The vault
Encrypted where it is made, not where it is stored.
Your vault is sealed on your device. What our servers hold is ciphertext, and they do not have the key.
The security question that matters for any password manager is who can read the contents. For Repass the answer is you, because encryption happens on your device before anything is transmitted, and the key is derived from a secret we never receive.
That has a consequence worth stating plainly: we cannot recover your vault for you. A support agent who can read your passwords is a support agent who can be tricked into reading them to someone else.
The model that drives a reset is never shown a password, a reset link or a verification code. Those stay local to your browser and never reach it.
More
The rest of what Repass does
Find accounts connected to your email
Every service you ever signed up for sent you an email. Repass reads those to build the list, so you find out about the 2016 forum account before somebody else does.
Reset reused passwords
Reuse is the single thing that turns somebody else's security failure into your problem. Repass replaces them in bulk instead of one painful evening at a time.
Reset compromised passwords
Rotating an exposed password matters more than rotating an old one. Repass does the rotation, on every account that needs it.
Generate strong passwords
The passwords Repass sets are made locally and never leave your machine in a form anyone else can read.
Change passwords automatically
Repass drives each site's real forgot-password flow in your own browser, and stops to ask when a site wants a human.
Two minutes from now
Your passwords stop being your problem.
3-day free trial · end-to-end encrypted · you can watch every step
