New: Otter Teams, free for 21 days

Save the key
you see once.

"This key will only be shown once." Close the tab and it's gone. Otter notices the moment a console reveals a new key, offers to keep it, and locks it in a vault that only your passphrase opens.

Add to Chrome, free

Personal is free forever. No account, and your vault never leaves your device. Teams is the paid add-on, for sharing keys.

How it works

Three small moments.

Otter only steps in when a secret appears, and never saves anything you didn't say yes to.

  1. A console shows a new API key once; Otter's prompt asks whether to keep it.
    01

    It notices

    A console shows a new key once. Otter spots it and offers to keep it.

  2. Otter's prompt after saving: Safe and sound, saved only for this site.
    02

    You say yes

    One click encrypts it with your passphrase, label and site included.

  3. On the same site's sign-in page, Otter offers to fill the saved secret.
    03

    It fills, carefully

    Only on the exact site it came from. Lookalike domains get nothing.

Security

Built like a safe, tested like one.

Your passphrase never leaves your device, and nobody, including us, can recover it. That's the point.

AES-256-GCM

Every record is encrypted, metadata included, with a fresh nonce each time.

PBKDF2 · 600,000

Rounds of SHA-256 between your passphrase and the key that opens the vault.

exact-origin fill

Same protocol, host and port, or no fill at all. Lookalike domains get nothing.

no server

The personal vault makes no network requests. No account, no analytics.

clickjacking-proof

The save and fill prompt only answers a real click on a prompt you can actually see.

137 tests

Plus seeded fuzzing, cryptographic known-answer checks and a weekly lab across 12 real provider consoles.

Not independently audited: the code is public so anyone can review it. How Teams protects your keys · Read the code. Found something? Report it.

Otter Teams Live now

Know where every key lives, and what to rotate when someone leaves.

For teams of up to ten developers. Every shared key records where it's deployed, so offboarding is a checklist, not an afternoon of guessing. Keys are encrypted on your devices before they're shared: our server stores them but can never read them.

  • The key map. Each key knows its project, environment and every place it's deployed: the Vercel variable, the GitHub Actions secret, the .env file.
  • Offboarding in minutes. Remove someone and Otter re-keys the team, then hands you a checklist of exactly what they could read and where each key is deployed, production first.
  • Who used what. Copies, fills and edits land in a signed log the server can't quietly rewrite.
  • Yours to take with you. Owners and admins can export every key at any time. How Teams protects your keys.
Try Teams free for 21 days

Install Otter, open it and choose Teams. No card needed for the trial.

Pricing

Free for you. Simple for teams.

Personal

Free

  • Catches keys and passwords
  • Encrypted vault on your device
  • Exact-site fill, safe copy
  • No account needed
Add to Chrome

Teams Live now

Early-bird price

$29$20/month

For teams that subscribe by November 13, for as long as they stay subscribed. Flat for up to 10 people, free for 21 days, paid by whoever creates the team. Regular price $29/month.

  • Key map: where every key is deployed
  • Offboarding: re-key and a rotation checklist
  • End-to-end encrypted, with a signed activity log
  • Export everything, any time
Start the free trial

Questions

Fair questions.

Does Otter read the pages I visit?

It looks at pages on your device to spot password fields and keys that have just been revealed. Nothing about a page is stored or sent anywhere. The only thing ever saved is a credential you click to keep.

What if I forget my passphrase?

Then the vault can't be opened, by you or anyone else. The passphrase is never stored or sent, so there's no copy to recover from. That's what makes the encryption mean something.

Can a fake site trick Otter into filling my key?

No. A key is filled only on the exact origin it was saved on: same protocol, host and port. A lookalike domain, a subdomain or plain http gets nothing, and the prompt only reacts to a real click on a prompt you can see.

How do I start a team?

Install Otter from the Chrome Web Store, open it and choose Teams. Sign in with Google, name your team and invite people by email. The first 21 days are free, and nothing is charged unless the team's owner subscribes.

If I use Teams, can you read our keys?

No. Shared keys and everything about them are encrypted on members' devices with a team key the server never receives. The server sees who is on a team and when a key was used, but never what it is. The privacy policy lists exactly what it stores.

Is there a Mac app?

A menu bar app is on its way, with the same vault format and an otter that can follow your pointer. Email me and I'll tell you the day it lands.

Who makes this?

Otter Vault is built by one person, Krishna Ganga. Every support email reaches me directly.

Keep the next key you make.

Add to Chrome, free