Lockstep is a password manager built so that no one — not even us — can read your data. Your master password never leaves your device.
A fast, organized password manager across every device — with privacy you don't have to think about.
Web app for full vault management. Browser extension for one-click autofill. Mobile app with biometric unlock. Everything syncs seamlessly.
Organize entries into nested folder trees. Drag and drop to rearrange. Folder names are encrypted too — even your organization is private.
Generate strong passwords with configurable length and character sets. Real-time strength meter. One click to copy, auto-cleared from clipboard in 30 seconds.
The browser extension detects login forms and fills credentials in one click. Domain-aware matching prevents phishing. Keyboard shortcuts for power users.
Vault locks after 5 minutes of inactivity, wiping decrypted data from memory. Sessions stay alive in the background — just re-enter your master password.
Authenticator apps (TOTP), email codes, and single-use backup codes. Layer your security how you want.
Your master password is never transmitted to our servers. We derive a separate authentication key for login and a separate encryption key for your vault. Even if we wanted to, we couldn't read your data.
One master password → two independent keys with different salts. The auth key proves who you are. The encryption key protects your vault. Compromising one reveals nothing about the other.
All encryption runs through the browser's built-in Web Crypto API — FIPS-validated, hardware-accelerated, constant-time. Zero third-party crypto libraries means zero supply-chain crypto risk.
Zero analytics, zero crash reporters, zero ad SDKs. No data is sent to any third party. We make money when you trust us — not when we sell your behavior.
We designed Lockstep to withstand the same attacks that have breached other password managers. Here's how each one is neutralized.
Attacker gets full database access.
Malicious script runs in the browser.
Attacker tricks browser into making authenticated requests.
Attacker tries millions of password combinations.
Attacker intercepts network traffic.
Attacker captures and replays a valid request or token.
Compromised dependency injects malicious code.
Fake site tricks user into entering credentials.
Lockstep keeps your passwords in sync across web, browser, and mobile — with the same zero-knowledge encryption on every platform.
Full vault management from any browser. Add, edit, organize, and share entries. Manage folders, account settings, and 2FA — all encrypted client-side.
Open Web AppOne-click autofill on any login page. Domain-aware matching blocks phishing. Inline password generator. Works in Chrome, Edge, and Chromium-based browsers.
Chrome Web Store Coming SoonBiometric unlock with Face ID and fingerprint. System-wide autofill on Android and iOS. Offline access to your vault with encrypted local cache.
Google Play Coming SoonCreate your account in 30 seconds. Your first vault entry is encrypted before it ever reaches our servers.
Create Your VaultFree to use · No credit card required · Zero-knowledge from day one