Pangolin
A password keeper that curls up around your secrets.
Free and open source. No account, no server, no tracking.
Small, calm and yours
Stays at home
Your vault is a folder on your own computer. Pangolin goes online only when you press Check for updates.
Armoured twice
The whole database is encrypted, and every password is sealed again on its own.
Curls up by itself
Walk away and it locks. Copy a password and the clipboard is cleared a few seconds later.
One quiet window
Type to search, click to copy. No pop-ups and no save button: every change is stored at once.
Makes strong passwords
A built-in generator, with the length and kinds of characters you choose.
English and Turkish
Switch the language whenever you like, even before you unlock.
How your secrets are kept
- One master passwordIt is stretched with Argon2id, which makes every guess slow and memory-hungry. It is never stored.
- A key only you can unwrapThe password unwraps a random master key. Nothing else can.
- Two layers of armourSQLCipher encrypts the whole database; XChaCha20-Poly1305 seals each password and note.
- Forgotten on lockWhen Pangolin locks, the keys are wiped from memory.
Download
- The builds are not code-signed yet, so Windows SmartScreen and macOS Gatekeeper will warn the first time you open Pangolin.
- On macOS, if it refuses to open: System Settings → Privacy & Security → Open Anyway.
- The Linux .tar.gz contains install.sh, which adds Pangolin to your application menu without root.
- Each release lists SHA-256 checksums. All releases and checksums
Two honest things
There is no password recovery. If you forget the master password, nobody can open the vault, including us.
Pangolin is new. It uses standard, well-reviewed cryptography, but it has not had an independent security audit yet. Keep a backup of anything you cannot afford to lose.