Vestyn

Your passwords, on your own server. End-to-end encrypted, Face ID protected, synced across devices — requires your own Vestyn server.

Vestyn is a self-hosted password manager — your vault lives on a server you control, not ours.

Every secret is encrypted on your device before it ever reaches the network. Your master password derives an encryption key locally; the server only ever stores ciphertext and the metadata needed to sync it. Nobody but you — not even your own server — can read your vault.

Vestyn for iOS requires a Vestyn server. Stand one up in minutes with Docker Compose (see vestyn.app), or connect to one a friend, family member, or admin already runs and invited you to.

FEATURES

• Face ID unlock, and Face ID–gated reveal for every password, card, and note • Passkeys — save and sign in with passkeys alongside regular logins • AutoFill — fill passwords and passkeys system-wide, in any app or browser • One-time codes — store TOTP secrets and see live 2FA codes inline • Password generator — strong passwords or memorable passphrases, with a live strength meter • Security checks — flags breached, reused, and weak passwords (breach checks use k-anonymity: only a partial hash ever leaves your device) • Shared vaults — invite family or a team; keys are wrapped per member, so sharing is cryptographic, not just a permission flag • Cross-vault search, trash and recovery, and full sync with the Vestyn Mac app, web vault, and browser extension

ARCHITECTURE

Every Vestyn client — iOS, macOS, web, and the browser extension — shares the same encryption core. Keys are derived with Argon2id and never leave your devices. The protocol and every client are open source, so you can inspect exactly what runs before you trust it with your passwords.

Vestyn is built for people who want a password manager without giving up control of where their data lives.