Passwords · Windows 10 and 11
A password manager that keeps your vault on your PC
Every password, card number, secure note and Wi-Fi key in one file, encrypted with your master password and kept on your computer rather than a server. It makes strong passwords, shows one-time codes for two-step sign-in, and tells you which passwords are weak, reused or leaked.
How to set up the password manager
- 1
Make your vault
Open Password manager in the Passwords app. Type a master password of at least 10 characters that rates Strong (the dice, Suggest one, makes a six-word passphrase), type it again, tick that you have written it down, and press Make my vault.
- 2
Bring in your passwords
Export your passwords as a CSV file from your browser or old password manager. Open Import & export, drop the file on Bring in passwords and press Add. Duplicates are skipped. Delete the CSV afterwards: it is not encrypted.
- 3
Add the rest
Press New and pick Login, Card, Secure note or Wi-Fi. The dice beside a password field makes a new one, and Use it puts it in.
- 4
Copy when you sign in
Select an entry and use its copy buttons. Copied secrets skip Windows' clipboard history and are cleared after 30 seconds, which you can change in Settings.
- 5
Check its health
The Health tab scores your passwords from 0 to 100 and lists the leaked, weak, reused and old ones. Check for leaks asks Have I Been Pwned without sending a single password.
How your vault is protected
The vault is a single file in Octoolo's data folder on your PC. When you unlock it, your master password goes through Argon2id, a function built to be slow and to need a lot of memory (64 MiB for every try). That turns the password into a key, and makes guessing millions of master passwords expensive for anyone who steals the file.
The key then seals the vault with XChaCha20-Poly1305, modern encryption that also notices if a single byte of the file was changed. The key lives only in memory while the vault is open. The vault locks itself after 15 minutes unused, or after 1, 5 or 60 minutes if you prefer, or never.
Octoolo never keeps or sends your master password, so nobody can reset it for you. That is the price of a vault only you can open: write the master password down and keep it somewhere safe.
What it holds
| Entry | What you can keep |
|---|---|
| Login | Name, website, user name, password, one-time code secret and notes, plus the email and phone it uses, how you sign in, two-step sign-in and recovery codes |
| Card | Name on card, number, expiry date, security code and PIN |
| Secure note | Any text: a passport number, a door code, software keys |
| Wi-Fi | Network name, its security (WPA3, WPA2, WPA, WEP or Open) and password |
Each entry keeps its last 10 passwords, in case a change did not go through. Favorites, search and filters by kind keep a long list manageable. The generator makes either characters (8 to 64, with capitals, small letters, digits and symbols, leaving out look-alikes such as O and 0) or a passphrase of 3 to 10 words, and shows how many bits of randomness you get. For one-time codes, see authenticator app for PC.
What it does not do
Better to know before you move in:
- No browser extension, so no autofill. You copy the user name and password from the vault; the clipboard clears itself.
- No sync between devices. The vault lives on one PC. To carry it, save an encrypted backup (an .octoolo file) to a USB stick or your cloud drive and bring it in on the other PC with Choose a backup.
- No attachments, passkeys or Windows Hello unlock.
- No master password recovery. Forgot the master password? puts the old vault aside, not deleted, in case you remember it, and starts an empty one.
If you need the same passwords filled in on your phone and several computers, a cloud password manager fits better. Octoolo's suits people who want their passwords on their own Windows PC and nowhere else.
Moving in from another manager
Export a CSV from Chrome, Edge, Firefox, Safari, Bitwarden, 1Password, LastPass, Dashlane or KeePassXC and drop it on Bring in passwords. (Classic KeePass 2.x writes its columns as Account and Login Name; rename them to Title and Username in the CSV first, or the names come in empty.) Octoolo recognizes where the file came from by its columns, shows how many entries it found, and adds them when you press Add. Entries already in the vault are skipped, LastPass secure notes stay notes, and one-time code secrets come along when the export includes them.
Going the other way, Save an encrypted backup writes a copy that opens only with your master password, and Export as CSV writes plain text for another manager, after you tick that you will delete it after use. Bring in a backup merges a backup into the vault: entries already there are kept, and newer changes win.
Questions, answered
Can Octoolo see my passwords?
No. The vault is encrypted with a key made from your master password, which Octoolo never stores or sends anywhere, so nobody at Octoolo can read it.
What if I forget the master password?
Then the vault cannot be opened, by you or by us. Keep the master password written down somewhere safe, and keep an encrypted backup too.
Does it fill in passwords in my browser?
No, there is no browser extension. Select the entry and copy the user name and password; copied secrets are cleared from the clipboard after a while.
Can I use it on two computers?
Not with automatic sync. Save an encrypted backup on one PC and bring it in on the other; from then on, the two vaults are separate.
Does anything leave my PC?
Only during a leak check: the first five characters of each password's SHA-1 fingerprint go to Have I Been Pwned. Everything else stays on your computer.
Can I import from LastPass or 1Password?
Yes. Export a CSV there and drop it on Bring in passwords. Chrome, Edge, Firefox, Safari, Bitwarden, Dashlane and KeePassXC exports work the same way.
Password manager, and 16 more apps.
Download for Windows7 days free, then from $3.99 a month for all 17 apps. Windows 10 and 11.