AltF Vault

How to choose a password manager

Pick a password manager on evidence: published independent audits, a clear encryption design, a recovery method you understand, the devices and autofill you need, a way to export your data, and a price you will keep paying. Using any reputable manager with unique passwords is far better than none.

  • Free, no account
  • Encrypted on your device
  • Works offline
  • Not yet independently audited

The checklist

  • Independent audits: are recent reports published, and by whom?
  • Encryption design: is it documented, and is the vault encrypted before it leaves your device?
  • Recovery: what happens if you forget the master password, and who can reset it?
  • Devices and autofill: does it cover your phone, laptop and browsers?
  • Offline access: can you open the vault without internet, and can you edit it?
  • Export: can you leave with a full export in a standard format?
  • Sharing and family plans, if you need them.
  • Cost: what is free today, and what happens if the price changes?

Where AltF Vault fits

AltF Vault is a free, no-account vault that runs entirely in your browser. It is useful for recovery codes, notes, a second copy of critical logins, or for trying a vault without signing up. It has no sync, no autofill and no independent audit yet, so for a primary password manager on every device, choose an audited product.

Checking this browser for a saved vault...

How to choose a password manager: questions and answers

Are password managers safe?

Reputable ones are much safer than reusing passwords. The main risks are a weak master password, a compromised device and, for cloud managers, a breach of the provider, which good encryption design limits.

What is the best free password manager?

It depends on what you need. Bitwarden's free plan offers audited sync; KeePassXC is free, open source, audited and offline; browser managers are convenient. Check each one's current terms.

Is the browser's built-in password manager enough?

For many people it is a big step up from reuse, especially with a strong account password and two-factor authentication. Dedicated managers add cross-browser support, secure notes and health reports.

Should I trust a password manager that is not audited?

With caution. Without an independent review you are relying on the developer's word. AltF Vault says so openly and keeps account sync and extensions switched off until audits happen.

Vault guides and features

AltF Vault homeThe vault, how it is built, what it cannot do and the FAQ.How the encryption worksThe full AltF Vault security design in plain English: PBKDF2-SHA-256 key derivation, AES-256-GCM, what is stored, and what it cannot protect against.Encrypted secure notesWrite encrypted notes in your browser: bank details, ID numbers, door codes and private lists, sealed with AES-256 on your device. Free and no sign-up.2FA recovery code storageStore two-factor backup and recovery codes encrypted on your device, tick off used codes and get warned when a set is running low. Free, no account.Password health checkFind weak, reused and years-old passwords in your vault, plus expired API keys and low recovery codes. Checked on your device, breach check optional.Encrypted backup and restoreDownload an encrypted backup of your AltF Vault, keep it in cloud storage or on a USB drive, and restore it on any device with your passphrase.Import passwords from CSVImport a password CSV from Chrome, Edge, Firefox, Safari, Bitwarden, 1Password or LastPass into an encrypted vault. Read on your device, never uploaded.Offline password managerA free offline password manager that runs in your browser with no account or cloud. Encrypted on your device, works without internet after loading.Master passphrase guideHow to choose a master password for a password manager: random word passphrases, how many words you need, how to memorise it and what to avoid.

Free tools that work with the vault

AltFTool stores nothing from your vault. It is encrypted and kept in your browser; the only optional network request is the k-anonymity breach check.