FigLock

In development - nothing to install yet

One vault for you and your agents

FigLock keeps your passwords, API tokens and notes in one encrypted vault that lives in storage you already own. When an AI agent needs a token, you approve it with Touch ID and the agent uses it without seeing it.

How your data is handled How it works
A mock-up with made-up data. FigLock draws this prompt itself, never the agent.

Built around three promises

  • Your storage, not ours

    The vault is ciphertext in Google Drive, iCloud Drive or a folder you choose. We don't run a server or a database that holds your data.

  • Agents use, they don't hold

    By default FigLock adds the token to the agent's web request itself. It can also inject the token into a command and scrub it from the output. Showing a raw value is opt-in per item and needs its own approval every time.

  • Open and standard

    Free, and licensed MIT or Apache-2.0. Only standard cryptography, written down with test vectors, and an outside audit before we invite other people to rely on it.

How it works

  1. Create a vault with two secrets

    Your master password plus a Secret Key that stays on your devices. You save the Secret Key in an Emergency Kit, and we ask you to check you saved it.

  2. Pick where it lives

    Choose Google Drive, iCloud Drive or another synced folder. Titles, URLs and usernames are encrypted too, so the provider sees only file counts, sizes and times.

  3. Find things fast, on any device

    Search is local and forgives typos, so "clodflare" still finds Cloudflare. Every device keeps its own encrypted copy and works offline.

  4. Let an agent work without handing over the key

    The agent asks, you approve for a limited time and scope, and every use goes into an encrypted audit log you can read.

Where it will run

  • Command line and desktop

    A figlock command for macOS, Linux and Windows comes first, then a desktop app for macOS.

  • Browser, web and phones

    A browser extension with autofill, an installable web app, then native iPhone and Android apps.

Where we are

FigLock is in planning and early development. Nothing is released and it has had no security audit. Please don't store real secrets in anything built from it until the audit is done and published.