Paid in bitcoin. Ciphertext only. No lock-in.

The password manager that can’t read your data.

Every entry is encrypted in your browser. Their key reaches us only sealed: under your passphrase and your recovery code, to one of your devices, or, in a team invite you ask us to email, under a one-time code you pass on yourself. So we hold ciphertext and nothing that opens it. Sign in with email, Google, GitHub or a Bitcoin wallet.

Open your vault See pricing

Your passphrase holds the key
AES-256-GCM in your browser
Paid on-chain
No fiat, no card

What you can store

Ten kinds of entry. Every secret you actually have.

Each entry is encrypted on its own with AES-256-GCM under your vault key. Mix and match. There is no per-type quota.

Passwords

Every login. One vault.

Username, password, URL, notes. Generate a 20-character password in two clicks. Copy with one.

2FA codes

Live 2FA codes. Authy without the cloud.

Paste a base32 secret or an otpauth:// URI. The 6-digit code rotates every 30 seconds, visible in the list view at a glance. Survives phone loss; never sees a Google or Authy cloud.

API keys

GitHub, OpenAI, Stripe, AWS, Coinbase.

Never paste your OPENAI_API_KEY into a browser tab again. Never email a Stripe live key to a coworker. Never type your AWS access key into a shell history. Pulls into your terminal via the CLI; never typed into the URL bar.

Cards

Card numbers, CVV, PIN, masked until you need them.

Cardholder, number, expiry, CVV, PIN, billing ZIP. The list view shows only the last four digits; the rest stays sealed until you reveal it. Copy the number with one click and the clipboard self-wipes 30 seconds later.

Identities

The form-filler details you retype on every signup.

Name, email, phone, company, address — the block of personal data every checkout and signup asks for. Kept in one encrypted entry instead of scattered across a dozen browser autofill profiles you do not control.

Recovery codes

The wall of codes every service makes you keep.

Every service emits a wall of 8-character recovery codes that are "important — save these somewhere safe." This is somewhere safe. Encrypted, and, with sync, there in any browser you sign in from.

Secure notes

A will. The Wi-Fi password. SSH keys. Licence keys. Medical records.

Anything you would type into a notes app, encrypted before it is saved.

Small files

Passport scans. Tax forms. ID documents.

Up to ~1 MB of binary payload per entry. The file becomes ciphertext on disk and stays ciphertext in transit.

Key-value · Env

And two for developers: key-value pairs and .env files.

What not to put in here

Bitcoin (or any cryptocurrency) seed phrases. The whole point of self-custody is that the seed never touches a connected device. Put your seed on metal — Coldcard tap-seed, Seedplate, Steelplate, Bitkey, Hodlr, Cobo Tablet, hand-stamped washers — and keep it in a safe. The vault supports a “seed phrase” entry type only for edge cases (BIP-39 passphrases that are not the full seed, non-Bitcoin recovery phrases). We will not market vault as “the place for your seed,” and you should not treat it as one.

If you came here to store a Bitcoin seed: please don’t. Read how to secure a wallet (opens in a new tab) first. Software is the wrong layer.

Every entry is sealed in your browser with AES-256-GCM under a vault key your browser holds. orangecheck sees ciphertext only. Lose the cloud, and your local copy keeps working. Lose your passphrase, and the recovery code from setup unlocks it. Lose both, and there is no recovery, by design: we hold only the sealed blob.

How it works

Four steps. One passphrase.

You are the only one who can read what you store. orangecheck keeps ciphertext and passes it between your devices.

Sign in
Open vault.ochk.io and sign in to your orangecheck account with email, Google, GitHub or a Bitcoin wallet. No password to choose, no second account to create.
Add a secret
Password, 2FA code, API key, card, note, or small file. Your browser encrypts it before it is saved. Plaintext never leaves the tab.
Sync or export
Free: it stays in this browser, and you can back it up to a file any time. Paid: 7,000 sats per 30 days or 70,000 sats per year, on-chain, syncs it to every device you sign in on.
Unlock anywhere
Any browser, any device. Sign in, then enter your vault passphrase. Signing in fetches the sealed key; only your passphrase or recovery code opens it.

Why it exists

Your passphrase never leaves your browser. We hold only ciphertext.

Every entry is encrypted in your browser under a key your passphrase unlocks. Our servers keep the ciphertext and nothing that opens it.

Account: orangecheck sign-in
Master password: Passphrase (generated by default)
Recovery: Passphrase or recovery code
Export format: Encrypted backup (open)
Payment: Sats on-chain, no card on file

All of vault.ochk.io’s data gets an attacker ciphertext and your key sealed under scrypt (N=2¹⁷). A generated passphrase is six random words, about 50 bits, out of practical reach at that cost. A passphrase you choose is only as strong as you make it.

No backdoor

Your passphrase never reaches us and we cannot reset it. Your recovery code is the only other way in.

Take it with you

An encrypted backup holds your key and every entry under a passphrase you choose. It opens anywhere with that passphrase and open code.

OC Vault encrypts with the primitives of OC Lock, specified in oc-lock-protocol (opens in a new tab). Your passphrase holds your vault key, not your Bitcoin wallet.

Questions worth asking

The four objections we hear most.

More on pricing, and the protocol design is in oc-lock-protocol (opens in a new tab).

Do I need a Bitcoin wallet to use this?

No. Sign in with an email code, or with Google or GitHub. A Bitcoin wallet (BIP-322) is the option that needs nobody else, and you can link one later without losing anything. Either way, your entries open with your vault passphrase, not your sign-in. Past sign-in, Bitcoin pays for cloud sync, on-chain, and a wallet can sign an entry you export as a .lock file for your OC Lock devices.

What if vault.ochk.io disappears tomorrow?

Keep an encrypted backup from settings: one file holding your vault key and every entry, sealed under a passphrase you choose. It restores on any device with open code (scrypt, AES-256-GCM), no server involved.

Can orangecheck read my entries?

No. We hold ciphertext only. The vault key is sealed under your passphrase, in your browser; cloud-sync blobs are double-encrypted so we don’t even see entry names or types — just random envelope ids and timestamps. Full database access recovers ciphertext that requires your passphrase to decrypt.

How is this different from LastPass or 1Password?

They encrypt under a master password too. The breach of LastPass in 2022 exposed weak master passwords to offline guessing. OC Vault suggests a generated passphrase (six random words, about 50 bits) and stretches it with scrypt, so a stolen database is not a practical target. You can choose your own; it is then only as strong as you make it. You also pay in sats, with no card on file.

Open by construction