Free
$0forever
Under 10 sites
- One vault, one device
- Rhythm 2FA, Rhythm Light, Phantom Keys
- Recovery Kit and Backup Codes
- Browser extension
Pricing · Billing ships at M4
Priced by how many sites you protect. Nothing else.
Every tier is zero-knowledge, open source and self-hostable. The rhythm factor is never paywalled.
Starter
$2.99/ month
Under 100 sites
- Everything in Free
- Sync across all your devices
- Encrypted offline cache
- "Not your rhythm" email alerts
Pro
Most room$4.99/ month
Unlimited sites
- Everything in Starter
- Breach check (HIBP k-anonymity)
- Emergency access for a trusted contact
- Per-device rhythm profiles, Precision Mode
- CLI unlock
Enterprise
Talk/ to sales
Groups, business, SDK
- Shared collections and admin console
- Audit log export, SSO roadmap
- Self-host support and SLAs
- @cypherkey/sdk with Progressive Enrollment
Every tier
Zero-knowledge vault
The server stores ciphertext and an Argon2id hash. It cannot read an entry, and neither can we.
Rhythm second factor
Never a paid upgrade. A password manager whose second factor is behind a paywall is a password manager with one factor.
A way back in
A printable Recovery Kit and one-time Backup Codes, on every tier, replaceable at any time.
Open source
MIT client, AGPL server. Self-host the whole thing with
docker compose up and pay nothing.
Groups · Business · Enterprise
Shared collections, admin console, audit export, and the SDK for your own login form.
Progressive Enrollment lets an application build a rhythm profile from the logins its users are already performing, with no enrolment step of its own. It ships with M5.
sales@cypherkey.io
Tell us seat count and whether you self-host.