Store the keys your agent should not see.
Encrypt API keys before upload, then retrieve them inside trusted software, outside your agent’s reach. The browser vault uses one password. Start free with an account and 25 items.
Your vault, in the dashboard.
Store and retrieve secrets from your dashboard. Code libraries (SDKs), the command-line tool (CLI) and agent tools (MCP) can access the same store. Encrypt data before uploading from your own code.
Vault client : in your browser
Type a secret, set one password, store it. Fetch it back the same way. Everything is locked on your device before it reaches the server, so we only ever hold the scrambled version. The same place you'd come to read an API key or recovery code back when you need it. Free with any account.
Open the browser client →Vault inventory : in your dashboard
Lists every item you've stored, however you stored it: browser client, SDK, CLI, MCP server. Relabel, recategorise, delete, add, or fetch secrets from the dashboard tabs. Metadata only, the server never decrypts your ciphertext.
Open the inventory →Don't have an account yet? Get a free API key (no card required).
How it works.
You type your secret
API key, password, credential, anything. It stays in your browser.
Encrypted locally
Your password is turned into a key on your device using Argon2id, a deliberately slow method built to resist guessing. That key locks the data with AES-256-GCM, an encryption method that also detects changes. All in your browser, nothing sent in the clear.
Only the locked version is stored
The server stores encrypted content plus item labels and other metadata. Keep sensitive information out of labels. It does not receive the browser vault password.
The bit people ask about.
One password, that's it?
Yes. The browser vault encrypts with one strong password. Keep it safe: it cannot be reset to recover your content. (The two-password setup belongs to our encrypt tool, which creates a real message and a chosen fake. The vault does not create a decoy.)
What if I forget it?
There is no reset, no security question, no support route in. We never hold your password or your key, so we genuinely cannot recover it for you. That is the trade for us never being able to read your vault either.
Can deny.sh see what I store?
The browser client encrypts your content before upload. We can see account information and item metadata, such as labels, but do not receive the password needed to decrypt that content.
What you get.
Categories and search
Organise by type: API keys, passwords, recovery codes, notes. Search your saved item labels and categories.
Edit in place
Update a secret without deleting and re-creating. Re-encrypts client-side on every save.
Export everything
One-click encrypted export of your entire vault. Your data is yours. Take it anywhere.
Auto-lock
The vault locks after 5 minutes of inactivity and clears displayed secrets. Clipboard clearing is attempted after 30 seconds; browsers and clipboard history can retain copies.
API access
Use the online vault API from your own software for storage and retrieval, backups and deployment workflows.
Audit trail
Every store, retrieve, update, and delete is logged with timestamp and IP. Available on paid plans.
Pricing.
Vault storage is included with every deny.sh plan.
Team
- 10,000 vault items
- Everything in Free
- Edit in place
- Audit trail
- API access
- Email support
Enterprise
- Limits by contract
- Everything in Team
- Contract-defined support
- Customer-managed keys
Need contract-defined service terms or compliance documentation? Talk to us.
Keep a separate backup and protect your password.
Encrypt before you upload.
Open vault client