MyPwdTool

MyPwdTool is a password manager built around one simple idea: your data should never be readable by anyone but you — not MyPwdTool, not a cloud provider, not anyone. FREE, WITH NO ACCOUNT The vault, browser AutoFill (Safari), the AutoFill Credential Provider, password health checks, breach checks, TOTP two-factor codes, passkey metadata storage, and encrypted backups all work fully offline and cost nothing — no feature limits, no time limit, no account or sign-up of any kind, on any platform. MULTI-DEVICE SYNC, OPTIONAL The only paid feature is multi-device synchronization, an affordable yearly subscription that lets your passwords stay in sync across all your Macs, iPhones, iPads, PCs — without a central cloud database. Devices talk directly to each other through a relay server whose only job is to pass encrypted messages along; it has no concept of a "vault," a "password," or a "user account," and could never read your data even if it were compromised. Joining a sync group someone else already created is free — the subscription only gates creating a new group or inviting further devices. SECURITY, DONE PROPERLY Every sensitive field — password, username, note, card number, TOTP secret — is independently encrypted with AES-256-GCM. Your master password is used once, locally, to derive a key via PBKDF2-HMAC-SHA256 with 400,000 iterations; it is never stored and never leaves your device. If you forget it, nobody — including us — can recover your vault. Unlock with Face ID or Touch ID between master-password prompts, on your own schedule. WHAT'S INSIDE • Encrypted vault for passwords, passkeys metadata, TOTP codes, and payment cards • Multiple independent vaults on macOS/iOS (e.g. personal + work) • Safari extension for autofilling passwords in your browser • System-level AutoFill Credential Provider, working everywhere the OS offers to fill a password • Password health audit: weak, reused, and old passwords flagged on-device • Breach check against Have I Been Pwned, using k-anonymity so your password never leaves your device • Encrypted local backups and CSV import/export • A full local activity log NO TRACKING, EVER No analytics, no advertising, no third-party SDKs for tracking, no account system, no server-side storage of your vault or its contents. The relay's source code is public for independent review.