Encrypted before it leaves
Your master password derives the key with Argon2id. Entries are sealed in an authenticated AES-256-GCM envelope on your device, with a separate key for every vault.
Zero-knowledge password manager
Every login,
Every login,
locked in your vaults.
TenkaPass keeps your passwords encrypted on your device and in sync across Windows, Android and the web. The server only ever sees ciphertext — never your master password, never your data.
Argon2id
AES-256-GCM
Zero-knowledge sync
Windows
Android
Web
Everything in one place
Passwords that work the way you do.
Separate vaults for work, home and family, with folders, notes and the logins you actually use. Built to be quick on every device, without handing your secrets to a server.
Sync without trust
Sign in on a new device and your encrypted vaults are listed first. The one you open decrypts locally, every single time.
Folders, search and favourites
Keep work, personal and home logins in separate vaults. Search the whole vault, pin what you use most, and generate strong passwords in place.
Auto-lock and clearing clipboard
Step away and the vault locks itself. Copied passwords can clear on a timer, so they never linger on a shared machine.
Import, export, move on
Bring your vault over from another manager, and export an encrypted backup whenever you want. Your data is yours.
Every vault, every screen
Native Windows and Android apps plus a browser-first web vault, all backed by the same account and the same encrypted data. Switch vaults without switching accounts.
Security model
We can't read your vaults. That's the point.
TenkaPass is zero-knowledge by design: the keys are derived on your device, the data is sealed before sync, and the server has nothing useful to leak.
-
1
Your master password stays local
Argon2id turns it into a key inside your browser or app. It is never sent to the server.
-
2
One sealed envelope per vault
Entries, folders and notes are encrypted together with AES-256-GCM and authenticated end to end. Each vault has its own data key.
-
3
The server stores ciphertext
Sync carries encrypted bytes and a password-derived verifier. No plaintext and no recovery key.
-
4
Only your device opens it
On a new device the selected vault downloads as ciphertext, then decrypts locally after you enter the master password.
What the server sees
An encrypted envelope for each vault and a verifier. That is the whole account.
{
"vaultId": "b0f2…9c41",
"version": 18,
"envelope": "p3sFq2k9…Xh0aQ==",
"nonce": "9mK2…",
"tag": "V7c1…"
}
No plaintext entries, no master password, no way for us to reset it. Export an encrypted backup and keep it somewhere safe.
Simple plans
Start free. Upgrade when your vaults grow.
Every plan gets the same zero-knowledge encryption, folders, search and encrypted export.
Free
$0
100 passwords, 1 vault, unlimited folders and sync across your devices. No card, no ads, no tracking.
Create free account
Plus
Unlimited
$1 / month
Unlimited passwords, unlimited vaults, a larger vault, breach reports and priority support. Or $8 per year.
Compare plans
Questions
A few things worth knowing.
Is TenkaPass really zero-knowledge?
Yes. Your master password is used locally to derive the encryption key. The server receives an encrypted envelope for each vault and a verifier, never the password or the plaintext vault.
What happens if I forget my master password?
Your vaults cannot be opened, and there is no recovery process that can reset them. That is the trade-off for zero-knowledge security. Keep an encrypted export somewhere safe.
Which platforms are supported?
TenkaPass runs as a native app on Windows and Android, and as a web app in any modern browser. All three use the same account and the same encrypted vaults.
Can I export my data?
Yes, on every plan. Export writes an encrypted .tenkapass envelope that only your master password can open. Import restores it on any device.
Can I self-host TenkaPass?
Yes. The server and web client are a single ASP.NET Core deployment, and self-hosting has no plan limits. See the project README for the build and deployment steps.
Start with the free plan.
100 passwords, folders, sync and encrypted export. No card required.