Offline vault · bookmarks, logins, servers

Your bookmarks and passwords, sealed before they touch the disk.

One place for the sites you use, the accounts you sign in with, and the machines you connect to. Everything is encrypted on your own computer with a key only your password can produce. No account, no cloud, and nothing to switch off.

AES-256-GCM
Works offline
No telemetry
Optional self-hosted sync

Download

Released 18 August 2026

Pick the file for your system. Every build below is the same application.

Linux AppImage Runs on any distribution. Nothing is installed system-wide. 121 MB · x86_64 Linux Debian package For Debian, Ubuntu and derivatives. Adds a menu entry. 95 MB · x86_64 Windows Installer Windows 10 and 11, 64-bit. Choose your own install location. 95 MB · x86_64

Check the file before you run it

This is software you are about to trust with passwords, so verify that what arrived is what was published. Compare the hash of your download against the value listed here — if they differ, delete it and try again.

# Linux and macOS
sha256sum "<file>"

# Windows PowerShell
Get-FileHash "<file>" -Algorithm SHA256

Bookmark Vault-0.1.1-x86_64.AppImage 0ef3de7e2c9e37224898934a12aa2067cd1cd3dceb2835ac656d1408302dd3ca

bookmark_0.1.1_amd64.deb d641697b3e6a9649843719b443800585685b966f6babfe0092155a64959f70f0

Bookmark Vault Setup 0.1.1.exe 26c97248c55113b4fa804b8e2472fd3e64333af28f4660671bede9017665ea48

Installing

What to expect the first time

Linux — AppImage

Nothing is installed system-wide. Make it executable and run it:

chmod +x "Bookmark Vault-0.1.1-x86_64.AppImage"
./"Bookmark Vault-0.1.1-x86_64.AppImage"

On a Wayland desktop the app restarts itself under XWayland automatically — that is expected, and works around a crash in Electron's Wayland backend.

Linux — Debian and Ubuntu

Install with apt so dependencies are resolved for you:

sudo apt install ./bookmark_0.1.1_amd64.deb

It then appears in your applications menu like any other program.

Windows

Run the installer and follow the prompts. You can choose the install location.

Windows will warn you that the publisher is unknown. These builds are not code-signed — a signing certificate costs money annually and does not make the software any safer. Choose More info then Run anyway. Verifying the SHA-256 above tells you far more about the file than a signature would.

How it protects you

The design, in short

Your password is the only key

It is never stored, never sent and never checked against anything. It is stretched into a key with 600,000 PBKDF2 rounds. There is no reset, because a reset would be a second way in.

Encrypted before it is written

Bookmarks, logins, notes and images are sealed with AES-256-GCM on your machine. The file on disk is ciphertext, and tampering with it makes it fail to open rather than open wrongly.

Sync is optional and blind

If you run the sync server, it stores sealed bytes and holds no password or key. Someone who takes the whole server takes ciphertext.

It asks nothing of the network

No account, no sign-up, no analytics, no update pings. It works with the network cable out, and this page loads no external scripts, fonts or trackers.