Hi, I'm Jonny. I build ZZPass.
A password manager for iPhone, iPad and Mac, made in Norway and paid for by the people who use it. It's built so you don't have to trust me, and this page shows you what you can check for yourself.
- App Store
- Sold by Jonny Rein EriksenThe name on the App Store listing
- Based in
- Norway
- Funding
- NoneNo investors, no ads
- Before
- 22 years at OperaBuilding the web browser
- Works on
- iPhone, iPad and MacIn 14 languages
What I can see about you.
Your passwords never pass through anything I run. Here is everything, and who can read it.
| Where | What's there | Who can read it |
|---|---|---|
| Your devices | Your vault, unlocked with your password, Face ID or Touch ID. | You |
| Your iCloud | Your vault, encrypted on your device before it syncs. Apple stores it but holds no key to it. | Only you |
| ZZPass servers | For Emergency Access and TimeCapsule only: keys already locked for the people you chose, and when to release them. An email address, if you ask for warning emails. | Nobody can open your vault with them, me included |
| ZZPass servers | Anonymous usage statistics and crash reports, if Share anonymous usage data is on. Never your passwords, notes, names or email. Turning it off deletes anything not yet sent. | Me, as anonymous totals |
One more thing to know: to show a website's icon, ZZPass fetches it straight from that website.
Don't take my word for it.
Everything on this page can be checked by someone who isn't me.
The server code is public
Read exactly what runs on the ZZPass servers, MIT licensed.
- timelock-escrowEmergency Access and TimeCapsule
- zzpass-telemetrythe anonymous usage data
- zzpass-monitoruptime checks
The design, in full
How your vault is locked, how sharing and Emergency Access work, and what a server breach would expose. Your vault is encrypted with Apple's CryptoKit.
Read the security whitepaper →What's inside the app
- Apple's own frameworks, including
CryptoKit,CloudKitandAuthenticationServices zzpass-core, my own Rust library for encrypted connections between devices, built on the open-source RustCrypto libraries- Open-source helpers:
CSV.swift(import files),FaviconFinderandSwiftSoup(website icons),SwiftDomainParserandIDNA-Cocoa(matching web addresses),LRUCache,Foil,swift-atomics Sparkle, for updates to the Mac app
Tell me first
Write to security@zzpass.com. Every good-faith report is acknowledged within 3 business days.
Security policy →Leave whenever you like
Export to CSV or 1PUX anytime, or on iOS 26 and macOS 26, straight into another app.
How to export →Why it's built this way.
I spent 22 years at Opera Software building the web browser, mostly on the browser engine, where security is the day job.
One lesson stuck: a system that asks you to trust whoever runs it will disappoint somebody sooner or later. So ZZPass is designed so that trust in me isn't needed. I can't read your vault, I can't reset your password, and there is nothing I could hand over to anyone.
What ZZPass won't do.
Most of these aren't policies. They follow from how the app is built, so they can't be quietly changed later.
- Read your vault.Your key is made on your device and never sent to me.
- Keep your password or Secret Key.That's also why I can't reset them, and why the Emergency Kit exists.
- Show you ads.Not in the app, not in email.
- Sell your data.A vault nobody else can open is worth nothing to anyone but you.
Small, on purpose
- One developer, so there's no 24-hour support desk.
- Apple only: no Windows, Android or web version.
- Features ship when they're done, not on a quarterly schedule.
And if ZZPass ever stopped, your passwords stay where they are now, on your devices and in your iCloud, ready to export.
Paid for by subscriptions. That's all.
ZZPass is free to use. Premium is $2.99 a month or $29.99 a year, and one subscription covers up to six people with Family Sharing.
No advertising, no investors waiting for a return, and no data to sell. See plans →
Get in touch.
Help with the app
support@zzpass.com, or start with the support guides.
Security reports
security@zzpass.com. Please don't open a public GitHub issue for a vulnerability.
Privacy
What's collected and what isn't, in the privacy policy.
Judge it by the app, not the about page.
Free to use, with unlimited passwords and devices. Nothing to cancel if it's not for you.
