DELG Pass
Get started

The password manager
that can't read your passwords.

DELG Pass encrypts every login, passkey, card and note on your device before it syncs. We store ciphertext. Never your master password, never your vault.

Create a free vaultGet the extension
pass.delg.dev

GitHub

github.com

Username
diego@delg.dev
Password
••••••••••••••

How it works

  1. 01

    You unlock on your device

    Your master password is stretched into keys right here. It is never sent anywhere, not even to us.

  2. 02

    Items are sealed before they sync

    Each login, card and note is encrypted with your vault key before a single byte leaves the browser.

  3. 03

    We keep only ciphertext

    Our servers hold sealed blobs and a one-way verifier. A breach would expose nothing readable.

Try it here

This is real AES-256-GCM running in your browser. Type on the left; the right side is all a server would ever receive.

What the server stores AES-256-GCM…nonce

What it holds

Logins
Usernames, passwords and every website a login belongs to, matched by the extension for autofill.
Passkeys
Created and used straight from the browser, then synced and encrypted like everything else.
One-time codes
Store the authenticator secret next to the login it protects and read live codes when you sign in.
Cards
Card numbers, expiry and cardholder, masked until you choose to reveal them.
Secure notes
Wi-Fi passwords, recovery codes, the answers to security questions. Anything private.
Folders and sharing
Organise items into folders, or share one with another DELG Pass user, re-encrypted for their key.

Specifications

Every cryptographic step runs in the browser with the Web Crypto API.

Vault encryption
AES-256-GCM, authenticated, per item
Key derivation
PBKDF2-SHA256, 600,000 iterations, on your device
Key separation
HKDF expands one secret into an encryption key and a login verifier
Server login check
The verifier is hashed again with bcrypt before it is stored
Sharing
RSA-OAEP keypair per account; the private key is sealed with your vault key
Breach check
k-anonymity: only a 5-character SHA-1 prefix leaves the browser
Recovery
A separate recovery key, independent of your master password
Platforms
Web, Firefox, Chrome and Edge

Browser extension

Fill a login with one keystroke. The extension matches saved logins on this device and fills only when you ask.

CtrlShiftL fills the login for the page you're on.

Add to FirefoxChrome and Edge (ZIP)

Start free.
Upgrade when you need room.

Free keeps 25 logins. Pro keeps 10,000 for 75 MXN a month or 500 MXN a year.

Create a free vaultHow recovery works