What does "zero-knowledge" actually mean?

All encryption and decryption happens on your device, in the browser or app. The server only ever stores encrypted blobs. Your master password and vault keys are never transmitted — so a database or storage compromise, or an administrator reading the database, does not expose plaintext vault contents.

Where is our data stored?

On your own infrastructure. rePASS is self-hosted: you deploy it with Docker or Kubernetes in your datacenter or private cloud. No credential, encrypted or not, ever leaves your network — which also makes GDPR and KVKK compliance dramatically simpler.

How do breached-password checks work — do you send passwords to haveibeenpwned?

No. The breach dataset is downloaded into your own installation and checks run against it locally, using the same k-anonymity scheme HIBP pioneered: the browser computes the password’s SHA-1 digest locally and queries only its first 5 characters; matching happens client-side. Neither the password nor its full hash ever leaves your environment, and nothing is sent to HIBP or any other external service — the check works even in closed networks.

What happens when someone leaves or forgets their password?

Nothing is lost. rePASS includes an escrow-based recovery system: several designated recovery admins must approve before access to an orphaned vault can be restored, and every step audited. To be precise about how strong that is: today the approval threshold is enforced by the rePASS application rather than by cryptographic key shares — a cryptographic (Shamir) share-based threshold is being rolled out in stages — and hardware-backed protection for the escrow key is optional via Azure Key Vault; otherwise it is encrypted with a key the server holds. Those limits — and the rollout plan — are documented in our security whitepaper.

Which platforms are supported?

The web vault runs in any modern browser. There are extensions for Chrome and Edge with autofill, TOTP and passkey support, a native macOS menu-bar app with Touch ID and system AutoFill, and the rp CLI for Linux, macOS, and Windows.

How is rePASS different from cloud password managers?

The encryption model is comparable — the trust model is not. With a cloud manager, your encrypted vault sits in a vendor’s multi-tenant cloud, a permanent high-value target. With rePASS it sits in your datacenter, protected additionally by escrow key wrapping in Azure Key Vault, device trust, AI anomaly detection and Remote Browser Isolation — a combination cloud vendors don’t offer.

How do we get started?

Open demo.repass.one — it is a full rePASS installation with sample data, and the login credentials are printed on the sign-in screen, so there is nothing to request and nothing to install. It resets every night. When you want to see it with your own data, get in touch and we’ll set up a proof-of-concept in your environment — usually running the same day thanks to the Docker-based installer.

rePASS — Where do your passwords live?

100%client-side encryption

14+threat types detected by AI

2+admin approvals to recover

13+item types, SSH to API keys

// the product

Everything your team runs on — one place, separate vaults.

Logins, servers, databases, SSH keys, API credentials, TOTP codes and more — organized in shared vaults, scoped by role, decrypted only on your device.

Production Servers

8 members · 42 items · role-scoped

Name	Type	Status	Updated
prod-db-master	Database	strong	2h ago
aws-deploy-key	API Credential	TOTP	1d ago
core-switch-01	SSH Key	strong	3d ago
[email protected]	Email Account	strong	5d ago

// zero-knowledge

The server knows nothing.
Provably.

Everything is encrypted and decrypted in your browser. The server only ever stores encrypted blobs — your master password and vault keys never leave your device. A database or storage compromise does not expose plaintext vault contents.

KRİPTOGRAFİ
Encryption	AES-256-GCM
Key exchange	RSA-4096
Key derivation	PBKDF2-SHA256
Transport	TLS 1.2+ / 1.3

// features

Security without compromise.

Everything a cloud password manager does — plus the controls only self-hosting can give you.

True Zero-Knowledge

Encryption happens in your browser. The server never holds the keys required to decrypt vault contents.

On-Premise Deployment

Deploy via Docker or Kubernetes in your own data center. Your data never touches external infrastructure.

Optional HSM Protection

Protect enterprise escrow keys with Azure Key Vault (FIPS 140-2 validated) — user vault keys always remain client-controlled.

