Most password managers ask you to trust a company with a copy of every password you own, sitting on their servers. Locke and Bramble both start from that same discomfort, but they solve it in almost opposite ways — Locke trusts a central vault but adds serious anti-phishing tech on top, while Bramble refuses to have a central vault at all. If you're choosing between them, the decision mostly comes down to which threat worries you more: a phishing site tricking you, or a company's servers getting breached.
Locke
Locke is a password manager built specifically to stop phishing, not just store passwords. It gives you disposable "Secure Inbox" email aliases so you never expose your real address, and its browser extension warns you in real time if a site is impersonating a real one. Passkeys are cryptographically tied to the correct domain, so a convincing fake site literally can't use them. Pricing is freemium: unlimited passwords and devices on the free plan (500MB, 1 secure box), Pro/Family at $4.99/month, and custom pricing for Business/Enterprise.
Strengths: built-in anonymous email aliases so your real address is never exposed, real-time impersonation detection via the browser extension, domain-locked passkeys that a phishing site can't forge, and a genuinely generous free tier (unlimited passwords and devices).
Limitations: less third-party security audit history than Bitwarden or 1Password, an inactive blog that's a weak signal on how actively the company communicates, and a less mature enterprise integration ecosystem than the established leaders.
Bramble
Bramble takes the opposite approach: instead of making a central vault safer, it removes the central vault entirely. Your devices sync passwords directly to each other over encrypted peer-to-peer connections (WebRTC), relayed through Nostr in a way that the relay itself never sees your data. There's no company server holding your vault, which means there's no company server to breach. It's fully open-source (GPLv3) and completely free — no paid tier at all.
Strengths: no central vault means no central target for a breach, solid encryption standards (AES-256-GCM plus Argon2id), end-to-end encrypted P2P sync where even the relay is blind to your data, and it's free and open-source with no catch.
Limitations: peer-to-peer sync is a less battle-tested model than established cloud sync, onboarding a new device is likely more fiddly than Bitwarden or 1Password's one-click flow, and there's no formal business or enterprise support if something goes wrong.
Locke vs Bramble at a glance
| Locke | Bramble | |
|---|---|---|
| Core idea | Central vault, hardened against phishing | No central vault at all — P2P sync only |
| Pricing | Free tier + $4.99/mo Pro/Family | Free, open-source, no paid tier |
| Anti-phishing features | Disposable email aliases, impersonation detection, domain-locked passkeys | Not a specific focus |
| Where your vault lives | Locke's servers (encrypted) | Only on your own devices |
| Best for | People most worried about being tricked by a fake site | People most worried about a company's servers getting hacked |
Pick Locke if you want a polished, freemium product with specific tooling against phishing and impersonation — the disposable email aliases alone are hard to find elsewhere. Pick Bramble if you don't want any company, including Locke, holding an encrypted copy of your vault, and you're comfortable with a younger, self-managed sync model in exchange for that. Both are solid, honest picks — neither is trying to be Bitwarden or 1Password with more features, they're each solving a specific problem those bigger tools don't.