macOS / Linux · health
Agent already running on this machine
curl -sS -H "X-Zecuri-Agent-Token: $ZECURI_AGENT_TOKEN" \ http://127.0.0.1:18788/v1/agent/health
Zecuri is a zero-knowledge password manager for Chrome, iOS, and Android.
One plan, $19 USD per year. Your vault encrypts on the device. Built by LineSpotting AB in Sweden. Zecuri is not zecurit.com.
Zero-knowledge on device
Built in Sweden
$19 USD / year, one plan
No analytics or ads
Local agent · copy paste
There is no public curl/irm installer. The agent is loopback only: 127.0.0.1:18788. Enable it in Chrome or iOS settings. Set ZECURI_AGENT_TOKEN in your environment. Do not print the token.
Windows · PowerShell · health
Same loopback. Do not echo the token.
Invoke-RestMethod -Headers @{ "X-Zecuri-Agent-Token" = $env:ZECURI_AGENT_TOKEN } `
http://127.0.0.1:18788/v1/agent/health
TOTP resolve
Codes stay on this machine. Do not log the response.
curl -sS -H "X-Zecuri-Agent-Token: $ZECURI_AGENT_TOKEN" \ "http://127.0.0.1:18788/v1/totp?q=ISSUER_OR_HOST"
Where it runs
Shipped clients, honest gaps
Same product family. The vault never decrypts on the Worker. There is no standalone web app.
Chrome extension
Shipped on the Chrome Web Store as Zecuri 0.1.0 (id miimkmkdempigljdmeejciakedfglamn). This is the web client.
iOS
Live App Store binary is still ZECURI 1.0.1 (id 6764837139). 1.1.0 bn 202609052006 is Waiting for Review, auto-release on approval. TOTP paste-URI is in 1.0.1.
Install iOS →Android
Google Play production is 1.1.0 vc8 (package com.zecuri.app). In-app Subscribe / Restore — the store shows the local amount. Never com.linespotting.*.
Local agent
Loopback 127.0.0.1:18788 only. Enable from Chrome or iOS. Header X-Zecuri-Agent-Token. No public installer binary. Source is not public.
Planned, not shipped: Firefox, family plan, standalone web vault (app.zecuri.com does not resolve). Yearly Premium is on Play 1.1.0 and in the iOS 1.1.0 review binary. Live iOS store binary is still 1.0.1.
How to start
Five steps, no us required
Install a client
Chrome extension, iOS app, or Android app. Pick the device you have. There is no browser vault at app.zecuri.com.
Create a master password
The master password never leaves the device. If you forget it, nobody can recover the vault — including LineSpotting AB.
Add items locally
Passwords live on the device first. iOS 1.0.1 can paste a TOTP URI. Do not email vault files or dumps.
Optional: local agent
In Chrome or iOS, enable the local agent. It binds 127.0.0.1 only. Put the token in an environment variable. Never paste the token into chat.
Subscribe when you need Premium
Yearly Premium is an in-app subscription. Play and the App Store show the amount for your storefront. Sync across devices is gated; live iOS 1.0.1 is still local-first.
Versions
Shipping board · 2026-09-05
Read from live App Store Connect, Google Play, Chrome Web Store, and api.zecuri.com. We do not invent versions. Full notes on Versions · API pulse on Status.
