ClefVault
Agency operations + team password vault

Run the agency and hold the keys - in one workspace.

ClefVault pairs your clients, projects, invoices, expenses and renewals with an encrypted vault for logins, API keys and .env files - plus built-in 2FA codes and a browser extension that fills your passwords in one tap.

Start for freeTour the product
  • No card required
  • Free plan forever
  • Encrypted vault
6
Credential types
$0
To get started
4
Role levels
4
Plans
One workspace coversClientsProjectsInvoicesExpensesRenewalsVaultEnv varsReports

Encrypted everywhere

Your data is protected on its way to us and again while it's stored.

Built-in 2FA codes

Generate login codes on your own device - nothing is sent over the network to get one.

Breach checking

We can check a password against known leaks without ever sending the password itself.

You control who sees what

Owner, admin and guest roles - plus access granted project by project - mean a client or contractor only ever sees what you give them.

See it in 22 seconds

Run the agency. Hold the keys.

The vault, project-based access, invoices and renewals, and one-tap fill from the browser extension, in one short walkthrough.

0:22
Two jobs, one login

The parts of your day that never lived together

Most teams run a project tool, an invoicing tool and a password manager side by side. ClefVault is the workspace where those overlap - the same clients, projects and roles across both halves.

Agency operations

A CRM and billing stack sized for service work - not a repurposed sales tool.

  • Clients with project counts and lifetime revenue
  • Invoices built from billable expenses in a few clicks
  • Renewal tracking that flags what's expiring
  • Revenue, expense and renewal reports
Explore agency features

Team password vault

Typed, encrypted records with 2FA codes and a browser extension that fills in one tap.

  • Six credential types, all encrypted
  • Built-in 2FA codes - no separate authenticator app
  • One-tap autofill, 2FA code copied automatically
  • Import and export .env files in one click
Explore the vault
Agency side

Everything the delivery team touches

Clients and projects feed billing; billing feeds reports. Each list has search, status and tag filters, and create actions respect your plan's capacity.

Clients & projects
Keep every client and project in one place. Filter by status or tag and see project counts and lifetime revenue per client at a glance.
  • Search, status and tag filters on every list
  • Per-client project count + total revenue
  • Projects carry their own environments and tech stack
  • Everything organised per workspace, so nothing gets mixed up
Invoices & expenses
Log billable expenses, then turn a selection into an invoice in one step - line items and billing status always stay in sync.
  • Build an invoice from selected unbilled expenses
  • Monthly and yearly invoices repeat automatically and are emailed to the client when due
  • Mark paid or unpaid, with overdue tracking
  • Print a clean invoice or save it as a PDF
Renewals
Track domains, licences and subscriptions with an automatic status so nothing lapses unnoticed.
  • Status updates itself: active, expiring soon, expired
  • Category and search filters
  • Linked to the owning project
  • Dashboard widget and a notification for what's due next
Reports & activity
Revenue over time, expenses by category, renewals by status, plus a workspace-wide activity feed.
  • Revenue for each month, with the last 3, 6 or 12 months to choose from
  • Expenses grouped by category
  • Renewals grouped by status
  • Filterable activity log of who did what, and when - the last 7 days are kept, with CSV export on paid plans
Client portal
Give each client a private link that shows their projects and invoices - no login, no extra account for them to manage.
  • One shareable link per client, no client login needed
  • Shows project status and downloadable invoices
  • You're notified the first time a client opens their link
  • Revoke a link any time from the client's record
  • Included on every plan, including Free
Vault side

Secrets, organized - not one giant text box

Every login, API key, database credential and card has its own form with the right fields. Everything is encrypted, and secrets only show when you - or someone you've shared them with - choose to reveal them.

