What Parcel Rocket is, and why a password manager needs a way to pass things on

Most of us carry more secrets than we realise. The password to the email account that everything else recovers through. The login for the bank, the electricity supplier, the domain registrar. The recovery phrase for a crypto wallet. Where the important documents are kept, the combination of a safe, the instructions for a business that only one person really understands.

Two things are true about all of it at once: it must be very hard for a stranger to get at, and it must be possible for the right person to get at, on the day they need it. Almost every tool picks one of those and ignores the other. Parcel Rocket was built to do both.

Why storing secrets “somewhere safe” does not work

The honest answer to “where do you keep your passwords?” is usually one of these: in a notebook, in a notes app, in a spreadsheet called something innocent, in the browser, or in your head with small variations per site.

Each of these fails in a familiar way.

• A notebook is unencrypted by definition. Anyone who opens the drawer has everything, and if it is lost, so is everything in it.
• A notes app or a spreadsheet is usually synced to a cloud account protected by a single password, and readable in plain text by anyone who gets that password, by the provider, and by whoever the provider is compelled to share it with.
• The browser remembers passwords for one browser on one device, and rarely for the things that matter most: recovery phrases, PINs, the answers to security questions.
• Your head does not scale past a handful of accounts without reuse, and reused passwords are how one leaked database becomes ten compromised accounts.

A password manager fixes the first problem. It generates a different, long, random password for every site, remembers all of them, and protects the lot behind one strong password that never leaves your device. That is the part everybody agrees on.

The problem password managers do not solve

Ask a different question: what happens to that vault during the stretch - days, weeks, longer - when you cannot open it yourself?

A stay in hospital. An accident. A phone lost with the authenticator on it, a month somewhere with no signal, a flood that takes the home office with it. Circumstances nobody schedules. The people who need to keep the lights on, pay the bills, reach the accountant, manage the accounts or find the documents are locked out precisely because you did the responsible thing and locked everything down.

Some services offer an “emergency access” feature. In practice it tends to mean a single trusted contact, all-or-nothing access to the entire vault, and a waiting period you cannot tune. It is better than nothing, and it is not what most people actually want.

What people want is closer to this: these details go to my partner, that set goes to my business partner, the wallet phrase goes to my brother on a date I keep pushing forward for as long as I can, and nobody gets anything they were not meant to see.

What Parcel Rocket does

Parcel Rocket has two halves that share one encryption model.

The Password Manager is a vault for your credentials: logins, cards, identity documents, API keys, crypto wallets, secure notes. Every record is encrypted in your browser with a key derived from your vault password. The server stores ciphertext and the parameters needed to derive the key again, and nothing else. We cannot read your records. We cannot reset your vault password. That is not a policy; it is how the maths works.

Parcels are how things get passed on. A parcel is an encrypted bundle of text, files or records from your vault, addressed to one or more people, with a deadline. Until the deadline, nothing is delivered. As long as you can reach it, you extend it, and the parcel waits again. If you cannot, the recipients are notified and can open it, after answering questions that only they would know the answers to.

The pieces fit together in a way that turns out to matter:

• A deadline is the trigger, and nothing else. Parcel Rocket does not try to detect that something has happened, and you do not have to prove anything to anyone. You simply keep extending, and the moment you cannot, the process starts.
• Reminders reach you first. Before a deadline passes you are reminded by email and Telegram, and by SMS on paid plans. A missed reminder is a signal; a missed month of reminders is a decision.
• Each recipient gets their own parcel. Your partner and your business partner see different things. Nobody is handed the whole vault.
• Recipients are verified by knowledge, not by account. They do not need to sign up. They answer the questions you set, and the answers are what decrypt the parcel.
• Records come straight from the vault. Adding your bank login to a parcel is picking it from the Password Manager, not copying it into a text box.

The security philosophy, in plain words

We designed Parcel Rocket around one rule: the server must be useless to an attacker. If someone stole our entire database tomorrow, they would find names, email addresses and dates, but every secret would be an encrypted blob with no way to open it.

That rule has consequences you can check for yourself.

Encryption and decryption happen in your browser, using standard, published algorithms: Argon2id for turning passwords into keys, AES-256-GCM for records, OpenPGP for parcels. The JavaScript that does it is served unminified - parcelr.js for parcels and vault-crypto.js for the Password Manager - because a security claim you cannot inspect is just a claim.

Your vault password is never sent to us. Your recovery key, the one way back in if you forget that password, is generated on your device and shown to you once. We do not have a copy, which is exactly why we ask you to write it down.

Parcels are encrypted to the answers of your questions, not to a password stored on our side. A recipient who knows the answers can open a parcel; a recipient who does not, cannot, and neither can we.

None of this makes Parcel Rocket convenient in every way a plain notes app is convenient. You will have to remember one strong password and keep one recovery key safe. That is the trade, and we think it is the right one for the things you would put here.

Who it is for

You do not need to be running a company or holding cryptocurrency to have something worth passing on. A shared email account, the photos on a cloud drive, the login for the family phone plan, a letter you would like one particular person to read: these are exactly the kind of thing that ends up out of reach because nobody else knew the password.

Parcel Rocket is free for one parcel, which is enough to find out whether it fits the shape of your life. If it does, Premium adds unlimited parcels, larger files, SMS delivery and dates as far ahead as your subscription runs - or pay once for Lifetime.

The point was never the software. The point is that on the day it matters, the right person opens the right parcel and finds what you meant them to find.