New Password manager, made in Australia

Every password, locked on your phone before it goes anywhere.

BinaryIT Safe keeps your logins, cards and notes end-to-end encrypted, fills them into apps and browsers, and tells you when a password has leaked. We keep only what we can't read.

Get it onGoogle Play How it's secured

Free during early access · Android 10 and later

  • End-to-end encrypted
  • We can't read your vault
  • Stored in Sydney
  • No ads. No tracking.
Features

Everything a password manager should do. Nothing it shouldn't.

Fast where you need it, strict where it matters: your passwords are only ever unlocked on your phone.

Autofill in apps and browsers

Pick a login from the keyboard or the form and it fills in. Logins are matched to the app's signing certificate or the site's domain, never a lookalike.

Strong passwords on sign-up

Creating an account? Tap "Generate strong password" and both password fields are filled with a strong, unique one.

Saves as you sign in

BinaryIT Safe offers to save each new login, even while it's locked. It joins your vault the next time you unlock.

Data breach alerts

Every password is checked against known breaches, and you're told when a site you use is breached after you set your password.

Passwords and passphrases

Random passwords up to 64 characters, or passphrases that are easy to type and hard to guess, with a strength meter.

Cards, notes and identities

Payment cards, secure notes and identity details live in the same encrypted vault as your logins.

One-time codes

Keep two-factor codes with the login they belong to, and copy them with a tap.

Fingerprint or face unlock

Open your vault with a touch. It locks again as soon as you leave the app, and copied passwords clear from the clipboard.

Every device accounted for

See each phone signed in to your account. Remove a lost one and it can't sync or sign in again.

A sign-up form with BinaryIT Safe offering Generate strong password above the keyboard
Sign up

A strong password, every time you sign up.

No more reusing the same password because it's easier. BinaryIT Safe spots a sign-up form and offers a new one right where you're typing.

  • One tap fills the password and its confirmation.
  • Works before you unlock: a new password isn't a secret yet, so there's nothing to open.
  • Saved straight after, when Android asks "Save to BinaryIT Safe?".
Breach monitoring showing one password found in data breaches
Breach monitoring

Know the moment a password has leaked.

Attackers try leaked passwords first. BinaryIT Safe checks yours against more than a billion of them, and against the list of breached sites.

  • Your passwords never leave your phone. Only the first five characters of a one-way hash are sent; the match is made on the phone.
  • Breached sites are matched on your phone, from the public list of breaches.
  • Check your email addresses to see which breaches they're in and what was exposed. Sent only when you ask.
Android asking Save username and password to BinaryIT Safe
Autofill

Your passwords follow you into every app.

Set BinaryIT Safe as your phone's password manager and it's there whenever you sign in or sign up, in apps and in your browser.

  • Saves without getting in the way: no need to open BinaryIT Safe first.
  • Asks before it overwrites. A changed password waits for you to choose Update or Keep.
  • Refuses lookalikes. An app has to prove it belongs to a website before that website's logins are offered in it.
Security

Built so that we can't read your vault.

Everything is encrypted on your phone, with keys made from two secrets only you hold. What reaches our servers is ciphertext.

Two secrets, not one

Your keys need your passphrase and a 128-bit Secret Key that stays on your devices and your recovery kit. A stolen copy of our database is useless without both.

Sign-in without sending your password

BinaryIT Safe signs in with OPAQUE, so the server never receives your passphrase or anything it could crack, not even when you log in.

Hard to guess, by design

Argon2id makes every passphrase guess cost memory and time, so trying millions of them isn't practical.

Whole-item encryption

Each item is one sealed envelope, bound to its vault, version and purpose. Nothing can be moved between items or swapped for an older copy unnoticed.

Tamper-evident devices

Every device on your account is added to a signed, hash-chained log. A device the server slips in, or one you removed, is refused by your phones.

Rollback detection

Your phone pins the latest state of your vault. A server that hides an item, brings back a deleted one or serves an old copy is caught.

Plain answers

What we can and can't see.

A password manager asks for a lot of trust. Here's exactly what's on our side.

We can't see

  • Your passphrase or Secret Key, not even at sign-in
  • Anything in your vault: titles, usernames, passwords, websites, card numbers, notes
  • Which sites and apps you have logins for
  • Your passwords during breach checks: only five characters of a hash are sent

We do hold

  • A random account ID. No name or email is needed to sign up
  • Your encrypted vault, and roughly how big it is
  • Your devices' IDs and public keys
  • Security events, such as sign-ins and device changes, with their times
  • An email address you check for breaches, only while checking it. It isn't stored
Get started

Set up in two minutes.

  1. Install BinaryIT Safe

    From Google Play, on any phone with Android 10 or later.

  2. Choose a passphrase

    Then save your recovery kit with its Secret Key. You'll need both on a new phone, and we can't reset them.

  3. Turn on autofill

    Make BinaryIT Safe your phone's password manager, and it starts saving logins as you sign in.

FAQ

Questions, answered.

What happens if I forget my passphrase?

We can't reset it, and nobody else can either: that's what keeps your vault private. Choose one you'll remember (the app can suggest one), and keep your recovery kit somewhere safe.

What is the Secret Key?

A random 128-bit key made on your phone when you create your vault. It's combined with your passphrase to make your encryption keys, so even a weak passphrase can't be guessed from a stolen copy of our database. It's on your recovery kit; you'll need it to set up a new phone.

Why does filling a login need an unlock, but saving one doesn't?

Saving only puts something new into your vault, so it can wait safely on your phone until you next unlock. Filling takes a password out of your vault, and that only happens after you've unlocked it, with your passphrase or fingerprint.

Where is my data stored?

Your encrypted vault is stored in Sydney, Australia. It's also kept, encrypted, on your phone.

Is it free?

Yes. BinaryIT Safe is free during early access, with no ads and no tracking.

Is there an iPhone app?

Not yet. BinaryIT Safe is on Android first; iPhone is planned.

Can I import from another password manager?

Not yet. For now, BinaryIT Safe offers to save each login as you sign in, so your vault fills up as you go.

Has the security been reviewed?

The design follows current research on attacks against password managers, and our own test suite runs those attacks against the app. An independent review of the cryptography is planned.

Your passwords, locked on your phone.

Free during early access. No ads, no tracking, and nothing we can read.

Get it onGoogle Play