Your passwords.Not even we can read them.
Every password, card and key is encrypted on your device before it syncs to your phone and computer. Unlocking takes your master password and your Secret Key, and neither ever leaves your hands — our servers hold only ciphertext.
All you need is an email address.
- Zero-knowledge
Encryption and decryption happen only on your devices.
- Your password stays home
Sign-in proves you know it with SRP, without ever sending it.
- Secure Enclave
Touch ID and Face ID unlock is gated by a key held in hardware.
- Proven, open cryptography
XChaCha20-Poly1305, Argon2id, SRP-6a and X25519.
More than passwords.
Cards, API keys, server logins, passkeys and one-time codes — eight item types, each with its own fields and its own way of filling.
- Logins
- Credit cards
- Bank cards
- API keys
- Servers
- Secure notes
- Passkeys
- One-time codes
Fill, save and share without thinking about it.
From signing in to a website to sharing one Wi-Fi password with your family.
Autofill everywhere
Fill from the macOS password panel, right above the iPhone keyboard, and in Chrome or Edge. Suggestions only show up on the site they belong to.
Passkeys and one-time codes
Create and sign in with passkeys, and keep your two-factor secrets right next to the logins they protect.
Shared vaults
Set up a vault for your family or team. Its key is sealed to each member's public key, so the server only ever relays ciphertext.
Easy to move in, free to leave
Bring everything over from 1Password, Bitwarden or KeePass with a single file, and export whenever you like.
Sync without surprises
Every device syncs ciphertext only. When two devices edit the same item, nothing is silently overwritten. You decide which version wins.
You control every device
See every device that's signed in and revoke any of them. Changing your master password signs out every other session, and recovering your account sends you an email.
On our servers, your vault is just noise.
Every item is encrypted before it leaves your device, with keys derived from your master password and Secret Key. Even if our servers and every backup leaked, all anyone would get is bytes they can't open.
Let AI use your passwords without ever holding them.
When an app built with the MimiKey SDK needs a password, MimiKey shows you an approval card. Only after you tap Use this item is the result sealed and sent back, readable by that one authorization on that one device.
let item = try await mimikey.pickItem(
hint: .init(url: "https://bank.example.com"),
reason: "Sign in to Example Bank to reconcile this month's statement"
)
// You get the one item the user approved. Nothing else.
signIn(item.record.username, item.record.password)Questions, answered
Read the docsWhat if I forget my master password?
You can reset it with the Emergency Kit you saved at sign-up, which contains your Secret Key. If you lose both your master password and your Secret Key, your data can't be recovered, not even by us. That's the trade-off of zero-knowledge.
What is the Secret Key, and why do I need it?
It's a 128-bit random key generated on your device when you sign up. Together with your master password it derives your encryption keys. Someone who guesses your master password still can't open your vault without it, and stolen server data can't be brute-forced offline.
Can MimiKey employees see my passwords?
No. We store ciphertext, a login verifier and your devices' public keys. None of them can decrypt your items.
Can I switch from 1Password or Bitwarden?
Yes. MimiKey imports 1Password CSV and 1PUX, Bitwarden JSON and CSV, and KeePass XML and CSV. Trashed and archived items and passkeys are skipped and listed so you can check what didn't come over.
Should I store my most important accounts in MimiKey today?
Yes, as long as you keep your Emergency Kit. MimiKey has not yet had an independent security audit; until it has, we recommend not keeping critical accounts, like your bank or primary email, only in MimiKey.
Take your passwords back.
Sign up free and start using MimiKey on every device you own.