Every platform you own
Mac, Windows and Linux desktops; iPhone and Android apps; a browser extension; a command-line tool. One license.
Pay once. Own it forever.
The password manager you buy once, with a vault that never touches our servers
You should always be in control of your secrets.
tigerpassword keeps your passwords, passkeys and crypto seed phrases in one encrypted file that you hold, on the devices you own, synced through the cloud you already pay for. We wrote the software. The team has over 40 years in software development and secrutiy. The secrets are yours.
- Zero-knowledge, two secrets
- No subscription, ever
- Mac · Windows · Linux · iPhone · Android
- Sync to your own cloud
Breaches are not slowing down. Your passwords must stop being the weak link.
Every breach headline is the same reminder: a password reused anywhere is a password lost everywhere. Publicly reported data compromises in the United States nearly tripled between 2020 and 2024, and 2024 alone produced more than a billion victim notices.
The numbers
| Year | Compromises | Victim notices |
|---|---|---|
| 2020 | 1,108 | 301 million |
| 2021 | 1,862 | 294 million |
| 2022 | 1,802 | 422 million |
| 2023 | 3,205 | 353 million |
| 2024 | 3,158 | 1.35 billion |
Source: Identity Theft Resource Center, Annual Data Breach Reports 2020–2024. Counts are publicly reported compromises affecting US residents; victim notices count notifications, not unique people.
What a breach can and cannot take from you
- One unique password per site means a breached site leaks a password that opens nothing else. That is the whole point of a manager, and the generator makes it effortless.
- Passkeys cannot be phished or replayed. A passkey signs for its own site only; a leaked database of passkey public keys is useless to an attacker.
- Vault Health tells you which passwords already appeared in a breach — checked against Have I Been Pwned without ever sending your password.
- And the vault itself is not a target. There is no tigerpassword server to breach: your encrypted file lives on your devices, sealed with two secrets only you know.
Why there is no monthly bill
Subscriptions pay for servers. tigerpassword has only this website. Your vault is an encrypted file on your devices; if you want it on all of them, it syncs through Google Drive, OneDrive, iCloud Drive or any folder you choose — as ciphertext nobody but you can open.
0servers holding your vault
2secrets seal it: your password and a Secret Key
2128work left for whoever steals the file, even with a weak password
1×the number of times you pay everywhere you use it
Built for the secrets you can't afford to lose
Passwords can be reset. A crypto recovery phrase, a hardware-wallet seed, the backup codes for your two-factor login — these can't. tigerpassword treats them as a different class of thing.
- Seed phrases are checked word by word against the official BIP-39 word lists as you type, in numbered cells that match the paper in your hand. The checksum is never skipped to make a save go through.
- Seeds are never autofilled, anywhere. The browser extension and the phone autofill services cannot ask for them, and the core refuses even if they did. They never take part in search.
- Revealing one is deliberate: amber, with a draining ring, hidden again after thirty seconds.
- Two secrets, not one. Steal the file, a sync blob or a backup, and an attacker still faces the Secret Key.
Everything a password manager should do
Autofill in your browser and on your phone, passkeys, one-time codes, a generator, a health check, encrypted backups, and imports from the manager you use today.
Passkeys that can never be shown
Sign in with passkeys from the extension and on Android. A passkey's private key has no reveal button and no place in search.
Unlock your way
Face ID or Touch ID on iPhone and Mac, a FIDO2 security key on the desktop, or your master password — which always still works.
Sync where you choose
Google Drive, OneDrive, iCloud Drive, Dropbox, Syncthing, any folder. No tigerpassword server in the middle, ever.
Backups that are always encrypted
Your folder, WebDAV, S3 or SFTP. There is no plaintext-backup switch because there is no plaintext-backup code path.
Bring everything with you
LastPass, 1Password, Bitwarden, KeePass, Chrome, Safari, Firefox, SafeInCloud and plain CSV — previewed before a single item is written.
Security you can check, not just read about
We have written down what auditors will read: the threat model, the byte-level crypto specification, the audit scope with every promise mapped to the test that enforces it, and the review that records what was swept, fixed and left open. Cryptography comes only from pinned, widely reviewed libraries; builds reproduce bit for bit.
Pay once. Use forever.
Planned pricing: a lifetime license for $59, early-bird lifetime licenses for $39 during the campaign, and a family of five for $99. All platforms, all 1.x updates. Less than two years of the subscription you are paying now — and then nothing.
Get the launch email
One email when the Kickstarter opens, one when 1.0 ships. Double opt-in, unsubscribe in one click, nothing stored until you confirm.