hHush
h
Password manager · for developers

Your servers,
logins and secrets.
One vault.

Hush keeps passwords, server access and app secrets in one zero-knowledge vault, with apps for the web and Android and a CLI for your terminal.

Private beta in preparation · not open for sign-ups

Everything is encrypted on your device before it leaves it, with a key made from your master password. The server stores locked boxes it has no key for.

What's different

Built for the people who look after servers

Servers are items

Host, users, database passwords and the commands to get in, with {{placeholders}} filled from the item. Copy a section as .env or JSON. Paste your existing JSON to import many servers at once.

Secrets in your terminal

hush run -- npm start puts secrets into a command's environment from a .hush.env file of references. Nothing is written to disk in plain text.

See what leaves the device

The sign-in log shows each step and exactly what is sent. Every item has a "server view" of the ciphertext the server holds.

Break-glass recovery

hush recover opens an encrypted backup offline, with no server, Docker or network, if the server is ever gone.

Already built

Everyday password manager, too

  • Logins with 2FA codes, cards, identities, notes in Markdown, API keys and SSH keys.
  • Android app with fingerprint unlock, autofill, a read-only offline copy and 2FA QR scanning.
  • Password health: weak, reused and old passwords, across every secret field.
  • Recovery key and two-step sign-in for the account.
  • Import from Chrome, Bitwarden and 1Password; encrypted export.

How Hush works explains the keys, what the server's database holds, and the limits.

Honest status

Not ready for you yet

Hush runs today for its developer only. Before anyone else can sign up it needs dedicated hosting, an external security audit, a published privacy policy and the source code made public.

Not audited. Hush is built on libsodium with nothing hand-rolled, and reviewed in-house, but no outside security audit has been done yet.

Found a security problem? See how to report it.