2Secret

A free, open-source password manager – one Rust codebase for macOS, Windows, Linux, the BSDs, iOS, Android, the web and your browser.

---

🇳🇱 Nederlands: lees verder in het Nederlands ↓

2Secret keeps your passwords, credit cards, notes, identities, SSH keys and other secrets end-to-end encrypted. It works like 1Password – master password plus a Secret Key, vaults you can share with family or colleagues, Watchtower, a password generator, one-time codes and browser autofill – but it is free, open source, and you can host the sync server yourself.

Features

🔐 Two-Secret Key Derivation	Master password (Argon2id) combined with a 130-bit Secret Key that never leaves your devices. A stolen server database is useless for guessing passwords.
🧱 End-to-end encryption	Every item is encrypted with 256-bit keys (XChaCha20-Poly1305), per-vault keys, quantum-resistant hybrid encryption (X25519 + ML-KEM-768) for sharing. The server only sees ciphertext, padded to hide exact sizes.
🔗 Share via link	Share an item with someone without 2Secret: an end-to-end encrypted link that expires (1 hour to 30 days), can be limited to a number of views and can ask for a password.
🆘 Emergency access	Trust someone with read access to your vaults for when you cannot give it: they ask, and get it after a waiting period you choose unless you deny it.
🗂️ Vaults & sharing	Multiple vaults; share a vault with other people on your server as viewer, editor or manager; leave or revoke access at any time.
🧾 19 item types	Logins, passwords, secure notes, credit cards, identities, bank accounts (IBAN/BIC), crypto wallets, software licenses, SSH keys, API credentials, databases, servers, Wi-Fi routers, e-mail accounts, passports, driver licenses, memberships, reward programs and documents – plus custom fields, tags, favorites and encrypted file attachments.
⏱️ One-time passwords	Built-in TOTP authenticator (RFC 6238, SHA-1/256/512, Steam Guard) with live codes. Setup links (otpauth://) open 2Secret on Windows, Linux and Mac, the desktop apps read setup QR codes straight from the screen, and on iPhone and iPad QR codes scanned with the camera work too (Set Up Codes In).
🛡️ Watchtower	Finds weak, reused and old passwords, unencrypted (http://) sites, expired and expiring cards/documents, and – opt-in – passwords from data breaches via Have I Been Pwned (k-anonymity: only 5 hash characters leave your device).
📊 Dashboard	After unlocking: your favourites, recent changes, vaults and security score at a glance, without showing any secrets. Or start with all items, favourites or Watchtower.
🎲 Password generator	Random passwords, memorable passphrases (EFF wordlist) and PINs with entropy and strength estimates (zxcvbn). In the item editor each password can have its own rules (length, character sets), which the item keeps for the next new password. SSH Key items can generate a new Ed25519 key pair (OpenSSH format).
🔄 Sync	Offline-first; automatic sync with conflict resolution (no password is ever lost – the losing version goes into the password history).
🧩 Browser extension	Chrome, Edge, Brave and Firefox: suggestions for the current site, one-click fill of username, password and one-time code.
🖼️ Website icons	Logins show their website's icon, fetched by the apps straight from the website (no icon service in between) and synced end-to-end encrypted with the login.
🔑 Passkeys	Save passkeys in your vault and sign in with them from the browser extension and AutoFill on iPhone, iPad and Mac; end-to-end encrypted and synced. Import from Bitwarden.
📲 AutoFill	iPhone, iPad and Mac: fill passwords, passkeys and verification codes in Safari and other apps after Face ID or Touch ID, without a browser extension. On the Mac this needs macOS 14 and a release signed with a Developer ID; verification codes need iOS 18 or macOS 15.
👥 Profiles	Keep two accounts in the apps, for example a personal one and one for work on another server, and switch between them from the top of the sidebar.
🖥️ Menu bar & system tray	On the desktop 2Secret keeps an icon in the menu bar (macOS) or the system tray (Windows, Linux) to open it, lock it or quit; closing the window keeps it running there. It can start there when you log in.
🔐 SSH agent	ssh and git use the SSH keys in your vault (Ed25519, ECDSA, RSA) after you allow it in 2Secret; the private keys never leave it.
⚡ Quick Access	Ctrl+Shift+Space (⇧⌘Space on the Mac) anywhere: find an item and copy its password, user name or one-time code without opening 2Secret.
⌨️ Keyboard friendly	Ctrl/⌘+F search, Ctrl/⌘+N new item, Ctrl/⌘+L lock, Esc closes dialogs.
💻 CLI for developers	2secret read 2s://vault/item/field, 2secret run -- cmd and 2secret inject keep secrets out of config files and CI.
📥 Import / export	Import from 1Password (.1pux, CSV), Bitwarden (JSON, CSV), LastPass, Chrome, Edge, Firefox, Safari, KeePass (XML), KeePassXC, Dashlane; export to encrypted backups, JSON or CSV.
🔒 Auto-lock & clipboard clearing	Configurable lock timeout; copied secrets are wiped from the clipboard. Unlock with Touch ID, Face ID or Windows Hello.
⬆️ Signed updates	Opt-in: the desktop apps install new versions themselves, Android says when one is available. Only updates signed with 2Secret's key are installed (details).
🌍 English & Nederlands	The apps follow your system language.
🏠 Sync your way	Use the 2Secret server (sync.2secret.app), host your own – one small binary or Docker image that also serves the web vault – or keep a vault on one device.
💾 Backups	Encrypted backups of all vaults in one file, with a reminder now and then.

