Lemonade Password Manager

Browser extensions for Chrome and Firefox provide one-click autofill of passwords, eliminating the friction of manual typing or copy-pasting. The extensions integrate directly with the vault, allowing users to log into websites instantly with credentials stored in Lemonade. Complementing this is a built-in TOTP authenticator that generates time-based one-time passwords directly from stored entries. Users can scan QR codes during setup, and authentication codes appear alongside the credentials, removing the need for a separate authenticator app. This tight integration means both the password and its 2FA code are accessible from the same interface, speeding up logins and reducing the attack surface of having authentication codes on a separate device. The extensions work with any site that supports standard password fields and TOTP, making Lemonade a practical daily driver for both personal and professional accounts.

Secure sharing allows users to grant access to passwords, notes, or entire vault items without exposing the actual plaintext content. Shared items remain encrypted, and recipients can use them only within Lemonade's interface. Emergency access is another critical feature: designated trusted contacts can request access to the user's vault after a configurable waiting period, ensuring critical credentials remain available in case of an unexpected situation. Additional features include custom fields for storing arbitrary data like security questions or backup codes, secure notes for sensitive text, and a trash system with 30-day retention and full password history for recovery. Reused password detection runs locally to identify where the same password appears across multiple entries, helping users improve password hygiene without sending any data externally. All these features are available in both self-hosted and hosted versions without any premium tier restrictions.

Lemonade operates as a progressive web app (PWA) that can be installed on any device's browser, providing a native-like experience without requiring app store downloads. The workflow begins with creating an account on the hosted service or self-hosting using the open-source code and a Firebase project. After login, users can import existing data from Bitwarden, 1Password, or CSV formats. The vault uses server-side AES-256-GCM encryption, ensuring data is encrypted at rest and in transit. Biometric authentication via WebAuthn and passkeys (FIDO2) provides passwordless login, while auto-lock with configurable background timeout secures the vault when the device is unattended. Smart search allows instant retrieval of any entry by name, URL, or username. The entire experience is designed around minimal setup and maximal usability, with no bloat or unnecessary complexity. Users can export their data in plain text format at any time, reinforcing zero lock-in.

Real-world scenarios illustrate Lemonade's practical value. A full-stack developer working on multiple microservices can import each project's folder into the Env Vault, automatically importing all .env and credentials files with version tracking, then export them whenever redeploying to staging or production. A small development team can share production API keys securely without revealing the keys themselves, and the emergency access feature ensures that if a team member is out sick, a trusted colleague can retrieve credentials after a set delay. For individual developers, the password generator creates strong unique passwords for each online account, while the TOTP authenticator stores and displays 2FA codes, eliminating reliance on phone-based authenticator apps. A system administrator can configure self-hosted Lemonade on Firebase for zero cost, maintaining full control over data residency and compliance requirements while still benefiting from all features including browser extensions and secure sharing.

Lemonade is built primarily for software developers, DevOps engineers, system administrators, and technical teams who manage sensitive credentials, environment variables, and API keys. It supports multiple platforms through its web-based PWA and dedicated browser extensions for Chrome and Firefox. The tech stack relies on Firebase for the optional hosted service, while self-hosted users run the code on their own Firebase projects with typical monthly costs under $1. Pricing is straightforward: self-hosting is free under AGPLv3, and the hosted plan costs a one-time $29 for a lifetime license with no recurring fees, including managed updates and security patches. There is no feature gating, meaning all capabilities are available regardless of deployment choice. The product emphasizes transparency, portability, and zero lock-in: if the hosted service ever shuts down, users can export data and self-host the open-source code. In summary, Lemonade delivers a developer-centric, open-source password manager that securely unifies passwords, environment secrets, and authentication codes into a single encrypted vault.