Passkeys & TOTP

A full passkey authenticator plus built-in TOTP: one-time codes generated and autofilled right where you log in.

AI Anomaly Detection

A hybrid ML + rule engine flags brute force, session hijacking, bulk access and 14+ threat types in real time.

Multi-Admin Recovery

Recovery needs several designated admins to approve — no administrator can complete it alone through rePASS.

Remote Browser Isolation

Open sensitive web apps in a hardened, streamed browser that runs in your infrastructure — nothing executes on the endpoint.

Tamper-Evident Audit

100+ audited action types, every record sealed with a keyed HMAC-SHA256 the database alone cannot recompute.

Device Trust

Devices register and get approved before access. Session fingerprinting and per-user device limits make stolen tokens hard to reuse.

Breached-Password Checks

Every password is checked against known breach corpora — the dataset lives in your installation and queries never leave it.

Security & Risk Scoring

A 0-100 security score plus a risk score on every login and access, tracked over time in Risk History.

API & CLI Automation

Scoped API tokens and the rp CLI inject secrets into pipelines and scripts — decrypted only where the job runs.

// remote browser isolation

Let someone use a password without giving it to them.

Recorded on the live demo, in real time — nothing sped up, nothing staged.

They open a share someone granted them — no vault access, no password.
A single-use browser starts inside your own infrastructure.
One click fills the credential; the field stays masked and uncopyable.
They are signed in. When the window closes, the browser is destroyed.

The person in this recording never receives the password. It is decrypted inside your infrastructure and typed into a throwaway browser; only the picture reaches their screen.

// platforms

Wherever your team works.

The same zero-knowledge vault — in the browser, in the menu bar, and in the terminal.

Web Vault

The full admin and vault experience in any modern browser. Nothing to install for end users.

Any modern browser

Browser Extension

Autofill logins and TOTP codes, save new credentials, and use passkeys — without leaving the page.

Chrome · EdgeGet it on the Chrome Web Store →

macOS App

Native menu-bar app with Touch ID unlock and system-wide AutoFill, including Safari.

macOS 14+ · Touch ID

rp CLI

Scriptable access to secrets for pipelines and servers. Downloaded straight from your own installation — one command, no package repository to trust.

macOS · Linux · Windows

// enterprise

Built for how organizations actually run.

Identity, policy, and recovery controls designed with your security team — not bolted on later.

Azure AD SSO + MFA

Users sign in with the identity they already have. MFA is mandatory, not optional.

Role-Based Access

Five role levels — from identity and security admins to audit readers. Everyone sees exactly what their role allows.

24+ Org Policies

Password complexity, session lifetime, IP ranges, device limits, rate limits — enforced centrally across the org.

Escrow Recovery

Leavers and forgotten passwords don’t orphan data: recovery admins jointly restore access via protected escrow, every step audited.

Admin Console

SSL, SMTP, Azure AD, backups, licenses, and system logs — managed from one place, on your infrastructure.

Reports & Event Logs

Live dashboards for risk scores, anomaly history, and vault activity — export-ready for your auditors.

Audit-ready by design

Data sovereignty: everything stays in your datacenter — a natural fit for GDPR & KVKK
Optional Azure Key Vault (FIPS 140-2 validated) escrow key protection
TLS 1.2+ (1.3 preferred) — the system refuses to run without a valid certificate
Append-only audit trail, each record sealed with a keyed HMAC-SHA256

// why self-hosted

Cloud convenience, without cloud exposure.

A fair comparison with typical cloud password managers.

	rePASS	Typical cloud password managers
Where your vault lives	Your own datacenter	The vendor’s cloud
Zero-knowledge encryption	AES-256-GCM, always client-side	Varies by vendor and plan
Key escrow & recovery	Multi-admin approval, optional Azure Key Vault (FIPS 140-2)	Typically vendor-managed
Remote Browser Isolation	Built in	Not offered
Anomaly detection	On-prem AI, 14+ threat types	Cloud add-on, extra cost
If the vendor is breached	Nothing of yours to steal	Your vault is in the target set

// built for

Teams that can't afford leaks.

