Your passwords and 2FA codes. Readable only by you.

MGVault is a zero-knowledge password manager that keeps your passwords, two-factor authentication (2FA/TOTP) codes and secure notes in one vault. Your data is encrypted before it leaves your device. It works in the browser and through a browser extension, lets teams use shared vaults, and is hosted in Türkiye. Personal use is free.

No. Your items are encrypted with keys derived from your master password on your device, and neither your master password nor your decryption keys are ever sent to our servers. So neither our staff nor anyone with access to our servers can read your passwords, item titles, notes or 2FA secrets. To run the service we only see your email address and metadata such as when encrypted items changed.

An attacker would obtain only encrypted data. Vault contents are encrypted with XChaCha20-Poly1305, and the key that opens them is derived with Argon2id from your master password, which is not on our servers. The only path left is guessing your master password offline; Argon2id makes every guess deliberately expensive, but a short or reused password is still a risk. In the event of a personal data breach we notify the Turkish Personal Data Protection Authority and affected users, as KVKK requires.

With the recovery code in your Emergency Kit. Because we do not know your master password, we cannot reset it; the 56-character recovery code you receive at sign-up lets you set a new master password and keep access to your vault. After recovery all sessions are signed out, two-step login is reset and a new recovery code is generated. If you lose both your master password and your Emergency Kit, no one, including us, can recover your data.

Create an organization, open a shared vault and give members view, edit or manage permission. Each shared vault has its own key, encrypted separately to every member’s public key (X25519) and signed with Ed25519 by the person who shared it. New members are verified with key fingerprints. When a member is removed, the vault key is rotated and the passwords that person could access are listed for you to change.

Yes. Our servers and encrypted backups are in four data centers in Türkiye: Datacasa, Mars Datacenter, Equinix and PenDC. Your encrypted vault, account data and logs are kept in Türkiye and processed in line with Turkish Personal Data Protection Law No. 6698 (KVKK). Supporting services such as email delivery process only the minimum data required; details are in our KVKK Privacy Notice.

For most accounts, yes, and it is far more convenient, but it should be a conscious choice. 2FA secrets are end-to-end encrypted in MGVault and codes are generated only on your device. On the other hand, keeping a password and its 2FA secret in the same vault ties both factors to the security of one vault. We therefore recommend protecting your vault with a strong master password plus a passkey or authenticator app, and considering a separate hardware key for your most critical accounts, such as email and banking.

With the import tool, in a few minutes. We support export files from Bitwarden (JSON or CSV), 1Password (CSV) and LastPass (CSV), Google Authenticator export QR codes and otpauth:// links. The file is processed in your browser and every item is encrypted before it is uploaded. Delete the unencrypted export file when the import is done.

The web vault works in all current desktop and mobile browsers. The browser extension supports Firefox and Firefox-based browsers (Zen, LibreWolf and others) and Chromium-based browsers such as Chrome, Edge and Brave; current install options are on the Extension page. A Safari extension is in preparation. On phones and tablets you use the web vault; there is no separate mobile app yet.

The personal vault is free with no item limit, including passwords, 2FA codes, the browser extension and import. A free organization supports up to 3 users, 1 shared vault and 50 shared items, with 7 days of audit log retention. For larger teams, the Team plan removes these limits and keeps the audit log for 365 days.

You can delete your account at any time in Settings. Your account and personal vault are permanently deleted and you are removed from your organizations; items in shared vaults stay with the organization. Copies in encrypted backups expire automatically at the end of the 14-day backup retention period. There is no export tool for the personal vault yet, so copy anything you want to keep before deleting.

MGVault is closed source. Instead, we publish our cryptographic design, parameters and known limitations on our Security page, and we test our crypto code against standard test vectors (RFC 9106, RFC 7748, RFC 8032 and others) and an independent reimplementation. You can report vulnerabilities to the address in /.well-known/security.txt. An independent third-party security audit is planned and will be announced on the Security page when complete.