# 9Secure > 9Secure is an offline-first password manager built around user-owned encrypted vaults, native applications, and direct local-network device synchronization. 9Secure does not require an account, cloud vault, or subscription. Windows, macOS, iOS, and Android use the same Rust-based 9Core engine. Each vault is an independent portable encrypted container controlled by the user. ## Canonical pages - [Overview](https://9secure.io/): Product overview, features, security comparison, and platform information. - [Documentation](https://9secure.io/docs/): 9Secure guides and technical documentation. - [Setup Guide](https://9secure.io/docs/setup/): Keyring setup, creating or importing a first vault, platform access, and first local Sync. - [Items and Credentials](https://9secure.io/docs/items/): Built-in item types, Login extensions, passkeys, Authenticator, SSH keys, and desktop SSH commands. - [Vaultlight](https://9secure.io/docs/vaultlight/): Windows and macOS vault search and field delivery. - [Sync](https://9secure.io/docs/sync/): Local device pairing, trust, vault subscriptions, convergence, and deletion scope. - [Sentinel](https://9secure.io/docs/sentinel/): Local password intelligence and optional breach checking. - [Security Architecture](https://9secure.io/docs/security/): Vault architecture, key lifecycle, cryptography, Sync, history, recovery, and trust boundaries. - [Download](https://9secure.io/download/): Current platform availability and pricing. ## Product model - Vaults are independent portable encrypted files rather than records in a hosted account. - New vaults can start empty or import supported Login items from an existing browser or password manager. - A separate password-wrapped keyring holds random Vault Keys and managed relative paths. - 9Core owns canonical storage, encryption orchestration, key lifecycle, history, Authenticator code generation, Vaultlight search, Sentinel analysis, pairing, and deterministic synchronization. - Login items can store concealed passkeys and one concealed Authenticator setup value. Passkeys and Authenticator are Login extensions, not separate item types. - SSH Key items store a public key, concealed private key, concealed passphrase, notes, and synchronized commands. Windows and macOS can execute saved commands. - The encrypted operation log supports history inspection and limited core inverse operations. Current native Log interfaces are read-only and do not provide general undo or point-in-time restore. - Native platform applications provide the interface, lifecycle, clipboard, input delivery, networking, and file destinations while sharing the same core data model and security rules. ## Items and Login extensions The built-in item types are Login, Payment Card, Bank Account, Address, Identity / Passport, Software License, WiFi Network, Crypto Wallet, API Credential, SSH Key, Secure Note, File, and Custom. Custom fields can extend items. Authenticator and passkeys extend Login items and are not independent item types. ## Vaultlight Vaultlight is the desktop command palette for Windows and macOS. It searches unlocked vault indexes by item title, field label, and non-secret field value without decrypting concealed fields for search. Selecting an item arms up to ten field actions with `Control+1` through `Control+0`. Paste, Type Out, Copy Only, clipboard clearing, permissions, and session timeout behavior belong to the native app. SSH Key command actions execute the saved command instead of delivering its text. Vaultlight is not available on iOS or Android. ## Passkeys Passkeys are available through the native Windows, macOS, iOS, and Android credential-provider integrations where the operating system exposes the required API. A passkey is a versioned concealed credential attached to a Login. It is not a separate item type, visible generic custom field, or manually entered secret. Passkey creation starts from a supported website or app, then the user chooses an eligible Login in 9Secure. Windows system integration requires Windows 11 24H2 build 26100.6725, Windows 11 25H2 build 26200.6725, or later and must be registered and enabled under Settings > Accounts > Passkeys > Advanced options. Windows 10 does not expose the required provider API. Apple integration requires macOS 14 or iOS 17 or later and 9Secure enabled under Password AutoFill. Android integration requires Android 14 or later, a compatible credential-provider implementation, and 9Secure enabled in Android's passwords and passkeys settings. 9Core stores ES256 private key material and account metadata inside an independently stamped concealed Login field. Private key material does not enter searchable metadata, ordinary fields, or generic plaintext vault export. Passkeys synchronize with their Login. A successful authenticated Sync import marks received credentials backed up only after durable commit; failed or cancelled imports do not. External browser and password-manager passkey imports are not supported. ## Authenticator Authenticator is available in the native Windows, macOS, iOS, and Android apps. A Login can store one concealed Authenticator setup value as either a Base32 secret or an `otpauth://totp` URI. Manual Base32 values use SHA-1, six digits, and a 30-second period. TOTP URIs can specify SHA-1, SHA-256, or SHA-512, six or eight digits, and a period from 1 through 300 seconds. HOTP is not supported. 9Core validates the setup value and generates each current code locally on demand. The app displays the rotating code with its exact expiration countdown and allows it to be copied. Windows and macOS Vaultlight place the Authenticator action immediately after the canonical password field, refresh it at the period boundary, and deliver it through the configured Paste, Type Out, or Copy Only mode. The setup value remains in the item's independently authenticated concealed payload and synchronizes as part of the Login. It is not searchable. Code generation does not use the network, start a persistent core timer, write the vault, or add history. Generated codes are transient, but requesting or copying one moves plaintext into native app memory and possibly the clipboard. Correct codes require an accurate device clock. Keeping a password and its Authenticator secret in the same vault is convenient but reduces separation between authentication factors if the unlocked device or vault is compromised. ## SSH keys and commands SSH Key is a dedicated item type with Public Key, concealed Private Key, concealed Passphrase, and Notes fields. Labeled commands are synchronized ordinary text fields. Their titles and complete command text are searchable while the vault index is unlocked. 