Argon2id + XChaCha20-Poly1305
Your master password is stretched with Argon2id, which won a public competition for exactly this job. Vault contents are sealed with XChaCha20-Poly1305.
Home / Products / DribbleVault
- Free download
- macOS · Apple silicon & Intel
- Signed & notarised by Apple
DribbleVault
Your passwords never leave your Mac.
DribbleVault keeps passwords, SSH keys, certificates and .env files in a local encrypted vault. No account to create, no server to trust, nothing uploaded — the app makes no network calls unless you switch on one of two optional checks.
Version 0.1.2 · universal .dmg, 7.3 MB · The free version is not a trial. It does not run out.
Signed and notarised by Apple. Verify the download if you like:
shasum -a 256 DribbleVault-0.1.2-universal.dmg 9796e8d0dfef85bfd3ad38510a93d1032b545d5797db82348e5963f5745e9231
How it is protected
Published, reviewed algorithms. Nothing invented here.
And nothing you have to take on trust that cannot be checked. The full details are on the security page.
The memory cost is the point
Argon2id runs at 256 MiB, calibrated on your own Mac. That limits how many guesses an attacker can run in parallel on a graphics card — roughly 96 at a time on a 24 GB card.
Nothing derived is stored
Your password is never saved, and neither is any value derived from it that would let somebody test guesses more cheaply.
It locks itself
After inactivity, and whenever the Mac sleeps. Anything copied to the clipboard is cleared with it.
Length is hidden too
Records are padded into fixed buckets before encryption, so the size of a file on disk does not disclose the size of what is inside it.
Backups you can actually restore
Encrypted, verifiable, and restorable on another Mac with nothing but the file and your passphrase.
Pricing
One payment. No subscription.
Because there is no server to pay for.
Free
$0
A complete password manager.
- Unlimited passwords and notes
- Two-factor codes (TOTP)
- Password generator
- Folders, tags and search
- Encrypted backup, and export to CSV
- Import from other managers
Pro
$29 once
Everything in Free, plus the developer layer.
- Encrypted file vault — documents, SSH keys, certificates
.envfile vault with masked values- Security Center: weak, reused and stale passwords
- One year of new versions
Available shortly. Pro is not on sale yet — the payment account is still being approved. The free version is complete and is not a trial. If you want a note when Pro opens, email support@dribblesoft.com. When it does: the version you buy keeps working forever. A year of updates is included; after that you only pay again if you want a newer build.
At a glance
- Platform
- macOS, universal (Apple silicon & Intel)
- Version
- 0.1.2 · 7.3 MB .dmg
- Encryption
- Argon2id + XChaCha20-Poly1305
- Network
- None, unless you turn on an optional check
FAQ
Questions people actually ask.
More answers on the support page.
Nothing, to your data. Your vault opens, every password and file stays readable, copyable and exportable. You lose the ability to add new files and to run the audit — never the ability to get your own things out. That is a rule the code is tested against, not a promise.
Then the vault is gone, and we cannot help. There is no reset, no hint and no recovery, because the key never leaves your Mac and we never hold anything that could open it. That is the trade for there being no server. Write it down. You can still start a new vault without deleting the old one, and get your items out first if Touch ID was on. The steps are on the support page.
No. Today DribbleVault is one Mac, one vault. You can move an encrypted backup yourself. Sync would mean a server holding your data, and that is a different product with a different threat model — if it is ever built, it will be described honestly rather than added quietly.
The formats, the key hierarchy and the threat model are written down in full, and the primitives are verified against independent implementations rather than against themselves. What has not happened is an independent third-party audit, and until it has, that is stated here rather than glossed over.
No. It is a signed file with your name on it and no activation, no machine fingerprint and no call home. Reinstall as often as you like. It carries your name because that is what makes people not pass it around.
Not yet. macOS first, properly, then iOS.
Get DribbleVault for your Mac.
Free, complete, and not a trial. Apple silicon and Intel.