Platforms

All apps share one Rust codebase (Dioxus UI + the twosecret-core crate).

Platform	App	How
macOS	desktop app (.app, .dmg)	dx bundle --platform desktop
Windows	desktop app (setup .exe)	dx bundle --platform desktop
Linux	desktop app (.deb, .rpm, AppImage)	dx bundle --platform desktop
FreeBSD, OpenBSD, NetBSD	desktop app, CLI, server	cargo build (WebKitGTK)
iOS / iPadOS	native app	dx bundle --platform ios (on macOS with Xcode)
Android	native app (.apk, .aab)	scripts/android.sh (Android SDK + NDK)
Web	web vault in any browser (WebAssembly)	served by 2secret-server
Browsers	extension for Chrome, Edge, Brave, Firefox	extension/build.sh
Terminal	2secret CLI	cargo install --path crates/cli

Quick start

1. Choose where to sync (optional)

A local-only vault works without any server, and the apps can sync through the 2Secret server (sync.2secret.app) without any setup. To run your own server instead – it also serves the web vault:

docker compose -f deploy/docker-compose.yml up -d     # with automatic HTTPS via Caddy
# or
docker run -p 8743:8743 -v 2secret-data:/data ghcr.io/joostiphone/2secret:latest

See docs/SELF-HOSTING.md for TLS, invite-only sign-ups, backups and systemd, and docs/PUBLIC-SERVER.md for a server for many people on Proxmox with a Cloudflare Tunnel.

2. Install an app

Download a build from the releases, or build one:

# Desktop (macOS, Windows, Linux, BSD) – Linux needs libwebkit2gtk-4.1-dev, libgtk-3-dev, libxdo-dev
# (and libayatana-appindicator3-1 for the icon in the system tray)
cargo run --release -p twosecret-app

# Command line tool and server
cargo install --path crates/cli
cargo install --path crates/server

Create an account, save your Emergency Kit (it contains your Secret Key), and you are done. On other devices choose Sign in to an existing account.

3. The CLI

2secret account create --server https://vault.example.com
eval "$(2secret unlock)"                     # unlock this shell for 30 minutes
2secret add login --title GitHub --username octocat --generate --url github.com
2secret list
2secret read "2s://Personal/GitHub/password"
DATABASE_PASSWORD="2s://Work/Postgres/password" 2secret run -- ./deploy.sh
2secret import ~/Downloads/1PasswordExport.1pux
2secret watchtower --breach-check

Full reference: docs/CLI.md.

