Mac app · macOS 26+

A password manager whose file is the whole database.

PassSumo reads and writes the open KDBX 4.x format — the same format used by several other password managers across desktop and mobile. Your vault is one file you keep in iCloud Drive or on local disk. There is no Heaven8 cloud and no account to create.

Not on the App Store yet Alpha — the app builds and runs today, ahead of its first submission.

Requires: macOS 26+
Format: KDBX 4.x
Sync: iCloud Drive or local file
Account: None

What it is

The .kdbx file is the single source of truth.

Unlock with a master password, or enrol Touch ID as a shortcut once the master password has unlocked the vault at least once. Search across every entry, generate new passwords, read TOTP codes for two-factor accounts, and attach files to an entry. Deleted entries move to a recycle bin inside the vault itself, the same convention other KDBX clients use, so nothing vanishes by surprise.

Encryption is the format's, not ours

The vault payload is encrypted with AES-256 or ChaCha20 under a key derived with Argon2 — that is what the KDBX format itself specifies, applied the same way any compliant KDBX reader or writer would apply it.

Sync is a file, not a service

PassSumo does not run a sync service. Put the .kdbx file in iCloud Drive and every device that can read that folder can open it; keep it on local disk and it never leaves the machine.

Built for interop

Reading and writing the same open format other password managers use is a design requirement, not an afterthought — a vault created elsewhere should open here, and a vault saved here should open elsewhere.

Decided, not missing

What PassSumo doesn't do, on purpose.

NOAutoFill or a browser extension. Both are attack surface. Filling a password into a running browser is not part of v1.
NOPasskeys. Passkey storage needs a system Credential Provider and there is no settled cross-client convention for storing one in a KDBX file yet.
NOA Heaven8 cloud, or any sync service of our own. Sync is whatever already moves your .kdbx file — iCloud Drive, or nothing at all.
NOAn account or sign-up. Nothing to register, nothing to log into.

None of this is a gap waiting to be filled quietly — it is stated here so it doesn't have to be discovered by its absence.

The system facts

Sandboxed, with nothing to sign into and nothing to leak.

Requires: macOS 26 or later
Distribution: Mac App Store, once submitted
Sandbox: Apple's App Sandbox
Account: None
Telemetry: None

There are no ads, no analytics, no telemetry and no third-party SDKs, and your vault never leaves your Mac. The one thing PassSumo talks to over the network is Apple's own purchase infrastructure, for the subscription — nothing else, and nothing out of your vault. Detail is in the privacy policy.

More detail

Read the rest, or send a message directly.

The support page, the privacy policy and the terms of use cover the rest. The feedback form goes straight to the person who writes the code.