Private alpha
A vault the server can’t read.
Remem keeps passwords, 2FA codes, cards, SSH keys and any other secret in an end-to-end-encrypted vault, with a desktop app, a browser extension and a terminal CLI.
What’s in it
Desktop app
macOS in the alpha. Touch ID unlock, a menu-bar quick panel, and 2FA setup that reads the QR code straight off your screen.
Browser extension
Chrome and other Chromium browsers, and Firefox. Autofill, and 2FA setup from the QR code in the tab you’re looking at.
Terminal CLI
remem run hands secrets to a single child process, plus an SSH agent and a Git credential helper. Every request names the process asking and waits for your approval.
Sync
Your devices stay in step through a server that stores ciphertext and puts it in order. It never has a key.
How it’s secured
Two secrets, not one
Your master password is combined with a 128-bit Secret Key generated on your device and never sent anywhere. Someone who steals the server’s database can’t start guessing your password without it.
Your password never crosses the wire
Signing in uses SRP-6a: the server checks a proof, not the password, and has to prove itself back before the app trusts it.
Every item sealed on its own
XChaCha20-Poly1305, with each item’s id and version bound in, so ciphertext can’t be swapped between items or rolled back without the app noticing.
What the server does see
Your email, how many items you have, how large they are and when they change. Not titles, not usernames, not anything inside them.
No recovery
Lose both your master password and your Secret Key and the vault is gone, for us as much as for you. That is what a server that can’t read it costs.
Remem