IT & Systems Teams

Server, database, and service credentials in shared vaults — scoped by role.

DevOps Teams

Secrets wired straight into your CI/CD pipelines, decrypted only at run time.

Regulated Industries

Banking, insurance, government: self-hosted, HSM-protected, audit-ready.

// automation

Lives in your pipeline.

The rp CLI injects secrets into CI/CD at run time — encrypted in transit, decrypted only where the job runs.

# secret yalnızca işin koştuğu yerde çözülür
rp run --vault=production -- ./deploy.sh

# CI/CD içinde
export RP_SERVER=https://vault.example.com
rp get production/database/password

// deployment

In production before lunch.

No professional-services engagement required. Evaluate with Docker Compose, go to production with the turnkey installer, stay current with one command.

docker compose up -dEvaluate in minutesThe full stack — database, API, and web vault — on a single machine.
./install.sh admin@your-serverTurnkey on-prem installA hardened Kubernetes (K3s) deployment with TLS bootstrap, on your own server.
./update.shOne-command updatesVersioned images, health-checked rollouts, painless upgrades.

// faq

Questions security teams ask us.

What does "zero-knowledge" actually mean?: All encryption and decryption happens on your device, in the browser or app. The server only ever stores encrypted blobs. Your master password and vault keys are never transmitted — so a database or storage compromise, or an administrator reading the database, does not expose plaintext vault contents.
Where is our data stored?: On your own infrastructure. rePASS is self-hosted: you deploy it with Docker or Kubernetes in your datacenter or private cloud. No credential, encrypted or not, ever leaves your network — which also makes GDPR and KVKK compliance dramatically simpler.
How do breached-password checks work — do you send passwords to haveibeenpwned?: No. The breach dataset is downloaded into your own installation and checks run against it locally, using the same k-anonymity scheme HIBP pioneered: the browser computes the password’s SHA-1 digest locally and queries only its first 5 characters; matching happens client-side. Neither the password nor its full hash ever leaves your environment, and nothing is sent to HIBP or any other external service — the check works even in closed networks.
What happens when someone leaves or forgets their password?: Nothing is lost. rePASS includes an escrow-based recovery system: several designated recovery admins must approve before access to an orphaned vault can be restored, and every step audited. To be precise about how strong that is: today the approval threshold is enforced by the rePASS application rather than by cryptographic key shares — a cryptographic (Shamir) share-based threshold is being rolled out in stages — and hardware-backed protection for the escrow key is optional via Azure Key Vault; otherwise it is encrypted with a key the server holds. Those limits — and the rollout plan — are documented in our security whitepaper.
Which platforms are supported?: The web vault runs in any modern browser. There are extensions for Chrome and Edge with autofill, TOTP and passkey support, a native macOS menu-bar app with Touch ID and system AutoFill, and the rp CLI for Linux, macOS, and Windows.
How is rePASS different from cloud password managers?: The encryption model is comparable — the trust model is not. With a cloud manager, your encrypted vault sits in a vendor’s multi-tenant cloud, a permanent high-value target. With rePASS it sits in your datacenter, protected additionally by escrow key wrapping in Azure Key Vault, device trust, AI anomaly detection and Remote Browser Isolation — a combination cloud vendors don’t offer.
How do we get started?: Open demo.repass.one — it is a full rePASS installation with sample data, and the login credentials are printed on the sign-in screen, so there is nothing to request and nothing to install. It resets every night. When you want to see it with your own data, get in touch and we’ll set up a proof-of-concept in your environment — usually running the same day thanks to the Docker-based installer.

Try rePASS with your team.

Open the live demo and look around, or tell us about your environment and we’ll tailor a rollout to it.

Try the live demo Talk to us

// contact

Tell us about your environment.

Rollout questions, a proof-of-concept in your own datacenter, licensing — whatever you need, a real engineer reads this and answers.

Prefer email? Write to [email protected]