phylakto Join the waitlist

Passwords · passkeys · notes · identities — light and agentic

Let agents sign in. Never hand them a password.

Phylakto keeps your logins, cards, passkeys and secure notes in one encrypted file that you own. When Claude Code or Codex needs to sign in, it asks Phylakto, which checks the site, asks you when it should, and fills the form itself.

Illustration: the panel Phylakto shows on your Mac when an agent asks to sign in to an account set to approval.
  • KDBX 4.1
  • Argon2id
  • macOS · Linux
  • Chrome
  • Android
  • MCP
  • No cloud
  • No trackers

01 — Agentic

Agents ask. Phylakto fills.

Claude Code, Codex and other agents reach your vault through Phylakto’s local MCP server and its Chrome extension. The password is never handed to the agent: Phylakto writes the fields into the page itself, and the agent gets a status back — filled, refused or locked.

  • Before filling, Phylakto checks the real origin of the tab and of every frame. A look-alike page gets nothing.
  • Payment cards always need your approval, and Phylakto never fills the security code: you type it yourself.
  • Agents can create accounts too: they fill the sign-up form with the identity profile you chose, personal or work, Phylakto keeps a new password in the vault, and the verification email is read for them.
  • Every agent action goes into a log you can read. One switch pauses all agents, from your computer or your phone.

Three modes, per account

Automatic
The agent can have this account filled without stopping you.
Approval
Each request waits for Touch ID or your system’s password prompt.
Forbidden
Agents can’t use this account at all.
Agent log — illustration
  1. 09:41Claude Code mail.example.comfilled · automatic
  2. 09:43Codex bank.example.comapproved · Touch ID
  3. 09:44Codex admin.example.comrefused · forbidden

02 — One file, yours

Everything in one file you can open anywhere.

Phylakto stores your vault as a standard KDBX 4.1 file, the KeePass format. If you stop using Phylakto tomorrow, KeePassXC still opens it. Argon2id guards it, and one master secret unlocks it.

  • Logins

    Usernames and passwords tied to the exact sites they belong to, with the history of old passwords.

  • Cards

    Filled into the payment frame you approve. The security code is never filled in: you type it.

  • Passkeys

    Kept in the same file, and used on Android through the system’s Credential Manager.

  • Secure notes

    Recovery codes, door codes, anything you’d rather not leave in a notes app.

How Phylakto shows a password: digits underlined, symbols inverted, so you can read it out without mistakes.

03 — Where you sign in

Light apps, where you already are.

  • Desktop

    macOS and Linux. About 15 MB, built with Tauri. It stays in the menu bar and asks Touch ID or the system prompt when an approval is needed.

    Available

  • Chrome

    Fills your logins. Saves new accounts and password changes on its own, with an Undo. Generates passwords with your options: length, symbols, no look-alike characters.

    Available

  • Android

    An autofill service and a Credential Manager provider, for passwords and passkeys in apps and in the browser.

    Available

  • Windows

    Same app, once the local component speaks Windows and Windows Hello.

    Coming

  • iOS

    An iPhone app.

    Coming

04 — Sync

Sync without anyone’s cloud.

Your devices sync through a small server you own: a Raspberry Pi on your Tailscale network. It only ever holds encrypted revisions.

When two devices change the same entry while apart, a three-way merge keeps both changes, or shows you the conflict and lets you choose. Nothing is overwritten silently.

Backups to your own Google Drive are being wired up: copies are encrypted before they leave, and Phylakto only gets access to the files it creates.

  1. Mac · Linuxdesktop app
  2. Androidphone app
  3. Your Raspberry Piover Tailscale · encrypted revisions
  4. Your Google Driveencrypted backups · in progress

05 — Housekeeping

The dull parts, done.

  • Leave your old manager

    Import from NordPass or 1Password, others next. See a report of what will change before anything does, then delete the export file.

  • Merge duplicates

    Phylakto finds the same account saved twice and merges it, keeping the password that last worked. The others go to its history.

  • Last used, last worked

    Each login shows when you last used it and when its password last worked, so forgotten accounts stand out.

06 — Coming

Not there yet.

These are on the way. None of them is available today.

  • More imports

    Bitwarden and other password managers.

    Coming

  • Windows and iOS

    The two platforms still missing.

    Coming

07 — The name

The name

φυλακτό

Phylakto, from the Greek φυλακτό: a small talisman you carry with you, that protects you.

Join the waitlist

Privacy

Your email, and nothing else.

What we keep
Your email address, the date you joined, and which version of the consent line above you agreed to.
What for
To email you when Phylakto is ready to try. Nothing else: it is never shared or sold.
How long
Until you leave, and at the latest until the waitlist closes.
Where
On Léandre’s own server, in the EU. No cookies, no analytics, no trackers on this site.
Who
Léandre Desmaretz, who makes Phylakto. Contact: hello@leandre-desmaretz-lespagnol.com. You can ask to see, correct or delete your address at any time, or complain to the CNIL.
Leaving
Enter your address below, or write to the address above. It is removed within a month at the latest.
The apps
How the Phylakto apps use Google Drive for backups, with access only to the files they create: app privacy policy and terms of use, in French.