The short version: Bramble is a local-first password manager, available as a browser extension, as mobile apps, and as a desktop app. It does not collect, sell, or share any of your data. There is no account and no Bramble server that holds your vault. Everything stays on your device, encrypted. Bramble makes network connections only for a few optional features that are off by default and that you turn on yourself: a password breach check, peer-to-peer sync between your own devices, encrypted backups to a storage provider you choose, and email aliases from a provider you already use. The one exception is the desktop app, which checks for updates when it opens; you can turn that off. None of these ever exposes your passwords or your vault in a form that Bramble, a provider, or anyone else could read. Details below.
What data Bramble handles
Bramble stores the data you choose to save in it, such as login usernames and passwords, passkeys, payment cards, secure notes, SSH keys, and two-factor (TOTP) seeds, together with your own app preferences. This data is created and used only to provide the password-manager features you asked for (saving, searching, and autofilling your credentials).
Where it is stored
Your vault is stored only on your devices. In the browser extension that means your browser's local extension storage and/or a vault file you pick on your own computer. In the mobile apps it means the app's private on-device storage, with a small number of secrets (the key that protects your vault) held in the OS keystore. In the desktop app it means ordinary files in the app's data folder on your computer; this device's sync identity and the credentials for any cloud backups you set up are kept in your operating system's credential store where one is available (the macOS Keychain, the Windows Credential Manager, or the Secret Service or kernel keyring on Linux), and never the key to your vault. Bramble has no vault server, so your data is not stored off your devices unless you turn on cloud backups (below), which keep an encrypted copy with a storage provider you choose.
How it is protected
Your vault is encrypted. The key that protects it is derived from your master password using Argon2id, and individual entries are encrypted with AES-256-GCM. Encryption and decryption happen locally on your device. Your master password and the keys derived from it are never stored in plaintext and never leave your device.
What Bramble does not do
- No data collection, tracking, analytics, telemetry, or advertising.
- No accounts, sign-up, or login to any service.
- No Bramble vault server or cloud. Bramble runs no server that stores your vault. If you turn on backups, only an encrypted copy goes to a storage provider you choose and control (see "Cloud backups" below); the ciphertext is all that ever leaves your device.
- No selling, renting, or sharing of your data with anyone.
- No use of your data for any purpose other than the features you use.
Network connections, in full
The browser extension and the mobile apps work entirely offline by default, and their updates come through the store or app store you installed them from. There are four features that make network connections, all optional and all off until you turn them on: the password breach check, device sync, cloud backups, and email aliases. The desktop app adds one more, on by default: a check for updates when it opens. They are described next. Bramble makes no other network requests.
Update checks (desktop app)
The desktop app is installed directly rather than from a store, so it looks for new versions itself. A few seconds after it opens, it downloads a small file from bramble.sh that names the latest version. You can turn this off in Settings, under Updates, with "Check for updates when Bramble opens"; you can still check by hand from the same place, or from the app menu.
- What is sent. An ordinary web request for that file, the same for everyone. Nothing from your vault, your settings, or your device is included. Like any web request it shows your IP address to the server; bramble.sh is hosted by Cloudflare.
- Nothing installs without you. If a newer version exists, Bramble asks before doing anything. If you agree, it downloads the update from Bramble's releases on GitHub and checks it against a signature built into the app before applying it, so a tampered download is refused.
- Not every install checks. On Linux, copies installed from a package (such as the .deb or .rpm, or through Nix) never check, because your package manager updates them; the AppImage does check.
Password breach check (optional)
Bramble can tell you whether one of your saved passwords has appeared in a known data breach. This feature is off by default; you turn it on in Settings.
When it is on, Bramble checks a password using the Have I Been Pwned "Pwned Passwords" service with a privacy-preserving method called k-anonymity: it computes a SHA-1 hash of the password and sends only the first five characters of that hash to its API (api.pwnedpasswords.com). The service returns a list of possible matches and Bramble compares them on your device. Your password, and even its full hash, never leave your device, and Have I Been Pwned cannot tell which password you checked. Bramble also asks the service to pad its response so the amount of data returned reveals nothing about your query.
Have I Been Pwned is operated by a third party under its own privacy policy: haveibeenpwned.com/Privacy.
Syncing across your own devices (optional)
Bramble can sync one vault across your own devices (for example between two browsers, or between a browser and a phone). This is optional and off until you set it up by linking a device, and it is strictly personal: only your own devices, only your own vault. There is no shared network, and no server ever stores your vault or can read it.
