Zero-knowledge · AES-256-GCM · Your own cloud
PockyPass encrypts your vault on your device with a master password only you know, and syncs it through your own Google Drive, OneDrive or iCloud. There is no PockyPass server that could see your data.
No PockyPass account No tracking Works offline
Availability
Zero-knowledge security across your phone, desktop and browser.
Android
Autofill in apps and browsers
In testing
iPhone & iPad
iPhone & iPad app with Face ID, AutoFill and iCloud Drive sync
On TestFlight
macOS
Native macOS desktop app with SQLCipher vault and Zero-Cloud browser bridge
Windows
Windows desktop app with QR phone pairing and local encrypted vault
Browser extension
Zero-knowledge browser extension for Chrome, Edge, Brave and Firefox
Want to try it early? Write to us: hello@pockypass.com
Open Visual & Video User Guide →Why PockyPass?
Most password managers keep your vault on their own servers. PockyPass has no servers for your data at all.
No PockyPass servers
Your encrypted vault is a single file in the private app folder of your own Google Drive, OneDrive or iCloud Drive. It never passes through or rests on our servers.
Straight to your cloud, no middleman
AES-256-GCM
A random 256-bit key encrypts every entry with AES-256-GCM. That key is locked on your device with your master password (PBKDF2, 600,000 iterations). Without your master password or recovery key, nobody can open the vault, including us.
Your master password never leaves your device
Offline-first
Your vault lives on your device, so you can search, copy and autofill without a connection. Changes sync automatically when you are back online.
Ready on a plane, in a tunnel, anywhere
Features
Store and sign phishing-resistant Ed25519 (COSE -8) passwordless login keys inside your AES-256-GCM vault across all your devices.
Fill in logins in apps and browsers. A password is only released after your fingerprint, face or screen lock, and only to the site it belongs to.
Keep two-factor secrets next to your logins and get the 6-digit codes right in PockyPass.
Check your passwords against known data breaches using k-Anonymity (only the first 5 SHA-1 hex chars leave your device) and audit weak or reused credentials locally.
Strong random passwords in one tap, plus a strength meter for your master password.
Unlock with your fingerprint or face. On Android the key is bound to the phone's secure hardware.
Changes merge across your devices through your own cloud, entry by entry, without overwriting each other.
Connect the browser extension directly to the macOS or Windows desktop app over 127.0.0.1:49192 with a 6-digit PIN—no cloud required.
Forgot your master password? The recovery key you get at setup lets you choose a new one. Only you have it.
The vault locks when you leave the app or stop using it, and copied passwords are cleared from the clipboard.
Take your data with you at any time in a password-protected backup file.
Including right-to-left Arabic and Urdu.
How it works
Your master password becomes a key on your phone or computer. It is never sent anywhere.
Every entry is encrypted with AES-256-GCM. Only the encrypted vault is written to disk or uploaded.
The encrypted file goes to your own Google Drive, OneDrive or iCloud. Your other devices pick it up from there.
Plans
For getting started
For all your devices
Everything in Free, plus:
Subscriptions are managed by Google Play or the App Store and can be cancelled at any time.
Frequently asked questions
On your device, encrypted. If you turn on sync (Premium), an encrypted copy is saved in the private app folder of your own Google Drive, OneDrive or iCloud Drive. PockyPass runs no servers that store vault data and has no user database.
Use the recovery key you saved when you created your vault to set a new master password. We cannot reset it for you: we never have your password or your keys. If both the password and the recovery key are lost, the vault cannot be opened, so keep the recovery key somewhere safe and offline.
PockyPass is available on Android, iPhone & iPad (TestFlight), macOS, Windows, and as a browser extension for Chrome, Edge, Brave, and Firefox. You can download the desktop apps and browser extension directly from this page.
Yes. The free plan includes every security feature, with up to 30 entries on mobile (20 on Windows). Premium adds unlimited entries, sync across your devices, the browser extension and 2FA codes.
No. Your vault is encrypted on your device before it is stored or uploaded, with a key that only your master password or recovery key can unlock. We never receive your master password, your vault or your keys.
Not yet. PockyPass uses standard, widely reviewed cryptography (AES-256-GCM and PBKDF2-HMAC-SHA256 with 600,000 iterations), and the design is described on this page.