Your passwords protected.
On your device.

No. All information in your vault is stored exclusively on your own computer in a vault file encrypted with AES-256-GCM. MPLock does not operate servers to host passwords or collect telemetry on your accounts.

This is normal for independent software and does not mean MPLock contains malware. When downloading mplock_setup.exe directly from our official GitHub releases, Microsoft Defender SmartScreen may display a blue preventive screen stating that it is an unrecognized app.

This warning appears automatically because the installer is not code-signed with a commercial Extended Validation (EV) certificate (whose annual fees are high for independent projects) and is building download reputation on Microsoft's servers. Unlike applications from large corporations distributed through the Microsoft Store, directly distributed independent software goes through this routine prompt while building reputation.

MPLock's cryptographic core is open and can be inspected: its source code is available under MIT/Apache-2.0, it operates locally on your computer without telemetry or remote servers, and the mathematical details of its threat model are documented in our Cryptographic Architecture Whitepaper.

Interface language: The desktop application and the browser extension interface are currently in Spanish (an English interface is planned).

Source code & audit status: The desktop app is closed-source with an open cryptographic core (mplock-core, dual-licensed under MIT/Apache-2.0). MPLock has not been independently audited by a third party.

Support & development: MPLock is built and supported by one person (Eddie Goudet, Chile).

When you purchase your license, you receive an email with your receipt and your unique cryptographic activation key. If you misplace it, you can find it by searching for the purchase email in your inbox or by contacting us at mplocksoporte@gmail.com from the exact email address used for the purchase.

Yes. Your license is for your personal use, with no artificial device limit — activate it on as many of your own personal computers as you need (home desktop, laptop). There is no activation counter because there is no server tracking your usage; that is part of our local-first design.

No. MPLock is developed exclusively for Microsoft Windows (Windows 10 and Windows 11, 64-bit). There are no versions for macOS or Linux, and none are planned for the product.

If within the first 14 calendar days after your purchase you decide that MPLock does not meet your needs, you can request a refund by emailing mplocksoporte@gmail.com. Refunds are processed through Lemon Squeezy (Merchant of Record). When a refund is processed, the key is added to a revocation list shipped with a future app update; an installed version may keep working until then.

You can export your passwords in a generic CSV file with website, username, and password columns (and optionally notes and TOTP secrets), and import them into MPLock. Once imported, they are immediately encrypted locally with your master password. Note that for TOTP/2FA, MPLock strictly supports RFC 6238 with SHA-1, 6 digits, and a 30-second period; services requiring other parameters (such as SHA-256/512, 8 digits, or different periods) will not work.

Additionally, to back up your vault file or transfer it between your own computers, MPLock offers export and import in an encrypted backup format (.mplockbackup), protected with its own password using AES-256-GCM and 600,000 PBKDF2 iterations.

We use public-key cryptography with the Ed25519 algorithm. When you purchase a license, our licensing worker generates a digital signature with a private key. The MPLock app on your PC contains the corresponding public key and mathematically verifies that the signature is authentic without needing to connect to the internet.