Vaultrix - Password Manager on Matrix

Vaultrix is an end-to-end encrypted password manager with no server of its own. Your vault is a private, encrypted Matrix room. Any Matrix homeserver is the sync backend - matrix.org, your employer's, or one you run yourself - and it only ever stores ciphertext. There is no Vaultrix account to create, no Vaultrix server to trust, and no subscription. WHAT IT DOES - Autofill that stays out of the way. Logins for the site you are on rise to the top of the popup. Press Enter to fill, or use Cmd+Shift+L / Ctrl+Shift+L without opening the popup at all. - Save and update prompts. When you sign in or change a password, Vaultrix offers to store it, and can tell a new login apart from an update to an existing one. - Built-in one-time codes. TOTP and HOTP live inside the item, so the second factor is one click from the first. Import a secret by scanning a QR code straight off the page. - A password generator where you actually need it - anchored to the password field inside the item, plus an inline "suggest strong password" on signup and change-password forms. - More than logins: secure notes, credit cards, identities, API credentials, and passkeys. - Multi-device sync through ordinary Matrix sync, with a live timeline watcher that applies changes from your other devices as they arrive. - Item history. The room timeline is an append-only version log, so every change to every entry is recoverable, and a deleted entry can never be silently resurrected by a stale device. HOW THE ENCRYPTION WORKS Every entry is AES-256-GCM encrypted on your device under a vault master key before Matrix's own Megolm room encryption ever sees it. That is two independent layers between your passwords and the server. The homeserver sees encrypted blobs and ordinary Matrix metadata - never your titles, usernames, passwords, notes, or card numbers. The Matrix end-to-end encryption layer is the standard, widely deployed stack (matrix-js-sdk with vodozemac), not a homegrown protocol. GETTING BACK IN Vaultrix uses the standard Matrix recovery key (SSSS). One key restores your whole vault from encrypted server-side key backup on any fresh device - print it, put it in a safe, done. Already have Vaultrix on another device? Skip the key entirely: add the new device by comparing seven emoji, exactly like verifying a Matrix session. The vault key is handed over end-to-end and the server never sees it. WHY MATRIX Matrix had already solved the hard parts of a password manager backend - end-to-end encrypted multi-device sync, an append-only history, key backup and recovery, and a real permissions model for shared rooms. Vaultrix leans on the real thing rather than reinventing it, which is also why you can self-host the entire stack by running a homeserver. PRIVACY No analytics. No telemetry. No crash reporting. No remote code. The extension talks to exactly one host: the homeserver you typed in at sign-in. Nothing is ever sent to the developer. Privacy policy: https://github.com/JorikSchellekens/vaultrix/blob/main/PRIVACY.md OPEN SOURCE MIT licensed, source at https://github.com/JorikSchellekens/vaultrix - including the browser extension, a web vault, and a Tauri desktop app sharing one core. STATUS Alpha, under active development. The Matrix E2EE layer is the standard audited stack, but Vaultrix itself has not had an independent security review. Please do not make it the only copy of credentials you cannot afford to lose.