Zero-knowledge vault

Your access, behind a rampart.

SSH servers, mailboxes, websites, keys, tokens and crypto wallets. Everything is encrypted on your device before it is stored. Local, or synced everywhere with Cloud.

Download Rempar Watch the demo

macOS, iOS, Android, Linux. Free locally. 30-day Cloud trial.

SSH Mailboxes Websites Keys Wallets TOTP Notes
Rempar

Vault locked

Enter your master password

Unlock

or Touch ID

Features

One vault for everything that opens a door.

Seven categories, one encryption key per item, and security gestures that are never negotiable.

SSH servers

Host, port, user, password or private key, expected fingerprint. Everything needed to connect without searching.

Mailboxes and websites

Logins, passwords, secret questions, and the TOTP code right next to them when a service asks for one.

Keys and tokens

SSH keys, API tokens, certificates. Copied in one gesture, wiped from the clipboard 30 seconds later.

Crypto wallets

Recovery phrases and private keys, never copied whole, always shown in a slashed-zero typeface.

TOTP codes

30-second ring, codes grouped 3+3, Google Authenticator compatible. Your codes and passwords in one place.

Vault health

Weak, reused or old passwords. Known breaches checked with k-anonymity: only 5 hash characters ever leave the device.

Local or Cloud

You choose where your vault lives.

Both modes encrypt the same way, on your device. Cloud adds sync and backup without ever seeing your data.

Local

One encrypted file on this device only. No account, no server.

  • Free, unlimited items
  • Same encryption as Cloud
  • Printable recovery kit
  • Encrypted .rempart export
Subscription

Cloud

Encrypted here, synced everywhere. The server only receives sealed blobs.

  • Sync across Mac, iPhone, Android, Linux
  • Continuous backup and revision history
  • Account protected by Google Authenticator 2FA
  • Devices managed and revocable remotely
See pricing

Security

The secret stays on the device.

The Rempar server knows neither your master password, nor your keys, nor the name of a single item. It cannot lose them, read them or hand them over.

Argon2id

64 MiB of memory, 3 passes. Your master password becomes a key nobody can brute-force cheaply.

XChaCha20-Poly1305

Every item has its own key, sealed by the vault key. Opening one item decrypts only that item.

Zero knowledge

The server stores a hash of the authentication key and opaque blobs. Nothing else.

Recovery kit

13 groups of 4 characters, shown once. Without the password or the kit, nothing is recoverable, and we say so plainly.

Understand the security model

Everywhere

One vault, all your devices.

A single Flutter codebase, a layout that adapts from the phone to the three-pane desktop.

macOS · iOS · iPadOSUniversal Apple Silicon and Intel, Touch ID and Face ID
AndroidFingerprint, FLAG_SECURE against screenshots
Linuxx64 bundle with install.sh
WindowsComing soon
E2E syncRevisions, conflicts kept as copies, offline is normal.
Google Authenticator 2FARFC 6238 TOTP on your Cloud account.

Start locally. Move to Cloud whenever you want.

Same encryption, same vault. The Cloud subscription activates in the app, no migration.

Download Rempar Read the documentation