Industry news, product updates, security deep-dives, and the occasional rant about how broken password sharing has become. Also see the changelog and our security model.
Three reports from squ11z1 exposed gaps in Pwdly's invite flow, MFA enforcement and passkey lifecycle. David explains what went wrong, what changed, and why zero-knowledge has to hold beyond the cipher.
GeekChamp ranks Pwdly #27 of 91 password managers, scores it 6.2/10 and calls it best for small teams on a fixed budget. A little celebration, a genuine thank you — and one word from behind the scenes: Inboxes.
iTechGuides ranked Pwdly #41 of 90 password managers with a 5.0/10 score. Here is what that milestone means, why development has slowed, and why deliberate progress matters in security software.
The honest answer to Pwdly's most-asked security question: why we can't reset your 3-word login phrase, why it's stronger than the password you'd have chosen, and how to make sure you never need to test the worst case.
Save logins, autofill credentials and grab 2FA codes without leaving the tab — all wrapped in the same zero-knowledge encryption as the Pwdly vault. Now available for Chrome and Firefox.
Attach a TOTP secret to any credential and every authorised teammate gets a live, auto-refreshing six-digit code — no separate authenticator app, no manual handoff. End-to-end encrypted, and free on every plan.
Dashlane’s June 2026 incident exposed a fundamental challenge for password managers: encrypted vaults are only as strong as the master password protecting them. Pwdly tackles this with machine-generated phrases, Argon2id, and per-project vaults.
GitHub just confirmed ~3,800 internal repositories were exfiltrated via a poisoned VS Code extension. Here is why, even if Pwdly source code, encryption algorithms and raw database were leaked tomorrow, attackers still could not read a single password.
The cipher quietly protecting your Pwdly vault — and why we picked it over the AES-GCM that almost every other password manager defaults to.
This week I tried to build an internal admin dashboard for Pwdly. It's almost empty — and that's exactly the point.
A walk through the worst day of our company life — a full database dump in the wild — and exactly what an attacker would, and wouldn't, walk away with.
Today we're launching Pwdly — a password manager built around a 3-word phrase, end-to-end encryption, and a server that genuinely cannot read your data.
Sharing a vault with a teammate sounds simple — until you realize the server can never read what's inside. Here's the cryptographic choreography that lets you invite collaborators without ever exposing a single secret to Pwdly.
Master passwords are the worst of both worlds: hard to remember and easy to crack. We replaced them with three words because human memory and cryptographic entropy don't have to be enemies.
Three random words feel small. Mathematically, they are anything but. Here's how a tiny phrase becomes a key strong enough to protect your entire vault.
Offboarding is where most teams' security posture quietly collapses. Here's how Pwdly makes revoking access an instant, cryptographically-backed event — not a checklist item that gets forgotten on a Friday afternoon.
Your master key has to live somewhere while you're using Pwdly. Here's the surprisingly nuanced engineering that goes into making sure 'somewhere' isn't a place an attacker can reach.
We pulled a real row from production. Here's exactly what an attacker — or a curious engineer — would see if they queried our credentials table.
A quick look at the stack: React on the front, a cloud backend for storage and routing, and the browser doing the heavy cryptographic lifting in between.
No cookies. No tracking. No banners (almost).
We use privacy-friendly, cookieless analytics (Umami) to count page views — no personal data, no profiling, no third-party scripts. Read more.