BlindLock

Your secrets
stay with you.

Your passwords, notes and sign-in codes stay encrypted inside an ordinary-looking image on your computer. Open your vault in BlindLock with your master password, on the device where you set it up.

Try free for 7 daysDownload · full feature set Buy a Lifetime licenceLifetime from $49 · pay once

Full feature set. No email, no payment details.

After seven days you need a licence to unlock. Export your entries before then if you do not want to keep using BlindLock.

Explore the interactive demo →

Windows, macOS and Linux · compatible security chip · one active desktop device per licence. Check system requirements.

An ordinary image. Your private vault.

Beach with palm trees at sunset used to illustrate an ordinary carrier image

holiday.pngExample file

Explore the interactive demo

Unlock the app with your PIN. Select the image. Enter your master password. The PIN protects app access. The master password protects the vault. Checking the PIN takes about ten seconds.

Once unlocked, you can, for example:

Sign in to your accounts
Copy your username and password from your vault in one click.
Complete a two-factor sign-in
Read the current sign-in code directly in BlindLock.
Keep account recovery codes
Store your accounts’ emergency codes in an encrypted note.

Everyday use and switching devices

When do I need internet?

Activation needs internet. Opening normally checks your licence. Vault contents are never transmitted. After a successful check, BlindLock stores a device-bound permit. If the server is temporarily unreachable, a valid permit allows access until its displayed expiry, normally up to seven days. A rejected licence cannot use this fallback.

How do I recover my vault on a new device?

For a new device, keep your encrypted backup file and your twelve words separately. A copied login image alone is not enough. The backup and words can restore access even if that image is lost. Separate file vaults also need their vault file and password. If required recovery material is missing and you cannot sign in anywhere, there is no back door. Read the recovery FAQ.

Three layers of protection. One clear principle.

Your vault stays on your computer. BlindLock does not collect customer vaults on a central server. Three layers protect your data: an ordinary-looking image, encryption and a link to your device.

Hidden in an ordinary-looking image

Your image still shows its original subject. BlindLock hides your encrypted passwords, notes and other contents inside it.

Encrypted twice

Two different encryption algorithms protect every entry in your login image. Each layer uses its own key. Your data is encrypted before it is hidden inside the image. File vaults use authenticated encryption.

Bound to your security chip

Without your security chip, the vault stays closed. The image file can be copied. The chip cannot. On another computer the vault stays closed, even with the image and your master password.

  • Windows and Linux: TPM
  • Mac: Secure Enclave
  • No other chip can replace it
Which technology protects what?
Protect vault contents
AES-256-GCM and XChaCha20-Poly1305 encrypt the PNG vault in two authenticated layers with separate keys.
Make password guessing costly
Argon2id makes large-scale password guessing more costly. This deliberately expensive calculation explains the wait when unlocking.
Protect key exchange
ML-KEM-1024 is reserved for key exchange when pairing with the upcoming mobile apps.
Verify signatures
ML-DSA-87 is reserved for signed trust statements when pairing with the upcoming mobile apps. It does not encrypt vault contents.

The post-quantum components have their own roles. They are not an additional encryption layer around your stored vault file. Read the technical security details.

One vault. Everything that matters.

Every BlindLock licence includes every feature — no tiers, no upsells and no premium gate on the tools you actually need.

Password manager

Stored only on your computer, with tags, favourites and instant search.

Two-factor codes

The sign-in codes for your accounts, right inside BlindLock. You need no second app.

WalletLink Coming Soon

Balances and addresses from your crypto accounts, without private keys. BlindLock reads public data only, approves nothing and holds no assets.

Encrypted file vault

Larger files live in a separate, encrypted container file.

Secure notes

Plain text with title, folder and date. Encrypted just like everything else.

Hardware keys

If you like, add a key you plug in, such as a YubiKey, Google Titan or SoloKey. It must be present to unlock (desktop).

BlindLock is not a wallet and not an exchange. It custodies no crypto assets and signs no transactions — that always stays with your own hardware wallet.

See all features →

Set up your vault in three steps.

The image is your carrier: the file containing your encrypted vault.

1

Choose your image

Pick a PNG with at least 4.4 megapixels, about 2100 × 2100 pixels.

2

Set up access and recovery

Choose your master password and link your device. Keep your encrypted backup and the twelve words separately.

3

Add passwords and notes

Store passwords, two-factor secrets and notes inside the encrypted image. Larger files go into separate encrypted containers.

What happens when you unlock?

Your PIN first unseals the hardware-anchored app key. It does not open the vault. This gate uses Argon2id with 256 MiB of memory and a check takes about ten seconds. The login-image key then depends on your device's security chip and a release from the BlindLock licence server, and BlindLock asks for your master password. Optionally, BlindLock also asks for a hardware key when unlocking.

The protection comes from the memory-hard work for each guess, not the waiting time. Read the security architecture.

Explore the interactive demoRead the full setup flow

Engineered for every platform. One device per licence.

BlindLock for Windows, macOS and Linux is available now — iOS, iPadOS and Android follow.
A Lifetime licence activates one desktop device at a time on your chosen platform.
iOS, iPadOS & Android are always free, for everyone.

Desktop — Lifetime licence
WindowsWindows 10 and 11, 64-bit macOSApple Silicon (M1 or newer), macOS 13.3 or newer LinuxDebian and Ubuntu 22.04 or newer, plus RPM and AppImage
Mobile — always free, for everyone
iOSiPhone and iPadComing Soon
AndroidPhones and tabletsComing Soon
System requirements →

Jump to the topics that matter most.

Understand local storage, cloud-free vault architecture, hardware binding and steganography — including the few connections BlindLock genuinely needs.

Cloudless vault Why your vault lives only on your computer. Hardware binding How the security chip binds your vault to your device. Steganography How your vault hides inside an ordinary image. Security Which methods protect what, and which connections exist.

Your secrets deserve to be invisible

Why I built a vault that hides inside your photos — and why it matters more than you think. A 12-minute read on the LastPass data breach, attacks that steal data today and decrypt it later, and the vault inside an image.

Read article

See whether BlindLock fits your everyday use.

Try all features for seven days on a compatible desktop. No email, no payment details, and nothing to cancel.

Try free for 7 daysDownload · full feature setExplore the interactive demo