AliasVault

What AliasVault does

AliasVault combines a password manager with an email alias service. For each website you can generate a separate identity, a random password and a unique email address, and mail sent to that address arrives in AliasVault itself, because the project runs its own SMTP service rather than forwarding through a third party. If an address starts receiving spam, you know which site leaked or sold it.

The vault also stores passkeys, TOTP secrets, notes and attachments. Clients include a responsive web app, extensions for Chrome, Firefox, Edge, Safari and Brave, and native iOS and Android apps, the latter also on F-Droid. Autofill works in the extensions and mobile apps, an offline mode allows editing without a connection, and passwords can be imported from other managers. The security whitepaper also describes shared vaults for groups such as a family.

Security and encryption

AliasVault publishes a detailed security whitepaper (version 0.5, a draft dated October 2026). The master password is stretched with Argon2id on the device and never sent to the server: login uses the SRP-6a protocol. Vault contents are encrypted with AES-256-GCM before upload, each vault has its own key, and one Rust library, compiled to WebAssembly and native code, performs the cryptography for every client. Mail for aliases on private domains is encrypted on arrival with the public key of the vault it belongs to.

The whitepaper lists what this does not cover: the server sees each email in plaintext for the moment it takes to encrypt it, keeps the metadata needed to route mail and run accounts, delivers the web app’s code (the extensions and mobile apps do not depend on that), and serves the public key used when inviting someone to a shared vault. Public alias domains are provided through SpamOK, a separate service run by AliasVault’s author, which the docs recommend only for non-critical aliases. No independent audit has been completed yet; the docs say one covering the cryptographic design and Rust core is being prepared, with the report expected before the end of January 2027.

Self-hosting AliasVault

An install script sets up Docker Compose with automatic TLS, and a single-container Compose setup suits servers that already have a reverse proxy. The documented minimum is a 64-bit Linux machine with 1 vCPU, 1 GB of RAM and 5 GB of free disk (16 GB total recommended), Docker 20.10 or later and ports 80 and 443. Receiving mail on your own domains also needs DNS records and ports 25 and 587. The mobile apps only connect to servers with a publicly trusted certificate.

Hosted version

The AliasVault team runs the official cloud at app.aliasvault.com, with the private aliasvault.net mail domain. The website says all core features are free on both the cloud and self-hosted installs, and that optional paid extras such as additional storage are planned.

Limitations

AliasVault is a 0.x public beta, with releases every two to three weeks, and security fixes go to the latest release only. Team and organization features are still on the roadmap, and FIDO2 hardware keys for login are not yet supported. Hosting your own alias domains means running a mail server, with open port 25 and correct DNS.

Who it suits

AliasVault suits privacy-minded individuals and families who want password management and email aliases in one end-to-end encrypted tool, either in the official cloud or on a small server of their own. Businesses that need mature sharing and administration are better served for now by Bitwarden or Passbolt.