Typed credentials
Six record types - login, API key, database, SSH key, secure note, payment card - each with the right fields for that type, and all encrypted.
  • A proper form for each type, not one big text box
  • Encrypted the moment you save
  • Only revealed when you choose to view it
  • Filter by tag, project and environment
Built-in 2FA codes
Add 2FA to any login and get the 6-digit code right there - no separate authenticator app to juggle.
  • Set up by scanning a QR code or pasting a setup key
  • Live code with a countdown, right in the app
  • Extension copies the code the moment it fills a login
  • The 2FA setup key is encrypted, just like a password
Browser extension
One tap on a login that matches the site you're on fills the page - no extra confirmation step, and every credential type shows up in the popup.
  • One-tap fill for matching logins
  • Works on modern sites, not just simple login forms
  • 2FA code copied to clipboard on fill
  • Available for Chrome today; Firefox is on the roadmap
Environment variables
Keep your .env files in the vault instead of scattered across laptops. Import a whole file at once and export it back out just as easily.
  • Paste an entire .env file and everything is saved at once
  • Export back to a ready-to-use .env file
  • Empty values are fine - nothing gets rejected
  • Organize with folders and tags, share by folder
Password health
A report that flags reused, weak and year-old passwords, plus a check against publicly known data breaches - without ever exposing the passwords themselves.
  • Breach check never sends your full password anywhere
  • Shows what needs fixing without ever displaying your passwords
  • A single 0–100 health score, on every plan
  • Each person's report covers only the items they can see
Sharing & access
Three workspace roles, plus viewer, editor and project-admin access that guests get one project at a time - and sharing of single items or whole folders on top.
  • Owner, admin and guest roles; guests are limited to the projects they're added to
  • Share one credential, or a whole env folder, with chosen teammates
  • Guests can only share credentials they created themselves
  • Change or remove someone's access whenever you need to
Share links
Hand a single login to someone outside the workspace with a link that expires on its own - no account needed on their side.
  • Expiry of up to 24 hours, chosen when you create the link
  • Revoke a link early from the credential's list of links
  • Every link you create is recorded in the activity log
  • Only possible for items you're already allowed to see
Environments & tags
Group credentials by deployment stage and label everything with one shared set of tags, so the vault stays navigable as it grows.
  • Create your own deployment stages, such as development, staging and production
  • One tag list shared by credentials, env variables and clients
  • Filter the vault by project, environment or tag
  • Environments and tags are managed by owners and admins
Expiry alerts
Give a credential an expiry date and ClefVault surfaces it before it lapses - on the dashboard and in a weekly email to the owner and admins.
  • Expired and expiring-soon secrets listed on the dashboard
  • A weekly email digest for owners and admins
  • Works on every credential type, from logins to API keys and cards
  • Only secrets with an expiry date are tracked
How it works

From signup to autofill in four steps

  1. 01

    Create a workspace

    Sign up, verify your email, and your workspace is ready - you're set up as its owner.

  2. 02

    Bring in your work

    Add clients and projects, import your .env files in one click, and drop existing logins and API keys into the typed vault.

  3. 03

    Invite the team

    Invite people as admins or guests, then give each guest the projects they need. Every plan includes a fixed number of seats, so there's no per-user math to do.

  4. 04

    Install the extension

    Add the Chrome extension and matching logins autofill with one tap - the 2FA code lands on your clipboard at the same time.

Pricing

One price per workspace, with room to grow

Plans differ by capacity and by which reports, controls, and the browser extension unlock. Members are included in every tier, with per-seat add-ons on Pro.

Free

For solo freelancers

$0

Start for free
  • Clients, projects, expenses & invoices
  • Typed vault (logins, API keys, DB, SSH, notes, cards)
  • 2FA codes on logins
  • Environment variables with .env import & export

Starter

Unlocks the browser extension

$4

/ month
Request Starter
  • Everything in Free
  • Browser extension with one-tap autofill
  • Activity log CSV export
  • More projects, clients & vault room
Most popular

Pro

For growing agencies

$29

/ month
Request Pro
  • Everything in Starter, with more capacity
  • Extra seats beyond 10, billed per seat
  • Priority support

Enterprise

For large teams

$49

/ month
Talk to sales
  • Everything in Pro, with no ceilings
  • Unlimited clients, projects & secrets, up to 200 members
  • White-label: custom domain, no ClefVault branding (roadmap)
  • Dedicated onboarding & SLA
Compare every plan
Questions

Common questions

Start free, invite the team when you're ready.

No card required. Every plan includes a fixed number of seats, so there is no per-user math to do.

Get startedSee pricing