Get started
Open sourceAGPL-3.0

The password manageryour team owns.

End-to-end encrypted passwords and keys for small teams and their agents. One click to deploy, on your own Cloudflare.

Deploy to CloudflareRead the docs
On your device
On the server
"vaultId""vlt_4f9c2a7e""wrappedKey""""data"""

Even the name is encrypted. Type to see it change.

The app

Everything your team shares.In one calm place.

The Engineering vault in vauly, with the AWS root login open: username, hidden password, a live one-time code and the website.

Vaults for every team

A private vault for each person. Shared vaults for everything else.

⌘K to anything

Copy a password without opening it. The clipboard clears in 90 seconds.

Every kind of secret

Logins with one-time codes, API keys, SSH keys and notes.

Sharing

Share vaults,not passwords.

And know exactly what to rotate when someone leaves.

  • Each vault key is sealed for each member. The server can't add anyone.
  • Admins invite and grant access. Members just use it.
  • When someone leaves, vauly lists what they could open.
Engineering18 items · 3 people
Give access
  • AK
    Alex KimYou
    Owner
  • RC
    Riley ChenSince March
    Admin
  • JP
    Jordan ParkSince August
    Member
Sam Lee left · could open 3 items
  • GitHubUnchanged for 214 days
    Change
  • Stripe live keyUnchanged for 61 days
    Change
  • FigmaUnchanged for 33 days
    Change
Agents and scripts

Agents use your secrets.They never see them.

Coding agents, scripts and CI get values at runtime. Nothing sits in plain text.

~/acme/api
Claude Code wants Postgres · stagingFor bun test api · just now
DenyFor 1 hourAllow once
  1. 1

    Reference, don't paste

    Your .env holds vauly:// references. Nothing in it can leak.

    DATABASE_URL=vauly://itm_7Gk2qXb9
  2. 2

    Run through vauly

    Values go straight into the process, masked in its output.

    vauly run -- bun test api
  3. 3

    A person says yes

    Each new item waits for someone to allow it, once or for an hour. Pause an agent anytime.

  4. How agents work →
Browser extension

Fills where you sign in.Saves what you type.

  • Choose vauly's mark in any login field to fill.
  • Sign in somewhere new and it offers to save.
  • The site can't read the menu. It's vauly's own frame.
Sign in to Linear
Email
you@company.com
  • Linearalex@acme.exampleFill
  • Linear (admin)ops@acme.example
Logins for linear.app
Password
Continue

Forgot your password?

The details

Small things,done properly.

  • 2weak passwordsReview
  • 1used in two placesReview
  • 3seen by someone who leftReview

Password health

Weak, reused and exposed passwords, worked out on your device.

482913
30s

Two-step login

A code from your phone, with recovery codes for a bad day.

acme.example/s/7Gk2#Q2xqZ8vN…
Alex shared an item with youShow the itemOpens once · expires in 59 min

Share links

Send one item to anyone. It expires, and the server can't open it.

  • Alex copied the password for GitHub2m
  • Claude Code used Postgres · staging8m
  • Riley revealed Office Wi-Fi1h
  • Jordan shared Figma3h
  • Alex removed Sam from Engineering1d

Every use, on the record

Reveals, copies, shares and agent runs, in one activity log.

Moved to Recently deletedUndo

Hard to lose things

Thirty days to undo a delete. Old passwords stay under Earlier.

vauly

Move in from anywhere

Import from 1Password, Bitwarden, LastPass and your browser. Export any time.

Light and dark, ⌘K everywhere, and it installs on your phone.

Security

The server can't read it.Not even the names.

Every item is sealed in your browser before it's saved. Your master password is the only key, and only you hold it.

  1. Master passwordNever leaves your device
    PBKDF2-SHA256 · 600,000 rounds
  2. Master keySplit by HKDF into a sign-in key and a wrap key
    Wrap key opens
  3. Your private keyECDH P-256
    Opens what teammates shared
  4. Vault keyAES-256-GCM, one per vault
    Wraps
  5. Item keyAES-256-GCM, one per item

Encrypted, out of the server's reach

  • Item names, usernames and passwords
  • Notes, websites and one-time code secrets
  • Vault names
  • Your private key and every vault key

What the server does see

  • Emails, names and roles
  • Who can open which vault
  • When items are used

Open source and small enough to read, but not independently audited yet.Read the model and its limits →

Self-hosting

One click.On your Cloudflare.

No vauly cloud, no account with us. A small team fits in Cloudflare's free plan.

  1. 1
    Deploy to CloudflareConnect GitHub. Cloudflare copies vauly into a repository of yours and builds it.
  2. 2
    Choose a setup codeOnly you know it, so nobody claims your vauly before you do.
  3. 3
    Claim itOpen the setup link, create your workspace, invite your team.
  4. 4
    Stay currentRun Update vauly in your repository's Actions. Cloudflare deploys it.
Deploy to CloudflareThe full guide →
Deploy to Cloudflare
Deploying vauly to your Cloudflare accountRepositorygithub.com/acme/vaulyDatabaseD1 · vaulyWorkerapp and API · vaulyYour vauly is ready:https://vauly.acme.example/setup?code=…
Questions

Fair questions.Straight answers.

More in the docs →
Is vauly free?

Yes. It's open source under AGPL-3.0. You only pay for your own Cloudflare account, and a small team usually fits in the free plan.

Can anyone at vauly see our data?

There's no one to ask. There is no vauly cloud: it runs on your Cloudflare account, and even that server only ever stores ciphertext.

What if I forget my master password?

Nobody can reset it, not even an admin. It's the only key to your items. An admin can invite you again so you start over, which is why vauly asks you to print an Emergency Kit.

What happens when someone leaves?

Remove them and their copies of the vault keys are deleted. vauly then lists every item they could open, so you can change what matters.

Can we move from 1Password or Bitwarden?

Yes. Import their CSV exports, or Chrome's, Firefox's and Safari's. You can download a full backup any time, too.

Has it been audited?

Not yet. The design is small and documented, and every line of code is open to read.

Own your secrets.Deploy in one click.

Free, open source, and running on your own Cloudflare.

Deploy to CloudflareStar on GitHub