Not (yet) included

Compared with 1Password, these are missing today – contributions welcome:

• Biometric unlock on Linux, Android and in the browser (the master password is required there).
• Creating passkeys outside the browser extension; using them on Android and in the desktop apps.
• System autofill on Android. (Safari fills through AutoFill on iPhone, iPad and Mac.)
• An independent security audit.

Security

2Secret's design follows 1Password's published security model:

• Two secrets. Keys are derived from your master password and a random Secret Key (2S-XXXXXX-…) generated on your device. The server never has enough information to brute-force your password.
• Zero knowledge. Item contents, titles, URLs, vault names and even the sync token are encrypted before they leave your device.
• Modern primitives. Argon2id (64 MiB, 3 passes), HKDF-SHA256, XChaCha20-Poly1305 with context-bound associated data; vault sharing with a post-quantum hybrid of X25519 and ML-KEM-768 (FIPS 203).
• Defence in depth. Server-side Argon2id over the authentication key, login rate limiting, strict Content-Security-Policy for the web vault, owner-only file permissions, secrets zeroized in memory.

Read the full white paper in docs/SECURITY.md. Found a vulnerability? Please follow SECURITY.md.

Building from source

Requirements: Rust 1.85+ (rustup), and for GUI builds the Dioxus CLI dx 0.7.

cargo test --workspace --exclude twosecret-app   # core, client, server, CLI (incl. end-to-end tests)

# Desktop
cargo run -p twosecret-app

# Web vault (output in crates/app/dist/public, serve it with 2secret-server --web-dir)
cd crates/app && dx bundle --platform web --release

# iOS (on macOS with Xcode)
cd crates/app && dx bundle --platform ios --release

# Browser extension (output in extension/dist)
./extension/build.sh

# FreeBSD / OpenBSD / NetBSD: install Rust plus the WebKitGTK 4.1 and GTK 3
# packages from your ports/packages collection, then:
cargo build --release -p twosecret-app -p twosecret-cli -p twosecret-server

Project layout

crates/core     Crypto, vault & item model, sync merge, generator, TOTP, Watchtower, importers (no I/O, runs everywhere incl. WebAssembly)
crates/client   HTTP client and sync engine (native + WebAssembly)
crates/server   Zero-knowledge sync server (axum + SQLite) that also serves the web vault
crates/cli      The `2secret` command line tool
crates/app      The Dioxus app: desktop, web, iOS and the browser extension
extension/      Browser extension manifest and build script
deploy/         docker-compose, Caddyfile, systemd unit
docs/           Security white paper, self-hosting guide, CLI reference, architecture

More in docs/ARCHITECTURE.md.

License

2Secret is free software, dual-licensed under the MIT or Apache 2.0 license, at your option. The passphrase wordlist is the EFF large wordlist (CC BY 3.0 US); icons are from Feather (MIT).

---

🇳🇱 Nederlands

2Secret is een gratis, open-source wachtwoordmanager – een volwaardig alternatief voor 1Password, geschreven in één Rust-codebase voor macOS, Windows, Linux, BSD, iOS, het web en je browser.

Wat kan 2Secret?

