Your stack.
Encrypted down to the last node.
We're changing the way youorganize your passwords.
PASSmap turns the chaos of accounts, domains, passwords and 2FA into one visual map — encrypted in your browser, before anything touches our servers.
Why PASSmap
Your brain thinks in trees — not lists.
Classic password managers store accounts as a flat contact list. That works until you have 20 entries. At 200 — project, client, environment, subdomain, alias — you're searching blind. PASSmap was built because tooling for managing infrastructure should match how people actually think about systems.
We built PASSmap for ourselves — a developer running a dozen client projects, each with its own hosting, domain panel, repo, mailbox, database, S3, cloud account and 2–3 environments. Excel fell apart in a quarter. Bitwarden hid everything in folders, but didn't show what depended on what. We needed a tool that shows the entire project map at a glance — and still keeps secrets zero-knowledge.
“If you have more than one client, two environments and your own hosting — within a week you'll find that a folder in a classic manager is just sweeping chaos under the rug.”
List vs. tree
Classic manager (list / folders)
- Flat structure: name, login, password.
- Folders max. 1–2 levels deep, no relations between entries.
- You can't see that hosting → domain → WP admin → database is a single chain.
- Onboarding a teammate = sharing 15 separate entries.
- Auditing “what's in project X” = manual filtering.
PASSmap (mind-map)
- N-level hierarchy: client → project → environment → service → account.
- Every node sees its parent and children — natural context.
- One glance shows the full project stack and dependencies.
- Share a whole branch, not 15 entries.
- Audit = expand the client node. Done.
Hierarchical structures aren't an arbitrary UX choice — they're how the cortex naturally organises knowledge about complex systems.
Chunking (Miller, 1956)
Working memory holds ~7±2 items at once. A tree groups 50 entries into 7 branches of 7 — cognitively cheap. A list isn't. The classic “Magical Number Seven” paper from Princeton.
Hierarchical encoding (Bower et al., 1969)
Stanford experiment: words organised in a hierarchy were recalled 2–3× better than the same words in random order. The brain encodes structure together with content.
Cognitive load theory (Sweller, 1988)
When managing infrastructure, the load comes from relations (“which key for which database in which environment?”). A tree visualisation externalises those relations — you stop holding them in your head.
Spatial memory (Maguire, 2000)
The famous London-cabbie hippocampus study: the brain remembers better when information has spatial position. A mind-map gives every secret a fixed “place” on the canvas.
What it means in practice
Instead of searching (“admin… which environment?”), you click the project branch and everything is right there.
why.outcomes.2.body
Every password sits under a specific project node. Delete the project — the entire branch goes with it, no orphans left in the database.
A new teammate gets the client branch with full context — not a list of 30 unrelated entries.
Live demo
This is how grows your vault.
Every new node — a domain, account, password, recovery — is plugged into the tree, and its content is encrypted in your browser before it ever reaches the database. What you see on the right is exactly what happens in your app on every click.
Node Details
Security model
Five layers of defense. Zero trust in the server.
We use the classic defense-in-depth model: every layer is independent and self-sufficient, so compromising one does not give an attacker access to your data. At no point does the server hold the cryptographic material required to decrypt your vault.
Defense-in-depth
defense-in-depth · 5 ×
Layer 1
Client-side cryptography
All cryptography happens in the browser, on the native Web Crypto API (SubtleCrypto). The server never sees plaintext or your key.
Zero-knowledge architecture
Your master password never leaves the device — neither as plaintext nor as a hash. The server only stores ciphertext + IV + auth tag. Infrastructure operators, database admins, and even a court order cannot change the fact that without your password the data is mathematically unreadable.
AES-256-GCM (NIST SP 800-38D)
Every node is encrypted independently with symmetric AES-256 in GCM mode. A 96-bit IV is drawn from a CSPRNG for every operation (no nonce-collision risk). The 128-bit GCM auth tag guarantees integrity — flipping a single byte of ciphertext immediately fails decryption.
PBKDF2-HMAC-SHA256 · 600,000 iterations
The master key is derived from your master password via PBKDF2 with a 16-byte per-user salt (matching OWASP ASVS L3 and OWASP 2023 recommendations). 600k iterations make GPU attacks economically infeasible: ~$10⁹ to brute-force a 12-character high-entropy password.
Recovery key (envelope encryption)
On setup we generate a 32-byte Recovery Key from a CSPRNG. The master key is additionally wrapped by it and stored as a separate ciphertext. If you lose your master password, you can recover the vault by entering the recovery key — but we never see it.
Data flow
Your secret traveling through 5 layers of defense
Click any layer or step through one by one
Each node is one of the 5 defense layers. Click a node to inspect it, or hit "Start" to walk the packet from your browser to the server.
