Your team’s credentials.
Locked down properly.
Stop sharing passwords over Slack. HexVault gives your team a zero-knowledge shared vault with structured offboarding, an AI that catches problems before they become incidents, and setup that takes an afternoon — not a project.
Whether it’s just you
or your whole team.
HexVault works for a solo developer who wants proper personal security, and for a 150-person company that needs shared vaults, access controls, and a proper audit trail.
Your digital life, properly secured.
One vault for every password, card, and note. Live breach alerts, built-in 2FA codes, a browser extension that actually works, and an AI that tells you exactly what’s at risk.
- Unlimited passwords, notes & 2FA codes
- Live breach monitoring (k-anonymity)
- HexGuard AI security assistant
- Encrypted one-time share links
- Emergency vault access for someone you trust
The security your team actually deserves.
Shared vaults with role permissions. Structured offboarding when someone leaves. JIT access for contractors. A daily AI briefing for your admin. Set up this afternoon.
- Encrypted shared folders with folder RBAC
- Offboarding workflow + credential rotation tasks
- Just-in-time temporary access grants
- Full audit log & compliance PDF export
- Service accounts for CI/CD pipelines
- SCIM provisioning (Okta, Azure AD, Google)
The three things that keep
IT admins up at night.
Someone leaves. You disable their account. But the AWS keys, Stripe live key, domain registrar login — they’ve seen all of it. You hope they didn’t copy anything.
Offboarding workflow. When you remove a member, HexVault shows every credential they accessed in the last 90 days, creates rotation tasks with assignable owners, and revokes their cryptographic key.
Your contractor needed database access for a sprint. You added them two months ago. They’re still in there. You have no log of what they accessed.
Just-in-time access. Grant temporary folder access for a defined window — 4 hours to 1 week. Expires automatically. Every access is logged. No more manual cleanup.
Your AWS root key hasn’t been rotated since 2021. Three ex-employees have seen your Stripe live key. You know you should fix this but there’s no system for it.
Rotation enforcement. Set a rotation policy. HexVault tracks which credentials are overdue, who owns them, when last changed. HexGuard surfaces the list every morning.
The only AI that knows your actual vault.
Every other AI security tool answers generic questions. HexGuard queries your real vault data — breach counts, rotation gaps, access patterns, open alerts — and reasons from it. Specific intelligence, not generic advice.
Your vault is in reasonable shape — one item needs attention today.
🔴 Cloudflare — this credential appears in 847 known breach datasets. Change it and update any services using it.
🟡 AWS Console & PostgreSQL — both last rotated 4 months ago, outside your 90-day policy.
🟢 Everything else looks solid. Security score: 87.
Want me to walk you through fixing the Cloudflare breach?
The only extension
that stops phishing
before you type.
Every other password manager waits for you to try autofilling — then silently refuses because the domain doesn't match. HexVault's extension actively detects suspected phishing sites and warns you before your cursor reaches the password field.
paypa1.com vs paypal.com — we catch it. Scored against your actual saved credentials, not a generic blocklist.stay safe
Three steps, all on your device. The server never sees anything it can decrypt.
You enter your master password
Your password is passed through Argon2id with 64 MB of memory — making GPU attacks 1,000× more expensive. The derived key is marked non-extractable by your browser. No JavaScript can read it back.
Every entry is encrypted independently
Each password gets its own fresh 96-bit IV. AES-256-GCM encrypts and authenticates in one pass — any tampering is detected and rejected. The key lives only in your browser's memory.
Server stores only ciphertext
We receive base64(ciphertext) and base64(IV). No master password, no encryption key, no plaintext — ever. A full database dump is computationally useless to an attacker.
SEE IT IN ACTION.
No account needed. Everything here runs in your browser — nothing is saved or transmitted.
ENCRYPTION THAT STARTS ON YOUR DEVICE.
Most tools encrypt on their servers. HexVault encrypts on yours — before anything leaves your browser. We receive ciphertext. Only ciphertext. There is no architectural path for us to read your passwords.
BUILT TO PROTECT.
DESIGNED TO USE.
departure away from a breach
Compare how your current setup stacks up against a properly secured team vault.
| Situation | Spreadsheet / Slack | Basic password manager |
HexVault Team
|
|---|---|---|---|
| Sharing credentials | Exposed in chat or email | Shared folder, limited control | Encrypted team vault, folder RBAC |
| Someone leaves | Manual — usually missed | Delete account, hope for the best | Offboarding workflow + rotation tasks |
| Breach monitoring | None | Basic alerts, no triage | Live monitoring + AI explanation |
| Audit trail | None | Limited or paid add-on | Full credential access log |
| Encryption | None — plaintext | Varies — server-side often | Zero-knowledge AES-256-GCM |
| Cyber insurance evidence | None | Screenshots at best | One-click compliance PDF |
| Browser extension | None | Autofill only — no phishing detection | Autofill + active phishing detection |
| Setup time | Immediate | Hours to days | Under an hour |
WE CANNOT READ YOUR DATA.
BY DESIGN.
This is not a promise — it is a mathematical constraint. Without your master password, our database contains nothing useful to anyone.
SECURITY YOUR
IT TEAM CAN ENFORCE.
Full visibility across your organisation's credential posture — without touching a single employee's personal vault. Two cryptographic domains. Zero ambiguity about what belongs to whom.oing the work.
Let's Talk.
WHAT'S BUILT. WHAT'S NEXT.
HexVault ships continuously. No fixed dates — we release when it's right, document everything, and move fast without breaking things that matter.
GET HEXVAULT
ON ANY DEVICE.
Native desktop apps for Windows, macOS and Linux. Mobile apps install straight from your browser — no App Store needed.
STRAIGHTFORWARD PRICING.
NO FREE TIER. NO TRICKS.
Every plan is fully featured from day one. If you're serious about security, this tool is worth paying for. Try any plan for 14 days — no card required.
- Unlimited passwords & secure notes
- Zero-knowledge AES-256-GCM encryption
- Live breach monitoring (k-anonymity)
- Built-in TOTP authenticator
- Encrypted one-time share links
- Decoy entry (honeypot) alerts
- Everything in Personal
- HexGuard AI security engine
- Full security analytics dashboard
- Activity log & audit trail
- PDF security reports
- Emergency access
- Priority support
- Everything in Pro
- Up to 6 family members
- Shared family vault
- Individual private vaults
- Family member management
- Shared breach monitoring
- Full Pro account per seat
- Encrypted shared folders with role permissions
- Structured offboarding + credential rotation
- HexGuard AI security briefings
- Team audit log & compliance PDF
- Up to 50 members
- Everything in Team
- Enterprise SSO / SAML 2.0
- SCIM provisioning & directory sync
- Dedicated account manager
- SLA & priority support
- Unlimited members
JOIN EARLY.
SHAPE WHAT WE BUILD.
HexVault is in active development. Early access members get founding pricing when we launch — and direct input on the product roadmap. One email when we go live. Nothing else.