9Core stores and synchronizes SSH Key data but does not execute commands or integrate with SSH agents. The Windows and macOS hosts can add, edit, and run commands from the item view or Vaultlight. macOS executes the complete text through `zsh`; Windows executes it through `cmd.exe`. Execution starts in the user's home folder, captures limited combined output, and can supply the saved passphrase through a temporary SSH askpass helper. The stored private-key field is not automatically installed, written to `~/.ssh`, or loaded into an SSH agent. Mobile apps store and synchronize commands but do not execute them. Saved commands are arbitrary shell input, not an SSH-only grammar. They can invoke scripts, shell operators, and non-SSH programs with the user's permissions. Users must review and trust each command before running it. ## Sync 9Secure discovers nearby devices and pairs them with a displayed authentication number plus bilateral confirmation. Users manage complete-vault subscriptions per paired device. Complete vault contents travel inside the encrypted Sync session. Current product documentation covers direct local-network Sync only and does not claim cloud, hosted-relay, or remote internet Sync. Ongoing Sync sessions use ML-DSA transcript signatures, ML-KEM shared material, HKDF-derived directional XChaCha keys, HMAC key confirmation, authenticated headers, and exact sequence numbers. Current vault state reconciles stamped fields deterministically; equal-stamp unequal values fail as conflicts. History merges separately and is not authoritative for current state. A vault can be removed from one device without deleting it elsewhere, or explicitly deleted across synchronized devices after authenticated confirmation. ## Sentinel Sentinel presents Compromised, Weak, Reused, Old, and Insecure Websites findings. Old identifies an item containing a password whose item modification time is over one year old. Strength and reuse analysis run locally for fields with the canonical `password` key. Optional Have I Been Pwned checks send a padded five-character SHA-1 prefix, enforce a fixed 2 MiB response cap, and match suffixes locally. Network failure means online status is unknown or pending, not safe. Per-field status and check time are encrypted locally; Sync invalidates that cache. Derived findings are not a synchronized cache, and full-audit and schedule metadata are installation-local. ## Security architecture - Each vault has an independent random 32-byte Vault Key. The keyring password wraps a separate Keyring Full Key. - The Recovery Key encodes the Full Key and unlocks an existing keyring. It cannot recreate missing keyring or vault files. - Argon2id derives the keyring wrapping key. - HKDF-SHA256 separates metadata, attachment-stream, and commit keys. - XChaCha20-Poly1305 provides authenticated encryption. - HMAC-SHA256 authenticates canonical anchors and footers and confirms Sync session keys. - ML-KEM, FIPS 203, supplies post-quantum key establishment for pairing and Sync. - ML-DSA, FIPS 204, signs ongoing Sync session transcripts. Pairing binds combined device keys through the ML-KEM and displayed-number transcript plus bilateral proofs. - Canonical storage uses append-only generations, authenticated anchors, chained footers, and manifests. VACUUM builds and validates a replacement container. - Plain index values support search. Concealed values, including Authenticator setup secrets and passkey credentials, remain in per-item encrypted payloads and are decrypted only for explicit use. - Passkey private keys remain concealed, are excluded from ordinary item fields and generic plaintext vault export, and synchronize as part of their Login. - Authenticator codes are computed locally on demand from concealed TOTP setup values. Generated codes are transient and do not mutate vault state or history. - Secure byte containers zeroize keys and attempt best-effort Unix memory locking. Windows does not currently use VirtualLock. Decrypted indexes, logs, and native-app-requested plaintext are not guaranteed locked memory. - Archive Keyring writes an archive, confirms the active source still matches the prepared buffer, then deletes the active keyring. 9Core does not reopen or authenticate the destination. The native app attempts to remove saved device unlock after deletion. - 9Secure does not provide automatic backups, universal corruption recovery, cloud recovery, or general history restore. Losing every copy of a Vault Key is unrecoverable. - Source-available [Quantum Crypto](https://github.com/turboboosttech/quantum-crypto) supplies primary cryptographic primitives. This is not a claim of formal verification or a professional cryptographic audit. ## Export boundaries - Windows and macOS Export Vault create a plaintext Markdown bundle with plaintext attachments. - iOS Export Vault exports the encrypted `.9vault` bytes. - Export Plaintext Keys exposes every Vault Key and requires protected storage and careful removal. ## Platforms and pricing - Windows: free. - macOS: free. - iOS: $9.99 USD one-time purchase. - Android: $9.99 USD one-time purchase through Google Play. - 9SecureCLI: coming soon. Platform detection only highlights the likely download. It never starts a download automatically or hides other platforms. ## Contact and policies - [Contact](https://9secure.io/contact/): Email 9Secure or join the Discord community. - [End-User License Agreement](https://9secure.io/eula/): Current 9Secure EULA. - [Privacy Policy](https://9secure.io/privacy/): Current 9Secure privacy policy. The EULA and privacy policy pages above are the authoritative current versions.