Tip · click nodes or use the arrows above
Data packet
plaintextstripe_api_key=sk_live_4f9...algo
AES-256-GCM
kdf
PBKDF2 · 600k
iv
96-bit · CSPRNG
tag
128-bit GCM
What does our server actually see?
| Field | Server | You |
|---|---|---|
| Email (for sign-in) | Sees | Sees |
| Master password | Does not see | Sees |
| Vault master key | Does not see | Sees |
| Project / domain / login names | Ciphertext only | Sees |
| Stored passwords and 2FA secrets | Ciphertext only | Sees |
| Recovery key | Does not see | Sees |
| Node creation timestamp | Sees | Sees |
Compliance & standards
How it works step by step
- 1Sign up. Provide an email and a master password (min. 12 chars, checked against HIBP). We'll send a verification link.
- 22FA enrollment. On first sign-in you scan a QR in your authenticator app. You can't continue without it.
- 3Encryption setup. From your password we derive (PBKDF2 600k) the master key. We generate a recovery key — you download a .txt file.
- 4Daily use. Every node is encrypted in the browser (AES-256-GCM, fresh IV) and sent to the database as ciphertext. Reading = fetching the ciphertext and decrypting locally.
Honestly: where we win, where others do
We compare ourselves with 1Password, Bitwarden, LastPass, Dashlane and Keeper — no marketing fluff. We also show our deliberate trade-offs.
Where PASSmap wins
Argon2id instead of PBKDF2
Bitwarden and 1Password still use PBKDF2 (vulnerable to GPU/ASIC attacks). We use Argon2id — recommended by OWASP since 2021 as the new standard for password-based key derivation.
No account recovery mechanism
1Password has Secret Key + recovery codes, Dashlane and LastPass allow support-based reset — extra attack vectors. With us, the master password never leaves your browser. Forget it = data is gone. That's a feature, not a bug.
Per-node encryption, not per-vault
Mainstream encrypts the whole vault with one key — a leak means the entire dataset is brute-forceable offline. Each of our tree nodes has its own derived key, so any compromise stays granular.
Full audit log from day one
Every login, vault unlock, 2FA toggle, key export — logged with IP and user-agent. Visible in the Activity panel. Mainstream often hides this behind Business plans.
Strict CSP + zero telemetry
A strict Content Security Policy blocks third-party scripts. No trackers, no third-party analytics, no fingerprinting. Your session is a black box.
Where we are „worse” — and why it's a deliberate choice
No browser extension
Most major incidents (LastPass 2022, Bitwarden phishing iframe 2024) went through the extension. No plugin = less convenience, but eliminates an entire class of attacks: malicious updates, code injection, side-channel leaks.
No native autofill
Autofill gets tricked by hidden form fields and clickjacking. Manual copy with auto-clearing clipboard after 30 s is slower but eliminates silent leaks to malicious pages.
No desktop / mobile apps
Native apps require trusting binaries, app stores (App Store, Play) and the OS. A browser PWA has a smaller attack surface and works the same everywhere — no extra updates to verify.
No password sharing between users
Sharing requires either public-key exchange (complex UX) or server-side mediation (breaks zero-knowledge). We chose zero-knowledge without compromise. Sharing will land only when we can do it fully E2E.
Younger project — no third-party audit yet
1Password and Bitwarden have SOC 2 and crypto audits. We don't — yet. But our entire crypto code is open for inspection, built on standard primitives (WebCrypto, libsodium-style), with no homemade algorithms.
Comparison matrix
| Feature | PASSmap | 1Password / Bitwarden / LastPass |
|---|---|---|
| Key derivation algorithm | Argon2id (OWASP 2021+) | PBKDF2-SHA256 |
| Master password reset | Impossible (zero-knowledge) | Often possible via support / recovery code |
| Encryption granularity | Per-node, derived key | Per-vault, single key |
| Browser extension | None (deliberate) | Yes — attack vector |
| Telemetry / trackers | Zero | Analytics, crash reports |
| Full audit log | Standard, on every plan | Business plans only |
| Structure visualization | Mind-map / tree | Flat list + folders |
Pricing
Pick the plan that fits.
You pay for what you use — no hidden fees, no ads, no data selling. Longer commitment, lower price.
Starting soon
We're getting ready to launch. Leave your email and we'll notify you the moment you can create an account.
1 month
For short-term needs.
- Unlimited nodes and projects
- Zero-knowledge AES-256-GCM
- Mandatory 2FA + recovery key
- Cross-device sync
- JSON import / export
- All future features included
3 months
An easy way to test it out.
- Unlimited nodes and projects
- Zero-knowledge AES-256-GCM
- Mandatory 2FA + recovery key
- Cross-device sync
- JSON import / export
- All future features included
1 year
Best price-to-value ratio.
- Unlimited nodes and projects
- Zero-knowledge AES-256-GCM
- Mandatory 2FA + recovery key
- Cross-device sync
- JSON import / export
- All future features included
Lifetime
Pay once, use forever.
- Unlimited nodes and projects
- Zero-knowledge AES-256-GCM
- Mandatory 2FA + recovery key
- Cross-device sync
- JSON import / export
- All future features included
Ready for secure order?
Create an account in 30 seconds. Your data is encrypted from the first click.
Create an account