Password vault
Keep logins, notes and account details together. Find what you need without searching through old messages.
Open your vault One account · your devices
Your digital life,
quietly kept.
Passwords, notes and authenticator codes in a single vault. Sign in with the same PassGram account on Android, Windows and the web.
Encrypted before it leaves your device
Your vault
12 itemsAll items
GooglePersonal account
GitHubwork@passgram
MailPersonal
Private by designYour encrypted vault stays yours.
Encrypted vault
Across your devices
Made for everyday
AndroidWindowsWeb
Less to remember
Everything important,
easy to reach.
A clear home for the details you use every day, with security built into the experience — not bolted on later.
Authenticator
Generate sign-in codes in the same place you already manage your accounts.
See the appsOne account
Use PassGram on Android, Windows and the web. Sign in once at the official web app.
Sign in to PassGramMobile quick guide
Everything in your pocket.
Swipe through the essentials. Each card is a short, practical walkthrough you can finish in under a minute.
1
Install the app
Download PassGram for Android from the Apps tab, open it and sign in with your account. Allow notifications so login codes can reach you instantly.
2
Turn on biometrics
Enable fingerprint or face unlock in Settings. Codes and sensitive entries stay hidden until you confirm it is really you.
3
Scan to sign in
On any computer, open web.zpas.org and scan the QR code with the in-app scanner. Check the device and city shown, then approve.
4
Review and end sessions
Open Settings, then Devices to see every signed-in browser. End anything you do not recognise with one tap.
What if I lose my phone?
Sign in from another device you trust, open Devices and end the lost phone's session. Then change your password. Because new logins need approval on a device you already own, a stolen password alone is not enough.
Does it work offline?
Your vault entries on the phone can be opened without a connection. Signing in to the web, receiving codes and syncing need an internet connection.
Will notifications show my code?
No. Lock-screen notifications stay generic. The six-digit code appears only inside the app after you confirm with biometrics or your PIN.
How much battery or data does it use?
Very little. PassGram only wakes up when a login request arrives or when you open it, and messages are tiny.
Why PassGram
One calm place for everything you
sign in to.
Most of us juggle dozens of accounts, hundreds of passwords and a pile of verification codes spread across browsers, notes apps and screenshots. PassGram brings those pieces together so that signing in becomes quick, predictable and safe, whether you are on your phone, at your desk or on a borrowed computer.
PassGram starts from a simple idea: security tools should be pleasant enough that you actually use them. Instead of reusing the same password because remembering a new one is tedious, you let the vault create a long, random password for every service and fill it in for you. Instead of hunting for an authenticator app, your one-time codes sit next to the account they belong to.
Your account works across Android, Windows and the web. Sign in once on the official web app at web.zpas.org and you get the same familiar, chat-style interface you see on your phone. Everything is designed around clear screens, large touch targets and as few steps as possible between you and the thing you need.
We are also deliberate about what we do not do. Sensitive actions, such as approving a new browser or revealing a one-time code, are confirmed on the device you already own and trust, so a stolen password alone is not enough to take over an account.
3platforms: Android, Windows and the web, all on one account.
6-digitone-time codes delivered to your app, not by SMS.
10 minlifetime of a QR sign-in code, usable exactly once.
0passwords you have to remember besides your own.
How it works
Sign in to the web in
seconds, not minutes.
PassGram Web gives you two ways to sign in. Both are confirmed by your phone, so you never have to type a long password on a shared or unfamiliar computer.
Open web.zpas.org
Visit the official web app. You will see a QR code, and below it the option to continue with your phone number or email address. Always check that the address in your browser reads web.zpas.org before you continue.
Scan the QR code with the app
Open PassGram on your phone, choose the scanner and point it at the code on your screen. The app shows which browser and approximate location is asking to sign in, so you can decide whether it is really you.
