A password you draw, not type

Nobody can
watch youtype this.

Notes, files, photos and two-factor codes, behind a picture password. Letters and numbers float over your own photograph. You drag them until your character lands on your spot. Someone standing over your shoulder sees a fingertip cross a picture.

How it opens

no accountno serveryour vault stays with you

Two screens of the extension, one turned and floating in front of the other: the lock screen, a grid of letters and numbers over a photograph of a city at dusk asking you to drag your character onto your spot, and behind it the vault it opens, with folders and a two-factor code.

How it opens

Three things to choose, once.

After that, opening the vault is one drag per character. The grid is dealt again from scratch on every attempt, so no two unlocks look alike, and watching one teaches nothing about the next.

1
Your picture

One photograph, and every secret lives on it. Busy beats beautiful: a crowd or a skyline gives you landmarks only you would think of, where one big subject has everybody picking the same eye.
2
Two characters

From sixteen that cannot be misread: the digits, and A, C, E, H, K, N. B against 8 and O against 0 are gone, because a character you misread over a moving photo is a password you cannot enter.
3
Two spots

Drag the whole grid until your character sits on your landmark, then let go. Every one of them on the grid is the same character, so the one you are aiming with is not the one anybody can pick out.

What it holds

A vault, not a password manager with a gimmick.

Notes, files, photographs, logins and two-factor codes, in folders you name and colour. Codes tick over on the home screen. Logins fill on the page you are looking at, and the extension asks for no standing access to any website to do it: clicking the toolbar button is what lets it reach that one page, until you leave.

Nothing out of the vault is uploaded, and there is nothing to sign in to. The vault is a file on your own machine. The free Android app carries an ad, which is the one thing on this page that talks to anybody; it is two paragraphs down, and it is never given anything from in here.

The vault's home screen: folders for documents, photos, cards, passwords and notes, with a live two-factor code beneath them.

Inside a folder: two notes listed with a search box above them.

Backups

One encrypted file, and two ways back into it.

A backup holds every folder, including the ones you were not going to open today, and its size says what you keep rather than how many secrets you keep it in.

Seventeen written-down words open it anywhere, with no account and no passkey. A passkey and your picture password open it too, both together and never either alone, so a stolen phone with a known PIN is not a way round the drag.

The backup screen, listing the two ways to open a backup file: written-down words, always on, and a passkey with the picture password.

Said plainly

What a picture password is, and is not.

It defends against being watched, not against being guessed. Two characters on two spots is roughly sixteen bits, which is a keypad-sized secret. What it buys is that a shoulder, a camera or a screen recording comes away with almost nothing.
So it is not what does the encrypting. Your vault is sealed by a key held in the device's own secure hardware, or by your computer account in a browser. The picture password is what releases it.
Ten wrong drags and the copy erases itself. The wait between attempts grows first, and the last five are spent one at a time with the number on screen. Your words still open your backup.
A second password on the same picture opens a different folder, and nothing gives away that it exists. Same lock screen, same file size, no list of vaults anywhere. What it cannot hide is that the app can do this at all.
Nobody can reset any of it. No account, no server, no back door for us either. Lose both the device and the words and what is inside is gone.
The free Android app shows a banner, and that is the only thing that leaves. It appears on the folder screens and nowhere else, never where a password is typed and never beside anything out of a vault. Google gets what it gets for any ad: a device identifier and a rough location from your address. It gets nothing from the vault, because nothing hands it anything. Pro has no ads, and neither does the extension or the iPhone app.

Three apps, one mechanism

The same vault, opened the same way.

The phones run one implementation of the scheme, the archive format and the throttle, so nothing about how a vault opens exists twice. A browser cannot run that code, so the extension carries its own, and the two are held against each other by fixtures written from one and asserted by the other. A backup made on either opens on both.

Chrome extension

The vault in the side panel, filling logins on the page you are already looking at.

Android

Folders, notes, files and codes, with the key held in the Keystore and in StrongBox where the phone has it.

iPhone

The same mechanism again, with the key held by the Secure Enclave.

Nobody canwatch youtype this.