When I started building Krypt, I made one fairly unusual decision: it wouldn't have a backend.

No accounts. No cloud database. No sync server. No API storing or processing users' vaults.

I expected that decision to become a problem eventually. Password managers are fairly sophisticated applications, and I assumed I'd reach a point where some important feature simply couldn't work without a server.

That point never really came.

What actually needs a server?

Less than I thought. Passwords, notes, photos, documents, and TOTP secrets can all be encrypted and stored locally. Password generation, search, and Face ID all run on-device. Krypt even has a second decoy vault with its own PIN — still local.

The biggest test was Password AutoFill. I expected integrating with iOS and filling credentials inside other apps to finally require some kind of service in the middle. It didn't: Apple's credential provider extension mechanism lets Krypt hand off credentials to AutoFill directly, inside the extension's own sandbox, without the request ever leaving the device.

By that point I had a password manager with encrypted passwords, notes and files, TOTP codes, Face ID, a decoy vault, encrypted backups, and system AutoFill. The backend was still zero.

Removing the backend removed some problems too

I can't leak a database of my users' vaults because I don't have one.

That's the whole security model, really. There's no cloud database to misconfigure, no authentication endpoint to attack, and no server breach capable of exposing thousands of vaults at once. That doesn't make the app invulnerable — local encryption still has to be implemented correctly, and the device itself still matters — but the entire category of "the company got breached" simply doesn't apply.

There's also nothing to go down. If my server is unavailable, Krypt doesn't care. There isn't one. And the infrastructure bill is equally uncomplicated: $0.

Of course, there's a catch

Removing the backend means giving up some genuinely useful things.

There's no seamless cloud sync between five devices. There's no server-side account recovery. If you lose your phone, I can't pull a copy of your vault from a database on my end — because that database doesn't exist.

The tradeoff shows up concretely in backups: instead of your vault silently syncing to a server in the background, you export an encrypted backup file yourself and put it wherever you trust — iCloud Drive, a second device, a USB drive. It's an extra step, and it puts the responsibility on you instead of on me. But it also means the only copies of your vault that exist are copies you chose to make.

That isn't necessarily better than a cloud password manager. It's a different tradeoff. Cloud password managers optimize for availability. An offline vault optimizes for containment.

That distinction became much clearer to me while building Krypt. I originally thought "offline" simply meant the app worked without an internet connection. It means something stronger than that: an offline vault isn't a cloud vault with sync turned off. There is nowhere for it to sync to.

Building by subtraction

This reminded me of something else I discovered while building Krypt: the original app was about 3 MB. I hadn't deliberately set out to make a tiny password manager — it happened largely because I built it natively and didn't add layers I didn't need.

The backend ended up being the same experiment on a larger scale. How much infrastructure does an iPhone password manager actually need? I started with zero and waited until the product gave me a reason to add some.

So far, it hasn't.

And I'm beginning to think that's the more interesting way to build software: not asking what else you can add, but occasionally asking what you can remove.