| Date | Component | Version | Status | Notes |
|---|---|---|---|---|
| 2026-09-05 | Google Play | 1.1.0 vc8 |
live | package com.zecuri.app · production completed · Subscribe / Restore in-app |
| 2026-09-05 | iOS 1.1.0 | bn 202609052006 |
Waiting for Review | id 6764837139 · bundle com.zecuri.app · auto-release on approval · yearly IAP in the same submission |
| 2026-08-07 | iOS App Store (live) | 1.0.1 |
live | Still the binary on the store until 1.1.0 is approved · TOTP paste-URI · local-first |
| 2026-08-21 | Chrome Web Store | 0.1.0 |
live | id miimkmkdempigljdmeejciakedfglamn |
| 2026-08-21 | Sync API | v1 |
live | api.zecuri.com returns 426 on bare GET. Zero-knowledge metadata. No TOTP route. |
| 2026-09-05 | Yearly IAP | com.zecuri.app.premium.yearly |
iOS review / Play | Store shows the local amount. In-app copy is Subscribe / Restore. |
| — | Web vault | — | not shipped | app.zecuri.com does not resolve |
| 2026-09-05 | Website | 2026-09-05 |
this page | Status matrix · versions · review notes · AGENTS.md · llms.txt |
Play 1.1.0 vc8 ████████████████████ live iOS 1.1.0 review ████████░░░░░░░░░░░░ waiting iOS 1.0.1 store ████████████████████ live Chrome 0.1.0 ████████████████████ live Website ████████████████████ this page
What's new
Dated changelog
2026-09-05
Play 1.1.0 vc8 live · iOS 1.1.0 in App Review
Google Play production completed 1.1.0 vc8. In-app paywall is Subscribe / Restore (the store shows the local amount). iOS 1.1.0 bn 202609052006 is Waiting for Review after an App Store 2.1(b) paywall-on-appear fix; release type is auto-release on approval. Live iOS store binary remains 1.0.1. Full notes on Versions · reviews.
2026-08-21
Site matches the product that actually ships
Shipping board, FAQ for humans, and AGENTS.md / llms.txt for AIs. Local agent documented as 127.0.0.1 only. Source is not public.
2026-08-21
Premium IAP in source
Yearly product com.zecuri.app.premium.yearly merged. Play now ships that train on 1.1.0. The App Store still lists iOS 1.0.1 until 1.1.0 is approved.
2026-08-07
iOS 1.0.1 on the App Store
ZECURI 1.0.1 is live. TOTP paste-URI exists. Vault is local-first on that binary.
Agent
Command reference
Loopback only. Never print tokens or TOTP codes. The Worker has no TOTP route.
| Call | What it does |
|---|---|
GET /v1/agent/health |
Confirms the process is bound to 127.0.0.1:18788. Requires X-Zecuri-Agent-Token. Does not return vault secrets. |
GET /v1/totp?q= |
Resolves a TOTP item by issuer, title, or host from an unlocked local vault. The JSON includes a code — do not log it, do not paste it into tickets. |
MCP zecuri_totp |
Same resolve path over local MCP stdio. Same token. Same loopback rule. |
api.zecuri.com |
Sync API only. Bare GET is 426 (client must speak v1). No TOTP, no decrypt. |
What is Zecuri?
Zecuri is a zero-knowledge password manager for Chrome, iOS, and Android, built by LineSpotting AB in Sweden. Your vault is encrypted on your device. Zecuri is not zecurit.com, an unrelated US IT firm.
How much does Zecuri cost?
Zecuri costs $19 USD per year as a single in-app purchase subscription on the App Store and Google Play. There is one plan: no family tier, no monthly plan, and no extra paid add-ons.
Can Zecuri employees see my passwords?
No. Zecuri employees cannot see your passwords because the vault is encrypted on your device with keys derived from your master password, and those keys never reach Zecuri servers.
Is there a web vault?
No. app.zecuri.com does not resolve. Web use of Zecuri today is the Chrome extension plus this marketing site.
Does cloud sync work on the live iOS app?
The live iOS App Store binary is still 1.0.1 and is local-first. 1.1.0 is Waiting for Review. Encrypted sync exists as an API at api.zecuri.com. Do not assume 1.0.1 already sells the yearly subscription.
Where are TOTP codes computed?
TOTP codes are computed on the device or by the local agent at 127.0.0.1:18788. api.zecuri.com has no TOTP endpoint. Do not send vault URIs or codes to the Worker.
How do I recover if I forget my master password?
You cannot recover a forgotten master password. That is intentional: the master password is the root of the encryption keys, and LineSpotting AB cannot decrypt your vault.
Is Zecuri open source?
No. Zecuri client and website repositories are private. The product is EU-built and zero-knowledge. Do not expect a public GitHub clone.
I am an AI — where do I start?
Read https://zecuri.com/AGENTS.md then https://zecuri.com/llms.txt and https://zecuri.com/FAQ.md. Do not request tokens, mailbox keys, or vault values.