# 9Secure

> 9Secure is an offline-first password manager built around user-owned encrypted vaults, native applications, and direct device-to-device synchronization.

9Secure does not require an account, cloud vault, or subscription. Windows, macOS, and iOS use the same Rust-based 9Core engine. Each vault is an independent portable encrypted container controlled by the user.

## Canonical pages

- [Overview](https://9secure.io/): Product overview, features, security comparison, and platform information.
- [Documentation](https://9secure.io/docs/): 9Secure guides and technical documentation.
- [Setup Guide](https://9secure.io/docs/setup/): Installation and initial configuration.
- [Vaultlight](https://9secure.io/docs/vaultlight/): Fast vault search and field delivery.
- [Sync](https://9secure.io/docs/sync/): Device pairing and selective vault synchronization.
- [Sentinel](https://9secure.io/docs/sentinel/): Password intelligence and breach checking.
- [Security Architecture](https://9secure.io/docs/security/): Vault architecture, key lifecycle, history, and recovery.
- [Download](https://9secure.io/download/): Current platform availability and pricing.

## Product model

- Vaults are independent, portable encrypted files rather than records in a hosted account.
- 9Core owns vault storage, encryption orchestration, key lifecycle, history, Vaultlight, Sentinel, pairing, and deterministic synchronization.
- The encrypted operation log supports password history, undo, restore, and best-effort history synchronization.
- Native platform applications provide the interface while sharing the same core data model and security rules.

## Vaultlight

Vaultlight is the desktop command palette for Windows and macOS. It searches every unlocked vault by item title, item type, field label, and non-secret field value without decrypting concealed fields. Selecting an item enables field delivery with `Ctrl+1` through `Ctrl+0`; only the selected item payload and requested field are decrypted.

## Sync

9Secure pairs trusted devices with a six-digit Short Authentication String. Users manage which complete vaults sync to each device. Local discovery uses mDNS; 9Core sync runs over a host-provided byte stream. A future update will add hosted-relay connectivity; the relay will route ciphertext outside the end-to-end trust boundary. Sync is transport-agnostic, mutually authenticated, end-to-end encrypted, and reconciles field-stamped state deterministically. A vault can be removed from one device without deleting it elsewhere, or explicitly deleted across synchronized devices.

## Sentinel

Sentinel identifies weak, predictable, reused, old, and compromised passwords, plus insecure HTTP websites. Strength analysis uses local zxcvbn entropy and pattern estimation. Have I Been Pwned checks use the Pwned Passwords k-anonymity range API: Sentinel sends a padded five-character SHA-1 prefix and matches returned suffixes locally. Audit results are cached inside the encrypted vault index.

## Security architecture

- Rust-based 9Core shared by every native application.
- Argon2id password-based key derivation.
- HKDF-SHA256 key derivation.
- XChaCha20-Poly1305 authenticated encryption.
- HMAC-SHA256 authentication.
- ML-KEM, FIPS 203, post-quantum key establishment.
- ML-DSA, FIPS 204, post-quantum signatures and mutual device authentication.
- Cryptographically secure random generation.
- Authenticated append-only vault commits with damage isolation and canonical rebuilding.
- Searchable-index-only unlocking; item secrets are decrypted on demand and transient values are wiped after use.
- Source-available [Quantum Crypto](https://github.com/turboboosttech/quantum-crypto) cryptographic implementation.

## Platforms and pricing

- Windows: free.
- macOS: free.
- iOS: $9.99 USD one-time purchase.
- Android: coming soon.
- 9SecureCLI: coming soon.

Platform detection only highlights the likely download. It never starts a download automatically or hides other platforms.

## Policies

- [End-User License Agreement](https://9secure.io/eula/): Current 9Secure EULA.
- [Privacy Policy](https://9secure.io/privacy/): Current 9Secure privacy policy.

The policy pages above are the authoritative current versions.