Bramble — Fly The Nimbus

Bramble is a password manager that lives in your browser and keeps your secrets on your own machine. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it.

Works in Firefox, LibreWolf, Waterfox, Zen and other Firefox browsers. Install it and you're running in about a minute.

WHAT IT DOES

Your passwords are encrypted on your device and stored in the browser's own extension storage, on your machine. There's no account and no server holding your vault. Set up once and you're autofilling logins, saving new ones, and generating passwords right away.

Got more than one device? Pair them and Bramble keeps your vault in sync across them over an end-to-end encrypted channel. The relay that introduces your devices only ever sees ciphertext and stores nothing, so your secrets never land on anyone's server.

FEATURES

• Local-first, always. Your encrypted vault stays on your device, in the browser's storage. No account, no server copy.
• Multi-device sync. Your devices stay in sync over an end-to-end encrypted channel; the relay that connects them only ever sees ciphertext and stores nothing.
• Serious crypto. Argon2id for your key, AES-256-GCM for data, envelope encryption so every entry has its own key. Secrets wiped from memory after use.
• Everything encrypted. Site names, usernames, notes, all of it.
• Domain-smart autofill. www.example.com, ca.accounts.example.com, and example.com all match one login. One entry, several URLs.
• More than logins. Logins, payment cards, secure notes, and SSH keys, each with their own fields.
• Built-in password generator.
• Recovery codes. Every vault gets a secure recovery code at setup: a printable backup that unlocks it independently of your master password.
• TOTP / 2FA codes. Paste an otpauth:// URI or secret and Bramble generates the codes.
• Optional breach checking. Have I Been Pwned lookup using k-anonymity, so nothing about your password leaves your machine. Off by default.
• Auto-lock after 15 minutes idle (configurable).
• Import from KeePass, Bitwarden, Proton Pass and 1Password.

WHY LOCAL-FIRST

Cloud managers keep everyone's vaults on their servers, which is one giant target. When one is breached, it isn't one vault that leaks but millions at once, often disclosed months later.

Bramble flips that around:
- No server to breach. Your vault never leaves your control.
- No account, no subscription, no telemetry. Nothing to sign up for.
- Your devices, your data. Sync it across your own devices, or keep it on one machine, offline. Nothing is ever parked on someone else's server.
- Nothing to trust but the code. The code is open source and runs entirely on your device.

HOW THE ENCRYPTION WORKS

Bramble uses LUKS-style key slots and envelope encryption. One random Vault Key protects your data. Each unlock method (master password, recovery code) derives its own Key-Encryption Key that unwraps a copy of that same Vault Key, so adding or revoking an unlock method never re-encrypts a single entry. The Vault Key then unwraps a fresh per-entry key for every item. Everything is AES-256-GCM.

COMING FROM KEEPASS?

You'll feel at home: your encrypted vault, your control, no cloud middleman, and Bramble imports your KDBX4 files. The differences: it lives in your browser (no separate desktop app or plugin bridge), autofill is built in with domain matching and an on-page dropdown, and it ships one modern build with Argon2id and AES-256-GCM rather than a sprawl of plugins. Clean UI, dark mode included.