Detailed answers about how Lock My Vault works, how your data is protected, and how to use every feature.
Lock My Vault is a free, open-source password manager that runs entirely in your browser. It stores all your passwords in a single encrypted file — your .vault file — that lives on your device, not on any server.
There is no account, no cloud sync, no tracking, and no backend. The app is a single HTML file — you can open it in any modern browser and it works completely offline.
Yes, completely free. There are no premium tiers, no subscriptions, no hidden costs, and no ads. Lock My Vault will always be free.
If you find it useful, you can support development by buying a coffee — but it is never required.
The master password is never stored anywhere — not on your device, not on any server. It only exists in your memory. This is what makes Lock My Vault truly private: no one can ever hand over your passwords because no one ever has them.
Recommendation: Write your master password on paper and store it somewhere physically secure, separate from your .vault file.
Yes. The .vault file is fully encrypted — without your master password it is indistinguishable from random noise. Even if someone gains access to your Dropbox, Google Drive, or iCloud, they cannot read your passwords.
Yes. Once the page loads in your browser, no internet connection is needed. All encryption, decryption, and 2FA code generation happens locally on your device.
You can install Lock My Vault as a Progressive Web App (PWA) for a native app experience:
Lock My Vault uses a multi-phase key derivation process followed by AES-256-GCM encryption:
AES-256-GCM is an authenticated encryption mode — it not only encrypts your data but also detects any tampering. The entire vault is encrypted as a single blob — metadata, entry names, passwords, everything.
Every time you save, Lock My Vault computes a SHA-256 hash of your vault contents and stores it inside the encrypted payload. When you open the vault, it recomputes the hash and compares.
If the hashes don't match, a warning banner appears: the file may have been modified outside the app. This could indicate tampering or file corruption.
Never. The app uses a strict Content Security Policy header:
connect-src 'none'This blocks all outbound network requests at the browser level. Even if malicious code were somehow injected into the page, it physically cannot send your data anywhere. Not to a server, not to an analytics service, not anywhere.
The encryption is mathematically sound — the only realistic attack is guessing your master password. A strong password is the single most important factor in protecting your vault.
correct-horse-battery-stapleA decoy vault is a second, separate vault hidden inside the same .vault file. It opens when someone enters a different password — showing fake or harmless entries instead of your real passwords.
This protects you in situations where someone forces you to unlock your vault — you give them the decoy password, they see a realistic but harmless vault, your real data stays protected.
Yes. Open the Decoy Vault panel from the sidebar. If a decoy already exists, you will see options to either remove it or replace it with a new one.
When you enable 2FA on a website, they show you a QR code and usually also a text-based secret key (a Base32 string like JBSWY3DPEHPK3PXP). This secret, combined with the current time, generates the 6-digit codes.
Lock My Vault stores this secret key encrypted in your vault. When you click the 🔑 button on an entry, it generates the live code locally using pure JavaScript — no network request is ever made.
When setting up 2FA on a website, look for one of these options:
The key will be a string of letters and numbers, usually 16–32 characters long. It may have spaces for readability — Lock My Vault will strip them automatically.
TOTP codes are time-based — they depend on your device clock being accurate. If your code is rejected:
Secure notes are for sensitive text that doesn't fit a password entry — anything you want encrypted but isn't a username/password pair:
Yes. Secure notes are stored inside the same .vault file as your passwords, encrypted with the same master password and AES-256-GCM algorithm. There is no difference in security between a password entry and a secure note.
Every time you click Save, a new file is downloaded with an incremented version number:
vault_v1.vault → vault_v2.vault → vault_v3.vaultThe version number is stored inside the encrypted vault — so it survives file renames. Even if you rename vault_v3.vault to mypasswords.vault, the app still knows it is version 3 and will save the next version as mypasswords_v4.vault.
Always keep the highest version number — that is your most recent vault. Older versions can be deleted once you confirm the latest one opens correctly.
personal_vault_v12.vault and keep older versions as backups for at least a few days.Yes. Open your vault, go to the sidebar and click ⬇ Export Passwords. You can choose between two formats:
Your .vault file is AES-256-GCM encrypted — without your master password it is indistinguishable from random data. You can store it anywhere safely.
Recommended backup strategy (3-2-1 rule):
The app is open source — you can read every line of code and see exactly how it works. No secrets, no black boxes.
🔒 Open App — It's Free