• Veilig door twee geheimen: je hoofdwachtwoord (Argon2id) gecombineerd met een geheime sleutel van 130 bits die alleen op jouw apparaten staat. Zelfs met een gestolen serverdatabase kan niemand je wachtwoord raden.
• End-to-end versleuteld: alles wordt op je apparaat versleuteld (XChaCha20-Poly1305); de server ziet alleen versleutelde gegevens.
• Kluizen en delen: meerdere kluizen, te delen met gezin of collega's als kijker, bewerker of beheerder. Delen is bestand tegen toekomstige kwantumcomputers (X25519 + ML-KEM-768).
• 19 soorten items: logins, wachtwoorden, notities, creditcards, identiteiten, bankrekeningen (IBAN/BIC), crypto-wallets, licenties, SSH-sleutels, API-sleutels, databases, servers, wifi, paspoorten, rijbewijzen en meer – met eigen velden, labels, favorieten en versleutelde bijlagen.
• Eenmalige codes (2FA/TOTP) ingebouwd; de desktop-apps lezen de QR-code om ze in te stellen rechtstreeks van je scherm.
• Watchtower: waarschuwt voor zwakke, hergebruikte en oude wachtwoorden, onbeveiligde websites, verlopen passen en (optioneel) gelekte wachtwoorden via Have I Been Pwned.
• Wachtwoordgenerator voor willekeurige wachtwoorden, wachtwoordzinnen en pincodes, en nieuwe Ed25519-SSH-sleutels in SSH-sleutel-items.
• Synchronisatie tussen al je apparaten via je eigen server, ook offline bruikbaar.
• Browserextensie (Chrome, Edge, Brave, Firefox) die inloggegevens en eenmalige codes automatisch invult, en passkeys bewaart en gebruikt.
• Opdrachtregel (CLI) voor ontwikkelaars, met 2s://-verwijzingen naar geheimen.
• Importeren uit 1Password, Bitwarden, LastPass, Chrome, Firefox, Safari, KeePass, Dashlane en meer.
• Automatisch vergrendelen en klembord wissen; ontgrendelen met Touch ID, Face ID of Windows Hello.
• Icoon in de menubalk (Mac) of het systeemvak (Windows, Linux) om 2Secret te openen, te vergrendelen of af te sluiten; als je het venster sluit, blijft 2Secret daar actief. Het kan daar starten als je inlogt.
• SSH-agent: ssh en git gebruiken de SSH-sleutels in je kluis nadat je dat in 2Secret toestaat; de privésleutels verlaten 2Secret nooit.
• Snelzoeken: druk overal op Ctrl+Shift+Spatie (⇧⌘Spatie op de Mac), zoek een item en kopieer het wachtwoord, de gebruikersnaam of de eenmalige code zonder 2Secret te openen.
• Delen via link: deel een item met iemand zonder 2Secret, via een end-to-end versleutelde link die verloopt (1 uur tot 30 dagen), een beperkt aantal keer te openen is en om een wachtwoord kan vragen.
• Noodtoegang: geef iemand die je vertrouwt leestoegang tot je kluizen voor als jij dat niet meer kunt: ze vragen erom en krijgen die na een wachttijd die jij kiest, tenzij je weigert.
• Back-ups: een versleutelde kopie van al je kluizen in één bestand, met af en toe een herinnering.
• Synchroniseren zoals jij wilt: via de 2Secret-server (sync.2secret.app), je eigen server, of alleen op één apparaat.
• Updates (als je het aanzet): de desktop-apps installeren nieuwe versies zelf, Android meldt ze. Alleen updates met de handtekening van 2Secret worden geïnstalleerd.
• Nederlands en Engels.

Nog niet aanwezig

Biometrisch ontgrendelen op Linux, Android en in de browser, passkeys aanmaken buiten de browserextensie, een Safari-extensie, automatisch invullen op Android, en een onafhankelijke beveiligingsaudit.

Snel aan de slag

1. Server (optioneel): synchroniseer via de 2Secret-server (sync.2secret.app, niets in te stellen), of start een eigen server met docker compose -f deploy/docker-compose.yml up -d (automatische HTTPS). Zonder server werkt 2Secret gewoon lokaal op één apparaat. Zie docs/SELF-HOSTING.md.
2. App: download een versie bij Releases of bouw hem zelf met cargo run --release -p twosecret-app.
3. Account aanmaken: kies een sterk hoofdwachtwoord en bewaar je noodkit (die bevat je geheime sleutel). Op een ander apparaat kies je Inloggen op een bestaand account.

⚠️ Je hoofdwachtwoord en geheime sleutel kunnen door niemand worden hersteld – ook niet door de beheerder van de server. Print de noodkit en bewaar hem op een veilige plek.

Licentie

Gratis en open source onder de MIT- of Apache-2.0-licentie (naar keuze).