Home Page Style
Zero-Knowledge Encryption

Your passwords.
Your keys.
Your control.

Lockstep is a password manager built so that no one — not even us — can read your data. Your master password never leaves your device.

Everything you need, nothing you don't

A fast, organized password manager across every device — with privacy you don't have to think about.

Use It Everywhere

Web app for full vault management. Browser extension for one-click autofill. Mobile app with biometric unlock. Everything syncs seamlessly.

Drag-&-Drop Folders

Organize entries into nested folder trees. Drag and drop to rearrange. Folder names are encrypted too — even your organization is private.

Smart Password Generator

Generate strong passwords with configurable length and character sets. Real-time strength meter. One click to copy, auto-cleared from clipboard in 30 seconds.

Instant Autofill

The browser extension detects login forms and fills credentials in one click. Domain-aware matching prevents phishing. Keyboard shortcuts for power users.

Auto-Lock & Idle Protection

Vault locks after 5 minutes of inactivity, wiping decrypted data from memory. Sessions stay alive in the background — just re-enter your master password.

Multi-Factor Authentication

Authenticator apps (TOTP), email codes, and single-use backup codes. Layer your security how you want.

What separates us from other password managers

True Zero-Knowledge

Your master password is never transmitted to our servers. We derive a separate authentication key for login and a separate encryption key for your vault. Even if we wanted to, we couldn't read your data.

Dual-Key Architecture

One master password → two independent keys with different salts. The auth key proves who you are. The encryption key protects your vault. Compromising one reveals nothing about the other.

No Third-Party Crypto

All encryption runs through the browser's built-in Web Crypto API — FIPS-validated, hardware-accelerated, constant-time. Zero third-party crypto libraries means zero supply-chain crypto risk.

No Tracking, No Telemetry

Zero analytics, zero crash reporters, zero ad SDKs. No data is sent to any third party. We make money when you trust us — not when we sell your behavior.

Built to survive real-world attacks

We designed Lockstep to withstand the same attacks that have breached other password managers. Here's how each one is neutralized.

Server Breach

Attacker gets full database access.

Defense: The database contains only ciphertext, wrapped keys, and bcrypt-hashed auth verifiers. No master passwords. No encryption keys. No plaintext. A full dump is cryptographically useless.

XSS (Cross-Site Scripting)

Malicious script runs in the browser.

Defense: Refresh tokens live in httpOnly cookies — invisible to JS. Access tokens are in-memory only. Master password is discarded after key derivation. Angular sanitizes all templates. The blast radius of XSS is minimal.

CSRF (Cross-Site Request Forgery)

Attacker tricks browser into making authenticated requests.

Defense: Per-session CSRF tokens, SameSite cookie flags, and mandatory custom headers on every state-changing request. Cross-origin form submissions are blocked.

Brute-Force & Credential Stuffing

Attacker tries millions of password combinations.

Defense: 600,000 PBKDF2 iterations (~300ms per guess) + server-side bcrypt + rate limiting (10 attempts / 15 min) + mandatory 2FA. 1 billion offline guesses ≈ 9.5 years.

Man-in-the-Middle

Attacker intercepts network traffic.

Defense: TLS everywhere, HSTS headers, Secure cookie flags, and certificate pinning on mobile. Even broken TLS reveals only derived auth keys and ciphertext — never the master password or encryption key.

Replay & Token Theft

Attacker captures and replays a valid request or token.

Defense: Short-lived JWTs (15 min), rotating refresh tokens with reuse detection, CSRF rotation, and unique IVs per encryption. If a stolen refresh token is replayed, the entire token family is revoked.

Supply-Chain Attack

Compromised dependency injects malicious code.

Defense: All cryptography uses the native Web Crypto API — no third-party crypto packages. Minimal runtime dependencies. Locked dependency versions. Build-time AOT compilation.

Phishing

Fake site tricks user into entering credentials.

Defense: Browser extension uses eTLD+1 domain matching — it won't autofill on the wrong domain. Fill mismatch warnings, HTTPS-only fill, and protocol validation block credential harvesting.

What if our entire server is compromised?

Nothing useful. Attackers get encrypted vault entries they can't decrypt, a wrapped vault key they can't unwrap, bcrypt-hashed auth verifiers they can't reverse, and random salts that are useless alone. Your data stays locked.

One vault. Three apps. Every device.

Lockstep keeps your passwords in sync across web, browser, and mobile — with the same zero-knowledge encryption on every platform.

Web App

Full vault management from any browser. Add, edit, organize, and share entries. Manage folders, account settings, and 2FA — all encrypted client-side.

Open Web App

Browser Extension

One-click autofill on any login page. Domain-aware matching blocks phishing. Inline password generator. Works in Chrome, Edge, and Chromium-based browsers.

Chrome Web Store Coming Soon

Mobile App

Biometric unlock with Face ID and fingerprint. System-wide autofill on Android and iOS. Offline access to your vault with encrypted local cache.

Google Play Coming Soon

All three apps share the same encrypted vault. Add a password on your phone, autofill it in your browser, manage it on the web — everything stays in sync, and nothing is ever stored in plaintext.

Ready to take control of your passwords?

Create your account in 30 seconds. Your first vault entry is encrypted before it ever reaches our servers.

Create Your Vault

Free to use · No credit card required · Zero-knowledge from day one