General
What is 2Secret?
2Secret is a free, open-source password manager. It keeps your passwords, cards, documents, keys and other secrets encrypted on your device, with apps for macOS, Windows, Linux, the BSDs, iOS, Android and the web, plus a browser extension and a command-line tool.
Is 2Secret really free?
Yes. There are no subscriptions, no paid tiers and no feature limits. The only thing that costs money is the iOS app in the App Store, for a small one-time fee that covers Apple’s developer account and hosting. Even that app is open source, so you can build it yourself.
How is 2Secret different from other password managers?
Three things stand out:
- Nobody hosts your vault for you. It lives on your device or on your own server.
- Two secrets. Your master password is combined with a Secret Key from your device, so a stolen server database is useless for guessing passwords.
- Free and open source, with quantum-resistant sharing, and titles and URLs encrypted along with everything else in your vault.
Which platforms does 2Secret run on?
macOS, Windows, Linux, FreeBSD, OpenBSD and NetBSD, iPhone and iPad, Android, and the web. There’s also a browser extension for Chrome, Edge, Brave and Firefox, and a command-line tool.
Which languages are the apps available in?
English and Dutch.
Security
Can anyone at 2Secret see my passwords?
No. Your vault is encrypted on your device before it goes anywhere, and the server never holds a key that can decrypt it. The 2Secret project doesn’t host vaults at all, and even the server you sync with only stores your vault as ciphertext.
What happens if I forget my master password?
Nobody can reset it for you, because nobody else can decrypt your vault. That’s the trade-off for real privacy. Choose a password you’ll remember (a few random words work well), keep your Emergency Kit somewhere safe and make encrypted backups.
What is the Secret Key, and what if I lose it?
It’s a random 130-bit key that your device creates and that never goes to the server. Your devices keep it, and it’s on your Emergency Kit. You need it to sign in on a new device. If you lose it and have no device left that’s signed in, nobody can recover it, so keep the Emergency Kit safe.
Has 2Secret been audited?
Not yet. 2Secret uses well-studied cryptography and all code is open for review, but no independent firm has audited it so far. We list this, and other limitations, openly on the security page.
What does “quantum-resistant sharing” mean?
When you share a vault, its key is protected with two methods at once: the established X25519 and the new post-quantum standard ML-KEM-768. Even if someone records the exchange today and has a powerful quantum computer in the future, they would still have to break both.
Is the browser extension safe?
It’s built defensively: it fills only when you click, checks the page and all frames again right before filling, matches sites on their real domain and never fills https logins into http pages. Logins and one-time codes never pass through a content script, and for passkeys a website can only ask: 2Secret opens its own window for you to decide.
Your data and servers
Where is my data stored?
Where you choose: only on your own device, or on a 2Secret server you run yourself (on a Raspberry Pi, NAS, Proxmox or VPS). The 2Secret project never stores your vault.
Do I need a server?
No. You can use 2Secret without a server, with your vault on one device. You need a server only to sync between devices or to share vaults, and you can connect one later.
What do I need to run my own server?
A small machine that can run Docker, such as a Raspberry Pi, a NAS, a Proxmox container or a VPS, and a domain name. The self-hosting guide walks you through it.
What happens when my server is offline?
Nothing dramatic. Every device keeps a full encrypted copy and keeps working. Changes sync as soon as the server is back. If the same item was changed in two places, the newest edit wins and the other version’s password is kept in the item’s password history.
Can I share passwords with my family?
Yes, with your own server. Share a vault and give each person a role: viewer, editor or manager. Compare fingerprints once to be sure you’re sharing with the right person.
Apps and features
Can I bring my passwords from another password manager?
Yes. 2Secret imports from Bitwarden (JSON and CSV, passkeys included), LastPass, Chrome, Edge, Brave, Firefox, Safari, KeePass (XML), KeePassXC and Dashlane, and from other password managers through a CSV export. See importing, step by step.
Can 2Secret generate two-factor codes?
Yes. It has a built-in TOTP authenticator, including Steam Guard codes.
Is there an Android app?
Yes, for Android 7 and newer on 64-bit ARM devices, built from the same code as the other apps. Releases that include a signed .apk list it on the download page; you can also build it yourself with scripts/android.sh. Its data stays out of Android’s cloud backups. Biometric unlock, passkeys and system autofill aren’t available on Android yet.
Pricing
Why does the iOS app cost money?
Publishing in the App Store requires a paid Apple developer account, and hosting costs money too. A small one-time price covers that. There is no subscription, and the app is open source like the rest of 2Secret.
How is 2Secret funded?
It’s an open-source project. Because it doesn’t host anyone’s vault, it has no expensive infrastructure to pay for, and it doesn’t make money from your data.