Password Vault

Store logins, notes, API keys and SSH keys, encrypted in your browser before they reach Magpie.

Password Vault holds six kinds of record, from a login with its two-factor code to an SSH key or a list of recovery codes. Your browser encrypts each record before it is saved, with keys that only your vault password or your recovery key can open. Magpie stores the encrypted result and cannot read a record's title, its type or any value in it.

Get started free

Six kinds of record

Choose the kind under New item. Every record also has notes and tags, and can be marked as a favorite.

Login
A username, password and website. A login can also show the two-factor code a website asks for after the password, generated in your browser from the QR code or setup key you add.
Secure note
A title and private text.
API credential
The service, API key, API secret and endpoint. Save in Password Vault, on the access token page in Git Repositories, opens a new API credential with the token filled in.
SSH key
The private key, public key and passphrase. Paste an OpenSSH private key and the public key will be filled in from it, or choose Generate key for a new Ed25519 key made in your browser.
Recovery codes
The service and its list of codes, hidden until you choose Reveal.
Custom item
Fields you name yourself. Mark a field Concealed and it will be hidden like a password.

How the encryption works

Setting up Password Vault creates a random key for your vault in your browser. Your vault password is turned into a second key with Argon2id, a method that takes a set amount of memory and time for each attempt, which slows anyone guessing passwords against a copy of the encrypted data. That key encrypts your vault's key, and your recovery key encrypts a second copy. Magpie stores the encrypted copies, never the vault password or the recovery key.

Each record is encrypted with its own random key, using XChaCha20-Poly1305 from the libsodium library, and that key is encrypted with your vault's key. XChaCha20-Poly1305 also detects any change to the encrypted data, so a damaged record fails to open instead of showing wrong values.

Magpie can see that a record exists, its size and when it changed. Its title, type, tags and every value in it are encrypted. Search, import, two-factor codes and the password generator run in your browser too, so nothing you search for, import or generate reaches Magpie unencrypted.

Unlocking and locking

Your vault password is separate from your Magpie password. Unlocking applies to one browser tab: a new tab starts locked, and an unlocked tab stays unlocked when you reload it or open another part of Magpie and come back.

The vault locks after 15 minutes without activity, or after another time you choose at the top of the list, up to an hour. It locks at once when you choose Lock or press Ctrl+L, and when you sign out. Locking clears the keys from the tab and deletes nothing.

To stay unlocked across a reload, the tab keeps an encrypted copy of its key, and Magpie holds the key to that copy only until the vault locks. Magpie never has the copy itself.

Secure Files protects its files with the same key, and a tab with Password Vault unlocked has Secure Files unlocked too. If you forget the vault password, your recovery key will let you choose a new one.

Password generator

Generate password, under a login's password field, suggests a password made with your browser's secure random number generator. Change the length or the characters, or choose Regenerate, for another.

Characters
Uppercase, lowercase, numbers and symbols, each on or off. Avoid ambiguous characters leaves out I, l, 1, O, 0 and o.
Saving
Use this password puts the suggestion in the field. On a saved login, nothing will change until you choose Save password, and the password it replaces will move to Password history.

Search, tags and copying

Search
Search matches a record's name, tags and every value that is not concealed, in the records already decrypted in your browser. What you type is not sent to Magpie.
Tags as folders
Give a record one or more tags. The Tags row above the list shows each tag with how many records it holds; choose one to show only those. Select several records to add or remove a tag together.
Copy
Copy, at the end of each row, copies a username, password, API key or public key without opening the record. A concealed value is copied without being shown.

Import from another password manager

Import passwords, under More, reads a CSV export from Google or Chrome Password Manager, Bitwarden or 1Password, or a generic CSV file. The file is read in your browser and is not uploaded to Magpie.

  1. Review the rows

    Every row will be listed before anything is saved. A row with the same website and username as a record already in the vault, or the same title, will be marked Possible duplicate and left unselected.

  2. Two-factor setup keys

    Setup keys in Bitwarden, 1Password and generic exports will be imported with their logins.

  3. Import selected items

    Each selected row will be encrypted in your browser and saved as a record.

Set up your Password Vault.

Create a Magpie account, open Password Vault, choose a vault password and save your recovery key.

Create account