How it works, and what each part can see:
- The vault transfer is device-to-device. Your devices connect directly to each other wherever the network allows it, and exchange the vault over that encrypted connection. The vault stays end-to-end encrypted under a key that only your devices hold.
- A signaling relay only helps your devices find each other. To set up the direct connection, your devices exchange brief connection details through a relay (a WebSocket server). By default this is a relay we run, but you can point Bramble at your own relay or at any public relay that speaks the same protocol. The relay never receives your vault, your passwords, your master password, or any key that could decrypt them.
- The relay sees only opaque data and basic metadata. The signaling messages it passes along are themselves encrypted with a key it does not have, and the "room" your devices meet in is addressed by an unguessable value derived from that key, so the relay cannot tie it to you. The most it can observe is that two network addresses connected, and when. The direct channel between your devices is mutually authenticated, so a dishonest relay cannot read, alter, or impersonate either device; it can at most refuse to help, in which case you can link devices by scanning a QR code instead.
- When a direct connection is not possible, it is relayed. Two devices on different networks (a phone on mobile data and a laptop at home, say) often cannot reach each other directly. Then the connection runs through a TURN relay server, Cloudflare's by default, which the signaling relay arranges. The relayed traffic is the same end-to-end encrypted connection, which the TURN server cannot read; it sees your network addresses and how much data passes. You can point Bramble at your own TURN service in the same Advanced settings as the relay.
Cloud backups (optional)
Bramble can keep an encrypted backup of your vault with a storage provider you choose. This is optional and off until you set it up, and you can turn it off or remove your backups at any time.
What this does and does not expose:
- Only ciphertext leaves your device. A backup is the same client-side-encrypted blob as a local export: it can be opened only with your master password. Encryption happens on your device before anything is uploaded, so the provider stores opaque data and never sees your passwords, your vault, or any key that could decrypt them.
- You pick the destination, and Bramble has no server in the middle. Bramble uploads directly to the storage you configure: Dropbox (which you connect with a normal sign-in), or any S3-compatible or WebDAV storage, including services you self-host. Bramble runs no backup server of its own and keeps no copy.
- The provider is a third party under its own terms. Whatever storage you choose receives the encrypted file and the account or connection details needed to store it, and handles them under its own privacy policy. Because the file is encrypted, that is all it can see.
Email aliases (optional)
Bramble can create a different email address for each site you sign up to, using an alias provider you already have an account with. This is optional and off until you set it up, and setting it up is what turns it on: until you enter an API key in Settings, Bramble never contacts any alias provider and the feature does not appear anywhere in the app.
What this does and does not expose:
- Nothing happens without a deliberate click. An address is only ever created when you ask for one, by pressing the alias button in an entry, or the alias row that appears on a sign-up form. Bramble never creates one in the background, never on page load, and never to see whether it could.
- Bramble is not the alias service and never sees your mail. Your provider is the one that creates the address and forwards the mail; Bramble asks it for an address on your behalf and puts the answer in the field. Mail never passes through Bramble, and Bramble runs no alias service of its own.
- What is sent, and to whom. The request goes to your provider and nowhere else: to Addy.io, SimpleLogin, DuckDuckGo Email Protection or Firefox Relay, or to your own server if you self-host Addy.io or SimpleLogin. It carries your API key, the site the address is for, and a short note naming Bramble, so the alias is recognisable in your provider's own dashboard. DuckDuckGo accepts neither the site nor the note, so a request to it carries your key and nothing else. Nothing from your vault is included.
- Your API key stays encrypted on your device. It is stored under your vault's encryption key, like the rest of your vault, and is used only to authenticate these requests. Because it is encrypted with the vault, an alias can be created only while the vault is unlocked. Removing the provider in Settings deletes the key, and deleting the vault deletes it too.
- The provider is a third party under its own terms. Addy.io and SimpleLogin receive the requests above and handle them under their own privacy policies, and the aliases you create live in your account with them, where you can disable or delete them.
Autofill
In the browser extension, Bramble's content script runs on web pages and looks at the structure of forms on the page (for example, whether a field is a username, password, or one-time-code field) so it can offer to fill saved credentials. This happens entirely on your device. Bramble does not read, collect, or transmit the content of the pages you visit, and it only fills a credential when you explicitly choose one.
On mobile, autofill uses the operating system's own AutoFill framework. When you pick Bramble to fill a login, the system hands Bramble the app or website you are filling so it can find a matching entry. Bramble's autofill runs in a separate, locked component that reads your vault only after you authenticate (with biometrics, your device passcode, or your master password) and then decrypt it; nothing in your vault is readable before that.
