DribbleVault — secure, organize, protect macOS · Apple silicon and Intel

Your passwords never leave your Mac.

DribbleVault keeps passwords, SSH keys, certificates and .env files in a local encrypted vault. No account to create, no server to trust, nothing uploaded — the app makes no network calls unless you switch on one of two optional checks.

Get DribbleVault How it works

Free version is not a trial. It does not run out.

Signed and notarised by Apple. Verify the download if you like:
shasum -a 256 DribbleVault-0.1.0-universal.dmg
00ad4f6b43ea38451e58f17b418f726b5382ab899c4fe3b1a31876db2a5e730c

How it is protected

Published, reviewed algorithms. Nothing invented here, and nothing you have to take on trust that cannot be checked.

Argon2id + XChaCha20-Poly1305

Your master password is stretched with Argon2id, which won a public competition for exactly this job. Vault contents are sealed with XChaCha20-Poly1305.

The memory cost is the point

Argon2id runs at 256 MiB, calibrated on your own Mac. That limits how many guesses an attacker can run in parallel on a graphics card — roughly 96 at a time on a 24 GB card.

Nothing derived is stored

Your password is never saved, and neither is any value derived from it that would let somebody test guesses more cheaply.

It locks itself

After inactivity, and whenever the Mac sleeps. Anything copied to the clipboard is cleared with it.

Length is hidden too

Records are padded into fixed buckets before encryption, so the size of a file on disk does not disclose the size of what is inside it.

Backups you can actually restore

Encrypted, verifiable, and restorable on another Mac with nothing but the file and your passphrase.

Pricing

One payment. No subscription, because there is no server to pay for.

Free

$0

A complete password manager.

  • Unlimited passwords and notes
  • Two-factor codes (TOTP)
  • Password generator
  • Folders, tags and search
  • Encrypted backup and export
  • Import from other managers
Download for macOS

Pro

$29 once

Everything in Free, plus the developer layer.

  • Encrypted file vault — documents, SSH keys, certificates
  • .env file vault with masked values
  • Security Center: weak, reused and stale passwords
  • One year of new versions
Buy DribbleVault Pro

The version you buy keeps working forever. A year of updates is included; after that you only pay again if you want a newer build.

Questions people actually ask

What happens if I stop paying?

Nothing, to your data. Your vault opens, every password and file stays readable, copyable and exportable. You lose the ability to add new files and to run the audit — never the ability to get your own things out. That is a rule the code is tested against, not a promise.

What if I forget my master password?

Then the vault is gone, and we cannot help. There is no reset, no hint and no recovery, because the key never leaves your Mac and we never hold anything that could open it. That is the trade for there being no server. Write it down.

Is there sync between my devices?

No. Today DribbleVault is one Mac, one vault. You can move an encrypted backup yourself. Sync would mean a server holding your data, and that is a different product with a different threat model — if it is ever built, it will be described honestly rather than added quietly.

Can I check the encryption is what you say?

The formats, the key hierarchy and the threat model are written down in full, and the primitives are verified against independent implementations rather than against themselves. What has not happened is an independent third-party audit, and until it has, that is stated here rather than glossed over.

Is my licence tied to one machine?

No. It is a signed file with your name on it and no activation, no machine fingerprint and no call home. Reinstall as often as you like. It carries your name because that is what makes people not pass it around.

iPhone and iPad?

Not yet. macOS first, properly, then iOS.