Fenko Vault
An open-source passkey and TOTP vault that keeps your credentials on your own devices. No account, no Fenko server holding them, no cloud you have to trust.
Passwords, 2FA codes and passkeys in the same vault. That’s convenient, and we’re not here to talk anyone out of a password manager. But if that vault is breached, the password and the second factor meant to back it up fall together.
What it does
It isn’t a password manager and won’t replace one. It separates out your factors of authentication.
Passkeys
WebAuthn, intercepted
Catches navigator.credentials calls and stores the passkey locally, so your credentials sit somewhere you can actually search, export and move. When a site needs a passkey you don’t have, the vault steps aside and lets the browser handle it as usual.
TOTP
RFC 6238
Live codes in the same searchable list, so you aren’t running a second app. Add one by pasting the setup link, pasting a QR screenshot, or uploading the image. All of it decoded on your device.
PIN lock
AES-GCM at rest
An optional master PIN encrypts the vault on disk and locks the popup behind a screen.
Sync
Sync is optional and off by default. Turn it on and there is still no account, and no server holds an unencrypted copy of your vault. Your devices encrypt it, hand the blob to a few Nostr relays, and your other devices pick it up. Pairing is a recovery phrase and nothing else.
Built on
What you get
Passkeys and one-time codes in a single list you can actually search, instead of two apps that don’t know about each other. One codebase runs as a browser extension, a Firefox add-on, and a native Android passkey provider.
MIT licensed, source at FenkoHQ/passkey-vault. You can read exactly where your passkeys are kept and what does and does not leave the device.
A native passkey provider, installed from Google Play like any other app. Turn it on under Settings, Passwords and accounts, Passkeys, and it shares the same vault as the browser extension.
By default your devices use a relay we run plus a few public ones. Swap ours out, or point it at your own. Two devices stay in sync as long as they share one working relay.
Turning on sync gives you a short word list. Type it into your other devices and they are linked. That phrase never leaves them, so there is nothing for us or a relay operator to hand over.
Runs on
The threat model
Nostr is a simple public transport that nobody owns. Using it as a personal encrypted sync backbone is a bit off the beaten path, and that is the point: no token, no platform, no company sitting in the middle.
In context
| Measure | Password manager | Authenticator app | Fenko Vault |
|---|---|---|---|
| Holds passwords | Yes | No | No, by design |
| Holds 2FA | Usually, same vault | Yes | Yes, separate from passwords |
| Holds passkeys | Usually, same vault | No | Yes, on your device |
| Account required | Yes | Sometimes | None |
| Sync | Vendor cloud | Vendor cloud or none | Relays you can choose or run |
| Inspectable | Rarely | Rarely | MIT, read the source |
Free, open source, and no account to create. Install it and see whether the split makes sense for you.