Smart vault
Manage all accounts in one place. Every password is unique per site, long and complex — nothing to remember or write down.
Deterministic password manager · local-first
The password manager that does not store your passwords
Real security without the cloud. Same inputs, same password — every time.
Alcatraz is a deterministic, local-first credential manager. It does not store site passwords — only metadata (domain, username, version, length) — and regenerates the password on demand with a fixed, verifiable cryptographic algorithm.
Download links coming soon · license at zionyx.ch
What is Alcatraz
Same setup, same device or another: you always get the same password without syncing secrets to remote servers.
Zero stored passwords = zero passwords to steal.
What Alcatraz does
Windows Hello unlock
Fingerprint, face or Windows PIN. No master password every time (optional dedicated recovery).
Browser extension
On Chrome and Edge: credentials offered for the site you visit. Show, copy or fill with one click.
Full ecosystem
Windows, Android and browser. Portable .alcatraz backups across all platforms.
Secure backup
AES-256-GCM export with a dedicated passphrase. No cloud account, no sync subscription.
Always ready
Starts with Windows, lives in the system tray — vault ready without cluttering the taskbar.
Why Alcatraz
Traditional password managers store your passwords. Alcatraz does not.
Bitwarden, 1Password, LastPass and others keep a vault full of encrypted passwords. If that vault is breached — bug, leak or attack — your credentials are at risk. With Alcatraz, stealing the database exposes no passwords: only domains and usernames. Passwords exist only for a moment, in memory, when you generate them.
Deterministic, secure and manageable
Random generators do not scale for dozens of accounts. Alcatraz combines:
- Deterministic — same inputs, same password, always
- Secure — up to 64 characters, upper case, numbers, symbols
- Manageable — site list, version rotation, browser autofill
You do not need to remember passwords. You do not need to sync them. You do not need to trust a server.
Quick comparison
| Alcatraz | Typical cloud managers | |
|---|---|---|
| Passwords in vault | No — metadata only | Yes, all of them |
| Sync | .alcatraz file backup | Mandatory remote server |
| Offline | Always | Often limited |
| Windows Hello | Native | Separate app / PIN |
| Pricing | Perpetual license | Subscription |
| Attack surface | Your PC only | PC + server + mobile app |
Rotation without chaos
Need a new password for a site? Bump the version in the profile — Alcatraz generates a completely new string: same domain, same username, new password.
Layered security
Windows HelloDPAPISQLCipher AES-256
PBKDF2 210k iterAES-256-GCM backupNative AOTVolatile RAM
- Windows Hello — biometric gate before every access
- DPAPI — Master Key protected by the OS
- SQLCipher AES-256 — site database encrypted end-to-end
- PBKDF2 210,000 iterations — recovery password brute-force resistant
- AES-256-GCM backup — export with integrity authentication
- Native AOT code — sensitive crypto not easily decompilable
- Volatile RAM — Master Key wiped on lock, never written in plaintext to disk
Who is Alcatraz for
- You do not trust the cloud with your most important secrets
- You use Windows Hello and want to use it for real
- You already have Alcatraz Android and want desktop and browser parity
- You are tired of subscriptions for features that should be yours forever
- You want to understand how your password manager works, not a black box
- You manage dozens of accounts and need a system that scales
"We do not keep your passwords. We give you the key to recreate them, wherever you are, without ever handing them to anyone."
Ready to protect your credentials?
Alcatraz by Zionyx — deterministic security, local privacy, complete ecosystem.