Passwords, API keys, SSH keys, recovery codes and contractor secrets — all encrypted client-side before they leave your browser. The server sees only ciphertext.
One vault for every type of credential. No more Google Docs, Slack DMs or unencrypted spreadsheets.
Username, password and TOTP seeds — all encrypted.
Store and organise every API key with notes and tags.
Private keys stored encrypted, never visible to the server.
2FA backup codes safe and accessible when you need them.
Encrypted free-text notes for anything sensitive.
Share secrets with teammates and contractors securely.
Invite contractors with read-only access. Give admins the ability to manage secrets. Off-board members and trigger rotation checklists when someone leaves.
Every create, update, delete, view and copy event is logged. Security health checks surface stale secrets, missing MFA and suspicious access patterns.
Start monitoringIt means SealedKeys never has access to your plaintext secrets. Your vault key is derived entirely in your browser from your master password using PBKDF2. Every secret is encrypted with AES-256-GCM before it leaves your device. Our servers store only encrypted ciphertext — even if our database were breached, attackers would find nothing readable.
LastPass and Bitwarden are well-known password managers with broad personal and business use cases. SealedKeys takes a more focused approach: it is built for small technical teams that need to manage passwords, API keys, SSH keys, deployment tokens and contractor access in one place.
SealedKeys includes organisation-level vaults, granular roles, contractor offboarding and audit visibility from the start, with simple pricing from £1.99/user/month.
Yes. SealedKeys supports five secret types: website logins, API keys & tokens, SSH private keys, recovery codes, and secure notes. All are encrypted identically using AES-256-GCM.
Because SealedKeys is truly zero-knowledge, we cannot recover your vault. Your master password is never transmitted to our servers in usable form. We strongly recommend writing it down and storing it in a secure physical location. Emergency recovery via a trusted contact is on our roadmap.
Yes — this is a core use case. You can invite contractors with Read-only or Member roles, scoped to a specific organisation vault. When they leave, remove their access and use the offboarding checklist to rotate secrets they had access to.
SealedKeys runs on Hetzner infrastructure in the EU. All data in transit is protected by TLS 1.3. At rest, your secrets are stored as AES-256-GCM ciphertext. We never transfer data outside the EU.
Free to start. No credit card. Zero-knowledge from day one.
Create free vault