SokuPass is a local-first password and secret manager for developers — browse everything like a filesystem, copy with a keystroke, and generate TOTP codes inline. No cloud, no sync, no telemetry.
Your vault is encrypted on this Mac and never leaves it. No servers, no accounts, no sync, no telemetry — the app's only network call is Apple's purchase check.
An Emacs/Helm-style navigator: C-x C-f to find, RET to copy, C-j to reveal. If you live in the terminal, it's already in your fingers.
Generate 2FA codes alongside your passwords — scan a QR straight off the screen, watch the 30-second ring, and RET copies the live code. Replace your authenticator app.
No magic, no proprietary black box. SokuPass uses well-understood, open primitives, and keeps everything on disk under your control.
The vault is sealed with ChaCha20-Poly1305 (CryptoKit). Authenticated encryption means tampering is detected, not just hidden.
PBKDF2-HMAC-SHA256 at 600,000 iterations, with a fresh salt on every save. Brute-forcing your master password is deliberately expensive.
vault.enc is 0600, its directory 0700. A one-generation vault.enc.bak snapshot enables safe rollback on every save.
Biometric unlock via Keychain with a biometryCurrentSet ACL — enrolling a new fingerprint invalidates the stored key. Master password still required after restart.
There is no analytics, no crash reporting, no phone-home. The only network traffic is Apple's StoreKit for the purchase itself.
// Derive key — 600k iterations, per-save salt let key = pbkdf2( password: master, salt: SecRandom.bytes(16), rounds: 600_000, hash: .sha256 ) // Seal vault with AEAD (ChaChaPoly) let box = try ChaChaPoly.seal( plaintext, using: key ) try box.combined.write( to: vaultURL, // 0600 options: .completeFileProtection ) // Network calls: none. Ever.
Download free, get every Pro feature for two weeks, then buy once. After the trial your data is never locked — Pro features simply pause and the vault stays fully readable.
| Feature | Free | Trial | Pro |
|---|---|---|---|
| Core vault | |||
| Local encrypted vault & unlimited secrets | ✓ | ✓ | ✓ |
| Keyboard navigator, tabs & global search | ✓ | ✓ | ✓ |
| Touch ID, auto-lock & password generator | ✓ | ✓ | ✓ |
| TOTP generation & QR scan | ✓ | ✓ | ✓ |
| Pro | |||
| Create & edit beyond the free limit | read-only | ✓ | ✓ |
| Import — .env · CSV · Bitwarden JSON | — | ✓ | ✓ |
| Encrypted backup & restore (.vaultbak) | — | ✓ | ✓ |
| Future Pro feature updates | — | — | ✓ |
| Use on all Macs with your Apple ID | ✓ | ✓ | ✓ |
No subscription. One purchase unlocks Pro on every Mac signed into your Apple ID.
Final price is set on the Mac App Store · confirm the Pro price before launch
Bring it all in. Imports land in a new top-level folder — nothing you already have is overwritten, and name collisions auto-rename to Name (1).
Paste or open a .env; each KEY=VALUE becomes a masked secret, with quotes and escapes handled.
Map name / value / folder / kind from your headers, adjust in the UI, and import the lot.
Unencrypted exports import logins, notes, cards, identities and custom fields — folder structure preserved.
A taste of the F1 reference — the whole app is reachable from the home row.
Your vault lives at ~/Library/Application Support/ on your Mac and nowhere else. We can't read it, lose it, or leak it — because we never have it.
No. SokuPass has no servers and makes no network calls except Apple's StoreKit for the purchase. Your vault is encrypted on your Mac and never transmitted.
Yes — one Pro purchase covers every Mac signed into your Apple ID. There's no automatic sync (by design); move data between Macs with an encrypted .vaultbak backup.
It can't be recovered — there's no reset server, which is exactly what keeps the vault private. Keep an encrypted backup, and consider a backup master-password reminder somewhere safe.
Nothing is locked away. Pro-only features (import, backup, unlimited editing) pause, and your vault stays fully readable. Buy Pro anytime to re-enable them.
SokuPass Pro is a standard one-time in-app purchase; Apple's Family Sharing rules for non-consumable purchases apply. Confirm Family Sharing is enabled for the IAP in App Store Connect.
Yes. SokuPass implements RFC 6238 TOTP (SHA1/256/512), accepts otpauth:// URIs or Base32 secrets, scans QR codes off-screen, and copies the live code with RET.
Local-first, keyboard-driven secrets for your Mac. Try every feature free for 14 days.
Download on theMac App Store