Features

Everything you need — nothing you don't.

Password, note and 2FA entries live fully encrypted inside your chosen PNG carrier. Larger files use separate disguised, encrypted file-vault containers. Every licence includes every feature, with no premium tier.

Password Manager

Store passwords and logins encrypted inside your image file. They are decrypted only while the vault is open and are never sent to BlindLock servers.

  • Quickly find entries by name, even with a typo, and organise them with tags
  • Favourites and recently used
  • Password generator with configurable policy
  • Autofill via secure clipboard with timeout
  • Breach-strength indicator that runs locally

TOTP 2FA Authenticator

Built in. No separate app, no QR code juggling between devices, no cloud sync to worry about.

  • Standard RFC 6238 TOTP compatibility
  • QR-code import and manual entry
  • One-click copy with auto-clear
  • Seeds encrypted alongside the rest of the vault

Encrypted File Vault

Any file, any format. Tax returns, passport scans and large archives live in separate encrypted containers disguised as unremarkable random data.

  • Arbitrary file types, streaming encryption
  • Preview for common formats (image, text, PDF)
  • Chunked storage for large payloads
  • Files never written to disk unencrypted

Secure Notes

Store sensitive notes in plain text or Markdown. BlindLock encrypts and hides them inside your image file, visible only after you unlock the vault.

  • Markdown rendering with code blocks
  • Title, tags, last-modified tracking
  • Full-text search across all notes
  • Same encryption envelope as passwords

Security keys (optional)

As an optional fourth factor, you can require a plug-in security key. The three main factors — file, password, and device — are always active anyway.

  • Compatible with YubiKey, Google Titan and SoloKey (FIDO2 sealing)
  • Optionally required to open the vault
  • Multiple keys can be registered
  • Emergency access via the recovery phrase
  • Desktop at launch (Windows, macOS, Linux); mobile support is platform-specific

Recovery Phrase

For device loss or migration, create an encrypted BlindLock backup and keep its recovery phrase separately. BlindLock cannot recover either for you.

  • High-entropy recovery words from a large wordlist (BlindLock recovery material)
  • Generated offline, shown once
  • Derived key escrow independent of device binding
  • Paper-backup friendly format

No cloud vault. No vault telemetry.

BlindLock never transmits vault contents to our servers. It needs brief encrypted connections for activation, licence entitlement and version checks. None of these connections includes passwords, notes, 2FA secrets or files.

  • No BlindLock cloud account is required to store your vault
  • No central customer-vault database or automatic vault sync
  • Licence checks exchange technical licence, device, platform and version data only
  • Routine updates remain optional; security-critical releases may require a minimum version

One Lifetime licence. Every feature. No subscription.

Pay once for a licence with no expiry date or recurring fee. Entitlement is verified online when you unlock the vault; security-critical releases may require a minimum version.