Fenko Vault

A second factor is only worth having if it lives somewhere the first one doesn’t.

An open-source passkey and TOTP vault that keeps your credentials on your own devices. No account, no Fenko server holding them, no cloud you have to trust.

Get the extension Read the source
The Fenko Vault popup and its sync path On the left, the browser extension popup listing passkey and TOTP entries with site names redacted and live one-time codes counting down. On the right, the optional sync path: a device encrypts the vault, relays carry only ciphertext, and another device decrypts it. No server ever holds the vault. extension popup Vault PIN Search PASSKEY TOTP 418 902 PASSKEY TOTP 735 116 PASSKEY Sync, if you turn it on your device relay relay relay your other device What a relay sees 8f3ac91e7d4b0562aa18ff37c95e2d04b7118ae6f0c3d92a4e7b e51d7c8039fa6b2ed4470c81b93f5a26d0e8c714ff2b590a63d1 end-to-end encrypted no account, no server

Most password managers now keep every factor in one basket.

Passwords, 2FA codes and passkeys in the same vault. That’s convenient, and we’re not here to talk anyone out of a password manager. But if that vault is breached, the password and the second factor meant to back it up fall together.

What it does

One job, done properly.

It isn’t a password manager and won’t replace one. It separates out your factors of authentication.

Passkeys

WebAuthn, intercepted

Catches navigator.credentials calls and stores the passkey locally, so your credentials sit somewhere you can actually search, export and move. When a site needs a passkey you don’t have, the vault steps aside and lets the browser handle it as usual.

TOTP

RFC 6238

Live codes in the same searchable list, so you aren’t running a second app. Add one by pasting the setup link, pasting a QR screenshot, or uploading the image. All of it decoded on your device.

PIN lock

AES-GCM at rest

An optional master PIN encrypts the vault on disk and locks the popup behind a screen.

Sync

Cross-device, without an account provider.

Sync is optional and off by default. Turn it on and there is still no account, and no server holds an unencrypted copy of your vault. Your devices encrypt it, hand the blob to a few Nostr relays, and your other devices pick it up. Pairing is a recovery phrase and nothing else.

Assessment phases and human gates 5 phases run in sequence: Your device, Encrypt, Relays, Decrypt, and Other device. A human gate labelled Ciphertext sits in front of Relays. Your device Encrypt Ciphertext Relays all a relay sees Decrypt Other device

Built on

  • WebAuthn
  • RFC 6238 TOTP
  • RFC 4226 HOTP
  • Nostr NIP-01
  • BIP-39
  • secp256k1 / BIP340
  • PBKDF2 100k SHA-256
  • AES-256-GCM

What you get

One searchable vault, on your hardware.

The vault

Passkeys and one-time codes in a single list you can actually search, instead of two apps that don’t know about each other. One codebase runs as a browser extension, a Firefox add-on, and a native Android passkey provider.

  • Chrome, Edge, Brave and Opera, plus Firefox and Android
  • JSON backup and import, private keys included, so you are never stuck
  • A standalone recovery page for when you cannot get into the extension
  • Interception rules: off, all sites, or an allowlist you control

Open all the way down

MIT licensed, source at FenkoHQ/passkey-vault. You can read exactly where your passkeys are kept and what does and does not leave the device.

On Android too

A native passkey provider, installed from Google Play like any other app. Turn it on under Settings, Passwords and accounts, Passkeys, and it shares the same vault as the browser extension.

Run your own relay

By default your devices use a relay we run plus a few public ones. Swap ours out, or point it at your own. Two devices stay in sync as long as they share one working relay.

A phrase, not an account

Turning on sync gives you a short word list. Type it into your other devices and they are linked. That phrase never leaves them, so there is nothing for us or a relay operator to hand over.

Runs on

  • Chrome
  • Edge
  • Brave
  • Opera
  • Firefox
  • Android
  • Chrome Web Store
  • Firefox Add-ons
  • Google Play
  • MIT licensed

The threat model

Relays see scrambled bytes and nothing else.

Nostr is a simple public transport that nobody owns. Using it as a personal encrypted sync backbone is a bit off the beaten path, and that is the point: no token, no platform, no company sitting in the middle.

  • Your vault is encrypted on your device before it is ever handed to a relay.
  • The recovery phrase is the keys to everything. Anyone holding it can join your sync.
  • Your passkeys, 2FA secrets and any exported backup are real credential material. Treat them like passwords.

In context

Where it sits next to what you already run.

Measure Password manager Authenticator app Fenko Vault
Holds passwords Yes No No, by design
Holds 2FA Usually, same vault Yes Yes, separate from passwords
Holds passkeys Usually, same vault No Yes, on your device
Account required Yes Sometimes None
Sync Vendor cloud Vendor cloud or none Relays you can choose or run
Inspectable Rarely Rarely MIT, read the source

Get it

Keep your factors apart.

Free, open source, and no account to create. Install it and see whether the split makes sense for you.

Get the extension Read the source