macOS / Linux · health
Agent already running on this machine
curl -sS -H "X-Zecuri-Agent-Token: $ZECURI_AGENT_TOKEN" \ http://127.0.0.1:18788/v1/agent/health
Zecuri is a zero-knowledge password manager for Chrome, iOS, and Android.
One plan, $19 USD per year. Your vault encrypts on the device. Built by LineSpotting AB in Sweden. Zecuri is not zecurit.com.
Zero-knowledge on device
Built in Sweden
$19 USD / year, one plan
No analytics or ads
Local agent · copy paste
There is no public curl/irm installer. The agent is loopback only: 127.0.0.1:18788. Enable it in Chrome or iOS settings. Set ZECURI_AGENT_TOKEN in your environment. Do not print the token.
Windows · PowerShell · health
Same loopback. Do not echo the token.
Invoke-RestMethod -Headers @{ "X-Zecuri-Agent-Token" = $env:ZECURI_AGENT_TOKEN } `
http://127.0.0.1:18788/v1/agent/health
TOTP resolve
Codes stay on this machine. Do not log the response.
curl -sS -H "X-Zecuri-Agent-Token: $ZECURI_AGENT_TOKEN" \ "http://127.0.0.1:18788/v1/totp?q=ISSUER_OR_HOST"
Where it runs
Shipped clients, honest gaps
Same product family. The vault never decrypts on the Worker. There is no standalone web app.
Chrome extension
Shipped on the Chrome Web Store as Zecuri 0.1.0 (id miimkmkdempigljdmeejciakedfglamn). This is the web client.
iOS
App Store listing ZECURI 1.0.1 (id 6764837139). Local-first vault. TOTP paste-URI is in 1.0.1. Cloud sync is not a free always-on feature of that live binary.
Install iOS →Android
Google Play listing for package com.zecuri.app marketing 1.0.6. Same product id family, never com.linespotting.*.
Local agent
Loopback 127.0.0.1:18788 only. Enable from Chrome or iOS. Header X-Zecuri-Agent-Token. No public installer binary. Source is not public.
Planned, not shipped: Firefox, family plan, standalone web vault (app.zecuri.com does not resolve). Premium IAP at $19/year is the store product; the live iOS binary is still 1.0.1.
How to start
Five steps, no us required
Install a client
Chrome extension, iOS app, or Android app. Pick the device you have. There is no browser vault at app.zecuri.com.
Create a master password
The master password never leaves the device. If you forget it, nobody can recover the vault — including LineSpotting AB.
Add items locally
Passwords live on the device first. iOS 1.0.1 can paste a TOTP URI. Do not email vault files or dumps.
Optional: local agent
In Chrome or iOS, enable the local agent. It binds 127.0.0.1 only. Put the token in an environment variable. Never paste the token into chat.
Subscribe when you need Premium
$19 USD per year, one plan, App Store or Play in-app purchase. Sync across devices is gated; the live iOS 1.0.1 listing is still local-first.
Versions
Shipping board · 2026-08-21
Read from live stores and api.zecuri.com. We do not invent versions. Full notes on Versions.
| Date | Component | Version | Status | Notes |
|---|---|---|---|---|
| 2026-08-07 | iOS App Store | 1.0.1 |
live | ZECURI · id 6764837139 · bundle com.zecuri.app · TOTP paste-URI · local-first |
| 2026-08-21 | Chrome Web Store | 0.1.0 |
live | id miimkmkdempigljdmeejciakedfglamn |
| 2026-08-21 | Google Play | 1.0.6 |
live | package com.zecuri.app |
| 2026-08-21 | Sync API | v1 |
live | api.zecuri.com returns 426 on bare GET (version required). Zero-knowledge metadata. No TOTP route. |
| 2026-08-21 | Premium IAP | $19 / year |
source | iOS product com.zecuri.app.premium.yearly · Play premium_yearly · PR 38 merged. Not the live 1.0.1 store binary. |
| — | Web vault | — | not shipped | app.zecuri.com does not resolve |
| — | Firefox / family | — | planned | Not on stores |
| 2026-08-21 | Website | 2026-08-21 |
this page | $19 copy · versions · AGENTS.md · llms.txt |
What's new
Dated changelog
2026-08-21
Site matches the product that actually ships
Price on this site is $19 USD/year (the $19 copy was wrong). Shipping board, FAQ for humans, and AGENTS.md / llms.txt for AIs. Local agent documented as 127.0.0.1 only. Source is not public.
2026-08-21
Premium IAP in source
Zecuri iOS PR 38 merged: product com.zecuri.app.premium.yearly at $19/year. Live App Store binary remains 1.0.1 until the next store release.
2026-08-07
iOS 1.0.1 on the App Store
ZECURI 1.0.1 is live. TOTP paste-URI exists. Vault is local-first on that binary.
Agent
Command reference
Loopback only. Never print tokens or TOTP codes. The Worker has no TOTP route.
| Call | What it does |
|---|---|
GET /v1/agent/health |
Confirms the process is bound to 127.0.0.1:18788. Requires X-Zecuri-Agent-Token. Does not return vault secrets. |
GET /v1/totp?q= |
Resolves a TOTP item by issuer, title, or host from an unlocked local vault. The JSON includes a code — do not log it, do not paste it into tickets. |
MCP zecuri_totp |
Same resolve path over local MCP stdio. Same token. Same loopback rule. |
api.zecuri.com |
Sync API only. Bare GET is 426 (client must speak v1). No TOTP, no decrypt. |
What is Zecuri?
Zecuri is a zero-knowledge password manager for Chrome, iOS, and Android, built by LineSpotting AB in Sweden. Your vault is encrypted on your device. Zecuri is not zecurit.com, an unrelated US IT firm.
How much does Zecuri cost?
Zecuri costs $19 USD per year as a single in-app purchase subscription on the App Store and Google Play. There is one plan: no family tier, no monthly plan, and no extra paid add-ons.
Can Zecuri employees see my passwords?
No. Zecuri employees cannot see your passwords because the vault is encrypted on your device with keys derived from your master password, and those keys never reach Zecuri servers.
Is there a web vault?
No. app.zecuri.com does not resolve. Web use of Zecuri today is the Chrome extension plus this marketing site.
Does cloud sync work on the live iOS app?
The live iOS App Store binary is 1.0.1 and is local-first. Encrypted sync exists as an API at api.zecuri.com; Premium at $19/year is the intended gate. Do not assume 1.0.1 already sells that subscription in the store listing you download today.
Where are TOTP codes computed?
TOTP codes are computed on the device or by the local agent at 127.0.0.1:18788. api.zecuri.com has no TOTP endpoint. Do not send vault URIs or codes to the Worker.
How do I recover if I forget my master password?
You cannot recover a forgotten master password. That is intentional: the master password is the root of the encryption keys, and LineSpotting AB cannot decrypt your vault.
Is Zecuri open source?
No. Zecuri client and website repositories are private. The product is EU-built and zero-knowledge. Do not expect a public GitHub clone.
I am an AI — where do I start?
Read https://zecuri.com/AGENTS.md then https://zecuri.com/llms.txt and https://zecuri.com/FAQ.md. Do not request tokens, mailbox keys, or vault values.