End-to-end encrypted password manager. Your vault is encrypted on your device with a key we never receive โ so we can't read it, and nor can anyone who breaches us. Unlike Bitwarden, forgetting your master password isn't fatal. A Recovery Kit, shown once at signup, gets you back in โ and we still never hold a key. Free forever: built-in TOTP authenticator, vault health reports, breach checking and a security log. Every one of those is a paid feature elsewhere. Made with love in India ๐ฎ๐ณ
Hi Product Hunt ๐
I built LisaVault because every password manager makes you pick between two
bad options.
Bitwarden's model: forget your master password and your vault is gone.
Permanently. No reset, no support ticket. That's the honest consequence of
real zero-knowledge encryption โ but it's terrifying for normal people, and
it's why most of us never move off the browser's built-in password saver.
The alternative is a provider who *can* reset it for you. Which means they
can read your vault. Which means one breach or one subpoena and it's all out.
LisaVault does neither. Your vault key is encrypted twice โ once with your
master password, once with a Recovery Kit shown to you exactly once at
signup. We hold neither one. Forget your password, use the Kit, and we still
can't read a single item you've stored.
(1Password pioneered this model. I didn't invent it. I made it free.)
WHAT'S FREE HERE THAT OTHERS CHARGE FOR
ยท Built-in TOTP authenticator โ Bitwarden: Premium
ยท Vault health reports โ Premium
ยท Breach checking against HIBP โ Premium
ยท Security activity log โ Enterprise
Plus unlimited items, import from Bitwarden/LastPass/1Password/Chrome,
encrypted export, and device management. Those four never move behind the
paywall. That's a commitment, not a launch promo.
WHAT I HAVEN'T DONE โ UP FRONT
No independent security audit yet. Bitwarden is open source and audited
annually; I'm neither, and you should weigh that. The crypto is deliberately
boring โ Argon2id, AES-256-GCM, HKDF, WebCrypto, nothing invented โ and the
/security page lists exactly what our server can see and what we haven't
built yet. An external audit is the next thing I spend money on.
No browser extension yet. Android lands this week.
HELP ME BUILD THE REST OF IT
This is v1, and I'd rather build the rest with you than guess at it:
ยท What would actually make you switch from what you use today?
ยท What's the first thing you went looking for and didn't find?
ยท Browser extension or iOS โ which do you need first? I'll follow the votes.
I'm in the comments all day and replying to everything. If you find a real
bug, I'll fix it this week and tell you when it's live. If you want to poke
holes in the security model, /security is where the honest list already is โ
I'd genuinely rather you find something than not.
Made with love in India ๐ฎ๐ณ
โ Abhay