Passkeys and security keys
Bramble can act as a passkey provider (and, in the browser extension, a security-key provider) for the sites and apps you sign in to. When a site asks you to create or use a passkey, your browser or device can offer Bramble: the passkey's private key is generated and kept in your encrypted vault, stored as an ordinary vault entry, and never leaves it. Bramble only signs the challenge the site sends, and only after you approve. In Chromium browsers this uses the browser's Web Authentication proxy; on mobile it uses the operating system's passkey framework. No passkey material is ever sent to Bramble.
On mobile: unlocking, key storage, and keyboard suggestions
- Biometric unlock. If you turn it on, Bramble caches your vault key behind a hardware-backed biometric gate provided by the operating system (the iOS Keychain and Secure Enclave, or the Android Keystore). The key is released only after a successful biometric or device-passcode check, and the system invalidates it if your enrolled biometrics change. This is a convenience built on the operating system's own protection; it stays on your device.
- Shared storage with the autofill component. So that AutoFill can work, its autofill component reads your logins from encrypted, app-private storage on the device. That storage is protected with your vault key and is not readable without unlocking, and nothing in it ever leaves the device.
- Keyboard suggestions (iOS, off by default). On iOS you can optionally let Bramble show matching logins as suggestions above the keyboard. Turning this on provides your saved usernames and the websites they belong to (but never your passwords) to iOS, so the system can show those suggestions even before you unlock Bramble. It is off by default precisely because it makes those usernames visible to the operating system before authentication; you can turn it off at any time.
- Camera. Bramble can scan QR codes (to link a device for sync, or to add a TOTP secret) using your camera. The scanning happens on your device and the camera images are not stored or transmitted.
On the desktop: the browser link, credentials, and starting at login
- Linking to your browser. The desktop app can link to the Bramble extension in browsers on the same computer, so its quick-access panel can fill the page in front of you. The two talk over a channel the browser provides between itself and programs on the same computer ("native messaging"), encrypted and authenticated by a pairing you confirm, and nothing about it goes over the network. To make that possible, the desktop app registers a small helper with the browsers installed on your computer: a small file for each browser, or on Windows one file plus a registry entry for each browser.
- Credentials. As above, the keys that identify this device to your others for sync, and the credentials for any cloud backups you set up, are kept in your operating system's credential store. Your vault key never is.
- Starting at login (off by default). If you turn it on, the app starts when you sign in to your computer, so scheduled backups run without you opening it.
Browser extension permissions, in plain language
- Access to websites: to detect login fields and offer autofill.
- Storage: to keep your encrypted vault and preferences on your device.
- Clipboard: to copy a password and clear it after a timeout.
- Alarms and idle: to lock the vault automatically after inactivity or when your screen locks.
- Offscreen: to run the encryption module.
- Web authentication: to let you use Bramble as a passkey or security-key provider for websites (Chromium browsers).
- Identity: to run the provider's sign-in screen when you connect a cloud-backup account such as Dropbox.
- Native messaging (optional, Chromium browsers): to talk to the Bramble desktop app on the same computer. Your browser asks you for it only when you link the extension to the desktop app.
Clipboard
When you copy a password, Bramble writes it to your clipboard and, after a short timeout, clears the clipboard to reduce the chance of a secret lingering there. This is done locally and the copied value is never sent anywhere.
Importing other password files
If you import a vault from another manager (for example a KeePass .kdbx file), Bramble reads that file locally to add its entries to your vault. The file and its contents are processed only on your device and are not transmitted anywhere.
Recovery and lost access
Bramble has no copy of your master password or the keys derived from it, so it cannot recover your vault or reset your password for you. If you set up a recovery code or a security key, you can use those to regain access. If you lose your master password and every recovery method you set up, your vault cannot be decrypted by you, by us, or by anyone. That is the trade-off for there being no backdoor.
Data retention and deletion
Because your data lives only on your devices, you are in control of it. Removing the extension or the app, deleting your vault file, and clearing the app's or extension's storage removes your data. For the desktop app, that means deleting its data folder too; the Windows uninstaller offers to do that for you, along with the credentials it stored in the Windows Credential Manager. Bramble retains nothing on your behalf because it holds nothing about you anywhere else. If you turned on cloud backups, delete the encrypted backup files from your storage provider too, since those live in your account there, not with Bramble.
Children
Bramble is a general-purpose tool, not directed at children, and collects no information from anyone.
Changes to this policy
If this policy changes, the updated version will be posted here with a new effective date.
Contact
Questions about this policy or your privacy? Email [email protected].