Your passwords. Encrypted. Yours.
CredentialBase encrypts everything on your device with AES-256-GCM before it ever reaches our servers. We literally cannot read your passwords — and that's the point.
GitHub
dev@example.com
Gmail
you@gmail.com
AWS Console
admin@company.com
Netflix
me@example.com
AES-256-GCM
Encrypted
Zero-knowledge
We can't read it
Features
Everything you need, nothing you don't
Built for people who take security seriously. Every feature designed around the principle that your data belongs to you alone.
Zero-knowledge encryption
PBKDF2 derives two keys from your master password: an auth key (sent to server) and an enc key that never leaves your browser. We store only AES-256-GCM ciphertext.
One-click autofill
Click the 🔑 icon injected into any login field. Picks the right credential by domain, fires native input events so every framework detects the fill.
Card autofill
Detects credit card fields via autocomplete attributes. 💳 icon appears — pick your card and all fields fill: number, expiry, CVV, name.
Secure share links
Generate a time-limited link to share credentials. Decryption key lives only in the URL fragment — never sent to our server. Optional PIN for extra protection.
Cross-device sync
Delta sync via ?since= parameter pulls only items updated since last sync. Fast, bandwidth-efficient, works the moment you open the popup.
Session management
See every active session with device name, IP, and last-active timestamp. Revoke any session — or all others — with one click.
Change master password
Re-derives a new enc key, re-encrypts every vault item client-side, batch syncs to server. No data loss, no re-login required on other devices.
Secure notes
Store sensitive text — SSH keys, recovery codes, API keys — encrypted the same way as passwords. Copy with one click, never shown in plaintext at rest.
How it works
Up and running in minutes
No complex setup. No vendor lock-in. No trust required.
Install in 30 seconds
Add CredentialBase to Chrome for free. No account needed to start — install and begin saving passwords immediately.
Create your vault
Set a master password. We derive two keys: one to authenticate you, one to encrypt your vault. The encryption key never leaves your device.
Autofill. Share. Sleep well.
CredentialBase fills logins and cards automatically. Share credentials via secure time-limited links. Your vault is always encrypted — even from us.
Security
Zero-knowledge. Provably.
We designed the system so that even a full server breach cannot expose your passwords. Here's exactly how it works.
Vault encryption flow
Master password
Only in your browser, never transmitted
PBKDF2
600,000 iterations · SHA-256 · salted per user
authKey
Sent to server. Authenticates your sessions via bcrypt.
encKey
Never leaves browser. Non-extractable CryptoKey object.
AES-256-GCM
12-byte random IV · encrypted blob stored as base64
Server stores: encrypted blobs only — no plaintext, no keys, ever.
Secure share link flow
Path (sent to server)
UUID to look up encrypted blob. Server returns ciphertext.
Fragment (never sent)
32-byte random key. Browser uses to decrypt. Server never sees it.
Result: server cannot decrypt share even if breached.
We can see
Encrypted blobs, your email, session timestamps
We cannot see
Passwords, usernames, URLs, notes, card numbers
Enc key lives
In your browser only — non-extractable CryptoKey
If server breached
Attacker gets useless ciphertext. No keys to decrypt.
Share key lives
In URL fragment only — browser never sends it to server
At rest on server
Only AES-256-GCM ciphertext with random IVs
Pricing
Free forever. Upgrade when ready.
Start for free. No credit card required. Upgrade to Pro for unlimited everything.
Free
No credit card required. Ever.
- 50 vault items
- 3 active share links
- 1h & 24h share expiry
- Login & card autofill
- Secure notes
- Session management
- Cross-device sync
Pro
Billed as $15.99/year · Save $8
- Unlimited vault items
- Unlimited share links
- 7d & 30d share expiry
- Login & card autofill
- Secure notes
- Session management
- Cross-device sync
- Priority support
- Early access to team vaults
All plans include AES-256-GCM encryption, zero-knowledge architecture, and Chrome extension access. Cancel or downgrade any time — your vault data is always yours to export.
Testimonials
Trusted by security-first teams
“Finally a password manager where I actually understand the security model. The zero-knowledge architecture is explained clearly and the code is clean. Been using it daily for 3 months.”
Alex K.
Senior Software Engineer
“The share link feature is brilliant. I share server passwords with my team and the key never hits the server. It's the only secure way to share credentials I've seen in a free tool.”
Maria S.
DevOps Lead
“Card autofill works better than my bank's own extension. CredentialBase detected my card fields on every checkout page I tested. The PBKDF2 iterations give me confidence in the crypto.”
James T.
Security Researcher
FAQ
Common questions
Yes. Your master password is never sent to our servers. We use PBKDF2 (600,000 iterations) client-side to derive two keys: an auth key (for login) and an enc key (for encryption). The enc key exists only as a non-extractable CryptoKey in your browser. We store only AES-256-GCM ciphertext. Even a full database breach exposes nothing useful.
Start today
Your passwords deserve better.
Free forever. Upgrade when you need unlimited. Zero-knowledge from day one.