Industry news, product updates, security deep-dives, and the occasional rant about how broken password sharing has become. Also see the changelog and our security model.
Attach a TOTP secret to any credential and every authorised teammate gets a live, auto-refreshing six-digit code — no separate authenticator app, no manual handoff. End-to-end encrypted, and free on every plan.
Dashlane’s June 2026 incident exposed a fundamental challenge for password managers: encrypted vaults are only as strong as the master password protecting them. Pwdly tackles this with machine-generated phrases, Argon2id, and per-project vaults.
GitHub just confirmed ~3,800 internal repositories were exfiltrated via a poisoned VS Code extension. Here is why, even if Pwdly source code, encryption algorithms and raw database were leaked tomorrow, attackers still could not read a single password.
The cipher quietly protecting your Pwdly vault — and why we picked it over the AES-GCM that almost every other password manager defaults to.
This week I tried to build an internal admin dashboard for Pwdly. It's almost empty — and that's exactly the point.
A walk through the worst day of our company life — a full database dump in the wild — and exactly what an attacker would, and wouldn't, walk away with.
Today we're launching Pwdly — a password manager built around a 3-word phrase, end-to-end encryption, and a server that genuinely cannot read your data.
Sharing a vault with a teammate sounds simple — until you realize the server can never read what's inside. Here's the cryptographic choreography that lets you invite collaborators without ever exposing a single secret to Pwdly.
Master passwords are the worst of both worlds: hard to remember and easy to crack. We replaced them with three words because human memory and cryptographic entropy don't have to be enemies.
Three random words feel small. Mathematically, they are anything but. Here's how a tiny phrase becomes a key strong enough to protect your entire vault.
Offboarding is where most teams' security posture quietly collapses. Here's how Pwdly makes revoking access an instant, cryptographically-backed event — not a checklist item that gets forgotten on a Friday afternoon.
Your master key has to live somewhere while you're using Pwdly. Here's the surprisingly nuanced engineering that goes into making sure 'somewhere' isn't a place an attacker can reach.
We pulled a real row from production. Here's exactly what an attacker — or a curious engineer — would see if they queried our credentials table.
A quick look at the stack: React on the front, a cloud backend for storage and routing, and the browser doing the heavy cryptographic lifting in between.
No cookies. No tracking. No banners (almost).
We use privacy-friendly, cookieless analytics (Umami) to count page views — no personal data, no profiling, no third-party scripts. Read more.