ClefVault
Vault & Extension

Every password, key and secret - organized, not just stored

The vault has a proper form for each of six credential types, all encrypted the moment you save. The Chrome extension fills matching logins the moment you click, and copies the 2FA code at the same time.

Create a vaultHow it is secured
Add to Chrome

Credential types

  • LoginUsername, password, URL - plus optional 2FA
  • API keyKey, secret, URL and scopes
  • DatabaseHost, port, user, password, database name
  • SSH keyPrivate key, passphrase, host
  • Secure noteFree-form encrypted text
  • Payment cardNumber, expiry, CVV, cardholder

Encrypted everywhere

Your data is protected on its way to us and again while it's stored.

Built-in 2FA codes

Generate login codes on your own device - nothing is sent over the network to get one.

Breach checking

We can check a password against known leaks without ever sending the password itself.

You control who sees what

Owner, admin and guest roles - plus access granted project by project - mean a client or contractor only ever sees what you give them.

What's inside

Vault capabilities

Typed credentials
Six record types - login, API key, database, SSH key, secure note, payment card - each with the right fields for that type, and all encrypted.
  • A proper form for each type, not one big text box
  • Encrypted the moment you save
  • Only revealed when you choose to view it
  • Filter by tag, project and environment
Built-in 2FA codes
Add 2FA to any login and get the 6-digit code right there - no separate authenticator app to juggle.
  • Set up by scanning a QR code or pasting a setup key
  • Live code with a countdown, right in the app
  • Extension copies the code the moment it fills a login
  • The 2FA setup key is encrypted, just like a password
Browser extension
One tap on a login that matches the site you're on fills the page - no extra confirmation step, and every credential type shows up in the popup.
  • One-tap fill for matching logins
  • Works on modern sites, not just simple login forms
  • 2FA code copied to clipboard on fill
  • Available for Chrome today; Firefox is on the roadmap
Environment variables
Keep your .env files in the vault instead of scattered across laptops. Import a whole file at once and export it back out just as easily.
  • Paste an entire .env file and everything is saved at once
  • Export back to a ready-to-use .env file
  • Empty values are fine - nothing gets rejected
  • Organize with folders and tags, share by folder
Password health
A report that flags reused, weak and year-old passwords, plus a check against publicly known data breaches - without ever exposing the passwords themselves.
  • Breach check never sends your full password anywhere
  • Shows what needs fixing without ever displaying your passwords
  • A single 0–100 health score, on every plan
  • Each person's report covers only the items they can see
Sharing & access
Three workspace roles, plus viewer, editor and project-admin access that guests get one project at a time - and sharing of single items or whole folders on top.
  • Owner, admin and guest roles; guests are limited to the projects they're added to
  • Share one credential, or a whole env folder, with chosen teammates
  • Guests can only share credentials they created themselves
  • Change or remove someone's access whenever you need to
Share links
Hand a single login to someone outside the workspace with a link that expires on its own - no account needed on their side.
  • Expiry of up to 24 hours, chosen when you create the link
  • Revoke a link early from the credential's list of links
  • Every link you create is recorded in the activity log
  • Only possible for items you're already allowed to see
Environments & tags
Group credentials by deployment stage and label everything with one shared set of tags, so the vault stays navigable as it grows.
  • Create your own deployment stages, such as development, staging and production
  • One tag list shared by credentials, env variables and clients
  • Filter the vault by project, environment or tag
  • Environments and tags are managed by owners and admins
Expiry alerts
Give a credential an expiry date and ClefVault surfaces it before it lapses - on the dashboard and in a weekly email to the owner and admins.
  • Expired and expiring-soon secrets listed on the dashboard
  • A weekly email digest for owners and admins
  • Works on every credential type, from logins to API keys and cards
  • Only secrets with an expiry date are tracked
Autofill

One click. No extra confirmation step.

Open the extension, see every login that matches the site you're on, and click one to fill the page. There's no separate 'autofill' button to go hunting for.

One tap fills

Click a matching login and it fills the page instantly. Need to see the full details first? Open the record from the same list.

Works on any site

Fills work on modern sites too, not just simple forms - the site sees the fill exactly as if you'd typed it yourself.

2FA on the clipboard

If the login has a 2FA code set up, it's generated and copied to your clipboard the instant the fill completes.

Add to Chrome

Chrome is available today. Firefox is on the roadmap.

Security

How the vault is secured

The short version: your data is encrypted in transit and in storage, secrets stay hidden until you reveal them, and nothing is shared unless you choose to share it.

Protected on the way in and in storage

Everything you send is encrypted before it leaves your browser, and everything we store is encrypted too. Anyone watching the connection, or getting hold of a backup, sees nothing they can read.

Secrets stay hidden until you ask

Passwords and keys stay masked on every screen and list. They're only shown when you deliberately reveal one - and only to people who are allowed to see it.

2FA codes, protected like a password

The secret behind your 2FA codes is stored encrypted, just like a password. The 6-digit code itself is generated on your device, so it never has to travel anywhere.

Breach checks without exposing your password

We can tell you whether a password has appeared in a known breach without ever sending the password itself. The check can't reveal what your password is.

Sharing is always on purpose

Guests only see credentials they created, ones shared with them and ones inside projects they belong to. Nothing is visible by default just because someone joined the workspace.

The extension can't be used to skip your permissions

The browser extension checks the same access rules as the web app. It can only ever show you the credentials you're already allowed to see.

Move your logins and .env files in today

Import an entire .env file in one click, drop your API keys into typed records, and add the extension.

Get startedSee pricing