Local-first password manager for Windows
No cloud. No internet required. Just your data, securely offline.
Sailock is a local-first password manager built for Windows. Your vault lives only on your device: no account, no cloud storage, and no internet connection needed to use it.
Built with Rust and Tauri, Sailock is lightweight (the installer is about 4–5 MB) and fast.
- Local-first: all data stays on your device. No cloud, no account.
- Organized Vault: folders and subfolders, favorites, trash, search, and list or gallery views.
- Entry templates: Password, Identity, Card, Note, Wi-Fi and Custom entries with typed fields.
- Built-in 2FA codes: store a TOTP secret in an entry and see its verification code.
- Password generator: passwords, passphrases, random usernames and recovery codes.
- Two-factor unlock: protect Sailock itself with an authenticator app, with single-use recovery codes.
- Re-authentication: the master password is required to reveal or copy a password, open the Trash, delete permanently, export, or clear the Audit Log.
- Audit Log: a record of important activity inside the app.
- Encrypted backups: export and import your vault as a
.slockfile protected by its own password. - Auto-lock: lock after inactivity or when the window is minimized.
- Accessibility: high contrast mode, adjustable text size and reduced motion.
- Light, dark and system themes.
- 12 languages: English, Spanish, German, French, Italian, Japanese, Korean, Dutch, Polish, Portuguese, Russian and Chinese.
- The vault is encrypted with AES-256-GCM. The key is derived from your master password with Argon2 and a random salt, and it exists only in memory while the vault is unlocked.
- Your master password is never stored. If you forget it, your data cannot be recovered.
- 2FA recovery codes are stored only as SHA-256 hashes and are shown once.
- Sensitive actions are verified by the Rust core, not only by the interface.
- Sailock has no analytics or telemetry. Its web view blocks external connections, and the only network request the app makes is the optional update check described below.
- Sailock has not been independently audited yet. The code is public so you can read it.
- Open the Releases page.
- Download
Sailock_<version>_x64-setup.exe(recommended) or the.msi. Thelatest.jsonfile is used by the in-app updater and is not needed for a manual install. - Run it. Windows may show a SmartScreen warning because the installer is not yet signed with a Windows code-signing certificate. Click More info → Run anyway.
If you installed Sailock with the .msi, keep using the .msi for new versions, so you don't end up with two installations. Your vault is kept when you update.
Every file on the release page shows its SHA-256 checksum, so you can verify your download.
- Sailock checks GitHub Releases for a newer version when it starts. This can be turned off in Settings → System, and you can always use Check for updates manually.
- The check only downloads a small public file (
latest.json). No data from your vault is ever sent. - Sailock always asks before installing, and every update is verified with a cryptographic signature before it is installed.
- OS: Windows 10 or later (64-bit)
- WebView2 Runtime: included with Windows 11. The installer takes care of it if it is missing.
Please do not open a public issue for a security vulnerability. Report it privately through GitHub's security advisories. Past advisories are listed in the Security tab.
We welcome contributions from the community! Here's how you can help:
- Report bugs: open an issue with detailed steps to reproduce.
- Suggest features: share your ideas in Discussions.
- Improve documentation: fix typos or add examples.
- Submit code: fork the repository, create a branch and open a pull request. For big changes, please open an issue first. Issues labeled
good first issueare a good place to start.
Copyright © 2026 Alba Ayala Vilanova. All rights reserved.
This project is source-available for reading and contribution purposes only. Copying, reusing or distributing any part of this code without explicit written permission is not allowed. See LICENSE for full terms.