Per-Device Encryption
In Vauz, each password gets its own encryption key, and the vault key is sealed by your Mac's Secure Enclave, or by your V-Key if you set one
In Vauz, each password gets its own encryption key, and the vault key is sealed by your Mac's Secure Enclave, or by your V-Key if you set one
Your vault lives on your Mac. No server outages, no internet dependency, no subscription lock-in. Access your passwords anytime, in any location
Two layers, both industry standard: XChaCha20-Poly1305 over the whole vault file, and every entry sealed again under a key of its own
Vauz itself never sends your vault anywhere. No cloud, no sync, nothing to breach at our end. Backups go to the folder you choose
Out of the box your Mac's Secure Enclave opens the vault, with nothing to remember. Set a V-Key and it opens with that on any Mac running Vauz 2. Forget it and nobody can reset it, not even Sealzi
Argon2id for your V-Key and encrypted exports, and BLAKE3 to derive the key for everything sealed in the vault file. Well-studied, published algorithms, no homegrown cryptography
Before filling a login, the browser extension checks the address you are really on. An address disguised as a well-known site gets no autofill, and a near-miss gets a warning first. Checked inside the extension, and nothing leaves your device
With Vauz, you can securely generate, store, and access your passwords with ease. We've designed the app with a clean and responsive interface, and the Vauz 2 beta runs on a Mac with Apple silicon and macOS 14 or later, with every feature free during the beta. Your data is encrypted, giving you peace of mind knowing your sensitive information is always protected!
Absolutely! Vauz works without an internet connection: your vault lives on your Mac, and with
No outbound requests turned on the app sends nothing unless you ask it to.
Every feature is free during the Vauz 2 beta, which ends on 31 December 2026. After it, Vauz
has a free plan with the essentials, and you can upgrade to our
Plus or Premium plans to unlock additional features.
The Plus plan is available for CAD 4.70 per month, and the Premium plan is available for CAD 7.60 per month
Vauz is built for logins: the sites, usernames and passwords you keep. Each entry can also carry a short note, encrypted with the rest of the entry
No. If you don't set one, your vault unlocks without a password whenever you open Vauz while you're signed in to your Mac. Your Mac's login password and its Secure Enclave still protect your Vauz vault while the Mac is locked or off, and a copy of your files can't be opened on another computer.
Set a V-Key if anyone else can use your Mac while you're signed in: a shared or family Mac, a Mac you leave unlocked, remote-access software, or apps you don't fully trust. With a V-Key, Vauz stays locked to them until you unlock it with your V-Key or Touch ID. By default it locks again after five minutes unused, a minute after you switch away, and when your Mac locks or sleeps. Premium lets you change these times, and Plus lets you turn them off.
A V-Key also opens the vault on any Mac running Vauz 2. A backup made as a copy opens with the V-Key it had when it was made, and one made as an export with its own passphrase. Each guess at a V-Key is made slow on purpose. Forget it and nobody can reset it for you, not even Sealzi — see our threat model for what each way does and does not cover
You can easily cancel your subscription through Vauz portal. Alternatively, you may terminate it at any time upon written notice via email. Upon termination, you must cease all use of the Software and destroy all copies in your possession as per the terms of the agreement
No. Vauz itself never sends your vault anywhere: it is kept on your own device and never reaches our servers, and backups go to the folder you choose. There is no setting that changes this today, because there is nothing to switch on: encrypted cloud backup, cross-device sync and password sharing are planned, not shipped. When they arrive they will be opt-in, and we will say so here rather than quietly enabling them
The vault file is encrypted as a whole with XChaCha20-Poly1305, and every entry inside it again under a key of its own. What opens it depends on how your vault opens.
A vault that opens on its own has its key sealed by your Mac's Secure Enclave, so the file on its own does not open on other hardware, and time spent with it elsewhere does not change that. A vault with a V-Key opens with that V-Key on any Mac running Vauz 2, so there the V-Key is the defence: each guess at it is made slow on purpose, and a V-Key nobody can guess is what keeps the file closed.
Neither is a substitute for your operating system's disk encryption — turn on FileVault. They deny the file, not the machine: someone who images your whole drive has taken more than the file.
On the original machine it is a different question, and we would rather be straight about it: anything already running as you on your own computer is inside the boundary. A V-Key raises the bar there, but does not remove it. Section 4 of the threat model sets out exactly which attackers this design stops and which it does not
Yes. Your browser keeps passwords in its profile, readable by anything running in the browser, and syncs them to the vendor — one bad extension reaches all of them. A cloud manager holds your vault on its servers. Should a breach happen, attackers guess master passwords offline, with no rate limit. We hold no vaults.
And a master-password vault is portable. A Vauz vault that opens on its own is sealed by your Mac's Secure Enclave, and the file on its own does not open on other hardware. One with a V-Key opens anywhere else only with that V-Key, and every guess at it is made slow on purpose.
Neither is a substitute for your operating system's disk encryption. An attacker who takes a full image of your drive, or who can run code on your machine, is covered by section 4 of our threat model rather than by this
Contact Us