OpenPassword
A password and passkey vault in your browser, synced end to end and unlocked by a gesture rather than by a page load. A hostile site can put a login form off-screen and wait forever; waiting gets it nothing.
wss://relay.opensync.network
Already filled in. Chrome · Edge · browser.
the page claims "accounts.yourbank.com"
the worker reads sender.tab.url → https://phish.example/
a match? none
filled nothingFeatures
A badge appears in the login field. Nothing is filled until you click it or press Ctrl/⌘⇧L. There is deliberately nothing between page load and a filled field, because a page that can make something happen without you is a page that will.
They live in chrome.storage.session, which is memory-only and gone when the browser closes. Only the relay keys are persisted — where they already were.
The worker reads it from sender.tab.url, which the browser fills in and no page can forge. So confusing the content script cannot widen what it is allowed to have.
WebAuthn credentials sync the same way and under the same encryption, so a passkey is not a thing that strands you on one device.
A badge has to know whether anything matches before any window is open, so the popup stopped being the store and became a window onto it. That is what makes the keyboard shortcut work with nothing on screen.
A recovery kit on paper, whose two keys carry checksums and are bound together by a fingerprint — because a checksum catches a typo but not two correctly typed keys from different printouts.
How it works
Everything that decides what your data is happens on your device. The relay holds bytes and hands them back in the right order.
01
A keypair, generated in your browser. No email, no master password to reset, nothing a server could hand to anyone.
02
Sealed before it is stored. The relay receives ciphertext and a size.
03
Matched against the origin the browser reports, never one a page claims.
04
A click, or a keyboard shortcut. Never before.
Download
Every OpenSync app shares an account, a relay and an encryption model — so a second one is a checkbox, not a second signup, a second bill or a second thing to trust.
Privacy
| What | Why, or why not |
|---|---|
| What the relay sees | Sealed bytes. Not a site, not a username, not how many entries you keep. |
| What the page sees | Nothing, until you act. No vault contents reach a page's JavaScript on load, and the extension does not take a page's word for which site it is. |
| What we never have | A master password. There is no account to reset and no recovery flow that could be socially engineered, because there is nothing on our side to socially engineer. |
Pricing
The paid side has no price yet, and this page will say so until it does — an app that lists a plan nobody can buy has already promised something.
£0
Credentials are text, and text is free — there is no entry count and no device limit. The paid part of this relay is attachments, which a password vault does not normally carry, so for most people OpenPassword is free and stays free.
Point an app at itUnmetered
What is being sold is running the server, not the feature. If you are going to end up here eventually, start here.
Run your own OpenSync relayFAQ
Because automatic filling is the vulnerability. A hostile page can position a login form where you will never see it and collect whatever arrives; requiring a click or a keystroke means it collects nothing. The badge tells you a match exists — you decide.
No. An account is a keypair generated in your browser, and the vault key is separate from it. There is nothing on our side to reset, which also means there is nothing to socially engineer.
Yes — WebAuthn credentials sync under the same encryption as everything else, so a passkey does not strand you on the device that created it.
In memory only, in the browser's session storage, gone when the browser closes. Only the relay keys are written to disk, and those are not the vault key.
It can try. The extension does not take a page's word for which origin it is — the service worker reads it from the tab, which the browser fills in and no page can forge.
Yes, for practical purposes. Credentials are text and text is unlimited; there is no entry cap and no device cap. Attachments are the paid part of this relay, and a password vault rarely carries any.