New Paste a .env, get a vault →

The new tab that keeps secrets.

Hushpad turns every new tab into an end-to-end encrypted vault for your notes and environment variables. Open it on any machine with five simple words. The sync server only ever sees scrambled data.

Get Hushpad See how it works

For Chrome, Edge, Brave and Firefox

No email, no account Encrypted on your device Works offline No ads, no tracking
01Why

Secrets end up in the worst places.

A database password pasted into a chat. An API key in a notes app that syncs as plain text. A .env emailed to yourself. Hushpad gives those things one locked place that's already open every time you start a new tab.

Today

Readable by whoever runs the app, and by anyone who gets into it.

Note to selfTue 11:42
prod db, don't lose this: postgres://admin:Spr1ng-2026@db.internal:5432/billing
notes.txtsynced
stripe live key sk_live_51Hx…9QeT
staging pw correct-horse-7

Hushpad

Encrypted before it's saved. Masked until you ask. Gone from your clipboard in 30 seconds.

DATABASE_URL••••••••••Show
STRIPE_KEY••••••••••Show
STAGING_PW••••••••••Show
The server stores v1:Qm9…x7c=, not your password.
02How it works

Three steps.

  1. Add HushpadInstall it for Chrome or Firefox. Your new tab becomes the vault.
  2. Get your five wordsHushpad picks them for you. That's your only key, so write it down.
  3. Open it anywhereOn another machine, type the same five words. Your notes and env vars are there.
03Your code

No username. No password rules. Five words.

Your vault opens with one short phrase of everyday words, like a code word at a door. Hushpad picks the words so they're easy to remember and impossible to guess.

Your vault code
  1. 1mammal
  2. 2social
  3. 3dance
  4. 4broom
  5. 5tilt
mamm soci danc broo tilt
mammalsocialdancebroomtilt
The first four letters are enough
Mammal socail DANCE-broom tilt
mammalsocail → socialdancebroomtilt
Typos, capitals and dashes are fine
  • Picked for youCommon, easy-to-picture words. Don't like a set? Ask for different words.
  • Forgiving to typeCapitals and spacing don't matter, four letters per word is enough, and a single typo gets corrected.
  • Shown again when you need itAny machine where your vault is open can show the code in Settings.
  • Wrong guesses get blockedFive random words give about 36 quadrillion combinations, and the server stops anyone who keeps guessing.
04Env vars

Every project's .env, in one place.

Organise variables by project and environment, the way Vercel and Netlify do. Paste a whole .env to bring a project in, copy one back out when you need it.

# billing-api
export API_URL=https://api.dev.billing.test # dev
DATABASE_URL="postgres://dev:dev@localhost/billing"
STRIPE_KEY=sk_test_demo_51Hx8q2Lz0aP
SIGNING_KEY="-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASC...
-----END PRIVATE KEY-----"
this line has no equals sign
3 new · 1 overwritten · 1 line skipped
newAPI_URL
newDATABASE_URL
overwriteSTRIPE_KEY
newSIGNING_KEY
skippedLine 8: missing "="
  • Real .env parsingComments, export, quotes and multi-line private keys all come through intact.
  • Preview before savingSee what's new, what gets overwritten and which lines are skipped, before anything changes.
  • Copy or downloadA whole environment as .env, one variable, or one KEY=value line.
  • Careful with productionProduction is marked in red, and exporting it asks you to confirm first.
05Features

Small, and careful with your data.

  • Encrypted on your deviceEvery note and env set is encrypted before it's stored or synced. Nothing readable leaves your browser.
  • Syncs between machinesWork laptop, home desktop, a fresh install. Same five words, same vault.
  • Merges, never overwritesAdd API_URL at work and DB_URL at home, and both survive. Clashing note edits are kept as a copy.
  • Works offlineUnlock and edit on a plane. Changes sync the next time you're online.
  • Clipboard clears itselfCopied secrets are wiped from your clipboard after 30 seconds.
  • Notes for everything elseSSH configs, recovery codes, deploy checklists. Searchable, and saved as you type.
06Security

What the server actually sees.

Hushpad's code isn't public, so here's exactly how it protects your data. Your five words never leave your device, and neither does anything that could unlock your vault.

On your device

  • Vault codemammal social dance broom tilt
  • NoteRotate keys on Friday
  • STRIPE_KEYsk_test_demo…
  • Unlock keykept in memory, cleared when you lock

On the sync server

  • Vault idq7Rk2mPz9xVb…
  • Itemv1:Qm9hY3Rp…x7c=
  • Itemv1:Lk3sZ0pW…e1Q=
  • Login checka hash it can't reverse
Encryption
AES-256-GCM, per item
Key from your code
PBKDF2-SHA256 + HKDF
Vault key
Random 256-bit, wrapped by your code
Notes vs env vars
Indistinguishable to the server
Wrong-code guesses
Rate-limited per IP
Lost code
Not recoverable, by anyone
07Coming next

Your env vars, straight into your terminal. Soon

  • Same five wordsThe command-line tool unlocks the same vault, with the same encryption.
  • No .env files lying aroundRun your app with variables injected straight in, so there's nothing to accidentally commit.
08Install

Up and running in a minute.

Add Hushpad to your browser and open a new tab. You'll get your five words straight away.

  1. Add Hushpad from the Chrome Web Store or Firefox Add-ons.
  2. Open a new tab and choose Create a vault.
  3. Save your five words somewhere safe, then type them once to confirm.
  4. On your other machines, install Hushpad and type the same five words.
Coming soon to theChrome Web Store Soon Coming soon toFirefox Add-ons Soon

Works in Chrome, Edge, Brave and Firefox. Hushpad replaces your new tab page.

09FAQ

Questions.

What is Hushpad?

A browser extension that turns your new tab into an encrypted vault for notes and environment variables. It syncs between your machines, and only you can read what's in it.

Why five words instead of a password?

No username means there's nothing to sign up for. Hushpad picks the words so they're easy to remember but practically impossible to guess, which a password you make up usually isn't.

What if I forget my five words?

If your vault is open on any machine, go to Settings and choose Show code. If it isn't open anywhere, the data can't be recovered, not even by us. That's what end-to-end encryption means, so keep a copy somewhere safe.

Can you read my notes or env vars?

No. Everything is encrypted in your browser before it's stored or synced, and the key comes from your five words, which never leave your device. The server only stores scrambled data and can't even tell a note from an env var.

Is Hushpad open source?

No, Hushpad is closed source. The Security section above describes exactly how the encryption works and what the server stores.

Does it work offline?

Yes. Unlocking, reading and editing all happen on your device. Changes sync the next time you're online.

Which browsers does it support?

Chrome, Edge, Brave and other Chromium browsers, and Firefox.

What happens to my normal new tab page?

Hushpad replaces it. When your vault is locked, a new tab shows the unlock screen. Lock it from the sidebar, and it locks automatically when you close the browser.

Is my data sent anywhere?

Only encrypted data, and only to the Hushpad sync server so your other machines can get it. You can also keep a vault on one device with sync turned off. See the privacy policy.

Give your secrets a better home than a chat thread.

Your next new tab can be the safest place you keep them.

Get HushpadHow it's encrypted