Or receive a code inside the app
If you prefer to type your number or email, PassGram sends a six-digit code straight to the app on your phone instead of an SMS. The code is only revealed after you confirm with your fingerprint, face or device PIN, and it expires after one minute.
Review new logins in your security inbox
Every time a new device signs in, a notice is added to the security activity area of the app with the device name, location and time. If anything looks wrong you can end that session straight from Settings, then Devices.
Security you can read
Careful by default,
clear about the details.
We would rather explain how sign-in protection works than hide behind buzzwords. These are the principles the web app and the mobile app are built around.
1
Codes that live briefly
QR sign-in codes expire after ten minutes and work only once. As soon as a code is used, it is consumed on the server and cannot be replayed, even if someone photographed your screen afterwards.
App sign-in codes are stored only as a one-way hash and are limited to a handful of attempts before they are locked.
2
Approval on your own device
A new browser is never trusted on its own. The request is shown on your phone, and the code itself is revealed only after biometric or PIN confirmation, so someone holding your unlocked phone for a moment still has to prove who they are.
3
Sessions you can end
Each signed-in browser appears in your device list. Ending a session signs that browser out quickly, and a device that has been ended cannot quietly sign itself back in.
4
Location without tracking
When you allow it, your browser shares an approximate position so the login notice can show a city and country. We round it before sending and do not hand it to third-party map services. If you decline, we simply show that the location is unavailable.
5
Private by design
Secrets are protected before they are stored, and sign-in challenges are kept in server-only data that browsers cannot read or modify directly. Access rules are written to deny everything that is not explicitly needed.
6
Honest notifications
Notifications on your lock screen stay generic. The sensitive six-digit code is never printed in the notification text, so it cannot be read over your shoulder or captured by a screenshot of your notification shade.
Everyday life
Built for the moments
you actually have.
At home and at work
Keep personal and work logins separate while still reaching both from one account. Search finds an entry in a couple of keystrokes, and a favorites list keeps the accounts you open daily within a single tap.
On a computer that is not yours
Need to check something from a friend's laptop or an internet cafe? Open the web app, approve the sign-in from your phone, and end the session when you are finished. Nothing needs to be installed, and nothing needs to be remembered.
When you change phones
Because your account is not tied to a single screen, moving to a new device is a matter of signing in again and approving it. Your old session can be ended from the device list so that nothing is left behind.
For developers
If you build tools of your own, the developer pages explain the planned bot interface, how tokens should be handled and what is already available today. They are written to be read from top to bottom, with examples you can adapt.
Your devices
Take PassGram
where you are.
Use the app that fits your day. Your web account lives at web.zpas.org.
View apps
For builders
Build with
PassGram.
Explore the developer API and bot tools from one place. Bot creation and token management require the PassGram bot service to be enabled for your account.
Explore the APIBot API · preview
POST /bot<token>/sendMessage
{
"chat_id": "…",
"text": "Hello from PassGram"
} Developer documentation preview
What’s new
Recent updates
A more connected PassGram
Update the Android app for the latest account features.
Explore AndroidYour desktop vault
Keep the password vault close on your Windows PC.
Explore WindowsYour account, in the browser
Sign in to the web app with the same account as the mobile app.
Open web.zpas.orgWhat we stand for
Principles we build
every feature around.
These are the promises behind the product, in our own words. Each one links to the page where you can see the detail.
Your secrets should be locked before they ever leave your device.
Private by designVault data is protected before it is stored, and sign-in challenges live in server-only data.
Read about safety
A new browser should always have to ask the phone you already trust.
Approval on your deviceQR codes last ten minutes and work once. App codes need your fingerprint, face or PIN.
See how sign-in works
You should be able to see every login and end any session in one tap.
Full visibilityEvery new device appears in your security activity with its name, location and time.
Get the apps
Ready to try the calmer way to sign in?
Open the web app, scan the code with PassGram on your phone and you are in. It takes less time than typing a long password, and it is safer too.
Open PassGram Web