.
- AI-agent logins: an agent asks through Vallkey's MCP server, you approve in the browser extension, and the extension fills the page. The agent never sees the password.
- The password fixer reads change pages its rules can't, with Chrome's on-device model, which is given what the fields say and never what they hold.
For teams: organizations, single sign-on, SCIM and audit logs
- Organizations, with a console in the web vault: people, groups, and vaults granted to edit, to view or only to fill, on a roster only the organization's own key can sign.
- Policies for master password strength, locking, exports and Travel Mode.
- Single sign-on with any OpenID Connect or SAML 2.0 identity provider, which never holds a key.
- SCIM 2.0: an identity provider adds and removes people and groups, and someone deactivated loses the organization's vaults at once.
- An audit log for each organization, read in the console or sent on to a webhook, Splunk, Datadog, Microsoft Sentinel or S3.
- Offboarding: what someone who left could open, which items still hold what they saw, and a report.
- A device that's logged in can let a new one in with nothing typed but a code, and an organization can let its admins do the same for a member who lost every device.
- A key connector a company runs on its own servers, so its people have no master password.
- Trusted contacts: a recovery code split between three people, any two of whom can help you back in.
- A vault kept only on your devices can sync through a folder you share between them, such as iCloud Drive or Dropbox.
Plans, email aliases, the password fixer and local-only vaults
- Email aliases: a different address for every site, forwarding to your inbox, in the web vault, the desktop app and the browser extension.
- The password fixer changes a password on the site for you, in the browser extension: it fills the old one and a new one, and saves the new one before any page sees it.
- Local-only vaults: no account and no server, with a pay-once license, in the browser extension and the desktop, iPhone, Mac and Android apps.
- Self-hosting: the server on your own machines, serving the web vault, sending email over SMTP and backing itself up.
- Plans, through Stripe, with the price lock and the offer for people switching.
Travel Mode and item history
- Travel Mode: mark vaults Safe for travel and turn it on, and every other vault leaves all your devices until you turn it off in the web vault.
- Item history: History on an item lists what it held before each change, and brings an earlier version back.
- After an import, the browser extension can turn off your browser's own password saving, and says how many passwords are weak or reused.
- Warnings about lookalike sites on iPhone, iPad and Android too.
Vallkey for Safari, and every kind of item
- Vallkey for Safari on the Mac, iPhone and iPad: the extension Chrome, Edge and Firefox run, carried by the apps.
- Eleven more kinds of item, so Vallkey has every kind 1Password has: documents, Wi-Fi networks, servers, databases, software licenses, crypto wallets, email accounts, medical records, outdoor licenses, reward programs and Social Security numbers.
- Importing from 1Password and KeePass brings documents and attached files along.
- KeePass 1 databases and KeePass XML exports import too, and databases encrypted with Twofish.
- Several accounts in the browser extension and in every app, such as one for work, with one unlocked at a time.
- A passkey can be made from a sign-in box another site embeds, where the page allows it.
- The extension's and the web vault's core is 40% smaller to download.
The desktop app unlocks your browser
- Pair the browser extension with the Windows or Linux app: it unlocks whenever the app is unlocked, and locks with it.
- Unlock the desktop app with Windows Hello, where it's set up.
- The desktop app locks when the computer sleeps or, on Linux, when the screen locks, and has a tray icon.
- Security shows a Change password link for each weak, reused or breached password, straight to the site's change page.
- Export your vault as a Credential Exchange file, passkeys included, to move it to any app that reads the format.
Vallkey for Windows and Linux
- A desktop app with every view of the web vault, which works offline and keeps the vault encrypted on the computer.
- It saves exports and files through the system's Save dialog, and clears copied passwords from the clipboard.
Vallkey for iPhone, iPad, Mac and Android
- Apps for iPhone and iPad, with AutoFill for passwords, one-time codes and passkeys, and Face ID.
- A Mac app that unlocks with Touch ID.
- An Android app with autofill, passkeys in browsers and apps, and fingerprint or face unlock.
- Every kind of item, sharing, families, legacy contacts, files and share links, on every one of them.
Sharing, families and legacy contacts
- Share a vault with editors or viewers; removing someone gives the vault a new key.
- Families of up to six people, with a shared Family vault and family recovery.
- Legacy contacts, who can ask for the vaults you leave them after a wait you choose.
- Share links show an item to someone without Vallkey, for up to 30 days, and can work only once.
Signed vaults and key transparency
- Every vault write is signed, and every download is checked against its signed manifest, so devices catch a server that drops, rolls back or changes items.
- Every key you share to is checked against a public key transparency log first.
- Recovery codes and a printable Emergency Kit.
The browser extension and web vault
- Chrome, Edge and Firefox: fill logins, one-time codes, cards and identities, save new logins, and make passkeys.
- A web vault for every item, import, export and account settings.
- Import from 1Password, LastPass, Bitwarden, Dashlane, Keeper, Proton Pass, NordPass, KeePass, browsers and Credential Exchange files.
- Passports, driver's licenses, memberships, final instructions, and files kept with items.
Get updates by email
Release notes and the build, about twice a month.
Your passwords. Your keys. Your price.
Vallkey opens soon. Join the waitlist to hear first.