Start free with everything you actually need. Premium at $3/mo (or $24/yr — 4 months free) adds Travel Mode, encrypted attachments, NightWatch security dashboard, and AI agent connections. Family plans share Premium across the household from $6/mo. For organizations, two tiers of the SMRT protocol — free for a single domain, $99/mo for vault + identity API with live propagation and silent customer matching included.
Free forever, or go Premium for $3/month ($24/yr — 4 months free) for Travel Mode, attachments, NightWatch, and AI agents.
For individuals getting started.
For power users who want more.
Or $24/year — 4 months free (~$2.00/mo)
One subscription, everyone covered. Every plan includes Premium for each member, plus shared family vaults.
Up to 5 people. Best for most households.
$1.20/seat · $60/yr annual
Up to 8 people. Extended households.
$1.13/seat · $90/yr annual
Up to 12 people. Large households & community groups.
$1.00/seat · $120/yr annual
Annual billing at 2 months free. Family breaks even vs. individual Premium at 2 members; best value at 3+.
Two tiers of the SMRT protocol — additive, JWKS-verified, no callbacks per request. See the SMRT page for the tier overview.
Anonymous preference signals on every request from any BoxOwl user.
X-BoxOwl-Smrt) injected by the extension/attest/payment-address + /attest/payment-cardholder) with signed-JWT chargeback evidenceHard cap: 10 domains. Beyond is Enterprise.
Identified recognition + consent-gated vault REST API + live propagation + silent customer matching.
X-BoxOwl-Identity)orgUid · name · verified flag · embedded SMRT profilebxorg_*)customer.vault.user-updated fires on every consented vault change within secondstags claim rides in the Identity JWT on every visitPOST /pdaas/true/sync) + missed-events recovery (GET /pdaas/true/events?since=)payment.method PDaaS scope with bound-address attestation (last4 only, never PAN)attestation.completed + attestation.challenge.completed webhooks for continuous fraud-resistance ingestionSoft caps: 25K vaults / 15 domains / 2× included per meter (raise in admin UI). Hard caps: 100K vaults · 25 domains · 50K orgUids · 500K webhooks · 10K sync, then Enterprise.
429 cap_exceeded until your admin clicks "Raise cap" in the dashboard. New cap defaults to the next 2× tier. Every raise is logged in the audit trail.orgUid that received at least one Identity JWT in the calendar month, counted distinctly.All org plans require a registered organization. Domain verification by DNS TXT or HTML meta.
| Feature | Free | Premium | Family | Family+ | Extended |
|---|---|---|---|---|---|
| Price (monthly) | $0 | $3 | $6 | $9 | $12 |
| Annual billing | — | $24/yr (4mo free) | $60/yr | $90/yr | $120/yr |
| Members included | 1 | 1 | up to 5 | up to 8 | up to 12 |
| Secrets | |||||
| Travel Mode | — | ✓ | ✓ | ✓ | ✓ |
| Encrypted vault attachments | — | 1 GB | 1 GB/member | 1 GB/member | 1 GB/member |
| NightWatch security dashboard | Weak / reused / breach-check | Full dashboard + history | Full dashboard + history | Full dashboard + history | Full dashboard + history |
| Shared family vaults | — | — | 2 | 4 | 5 |
| Data | |||||
| Custom CSS on public profile | Included on every plan | ||||
| Shared family addresses | — | — | ✓ | ✓ | ✓ |
| Agents | |||||
| AI agent connections | 3 | Unlimited | |||
| Hermes (Mode 1 detect / Mode 2 external / Mode 3 Docker) | ✓ · all tiers | ||||
| Cloud-fallback inference (when local hardware insufficient) | — | ✓ | |||
| Cross-pillar | |||||
| Vault items | Unlimited (all plans) | ||||
| Priority support | — | ✓ | ✓ | ✓ | ✓ |
Questions about plans, family vaults, switching, or payment? See the full FAQ →
The free tier isn't a trial — it's the default. Upgrade only if you want more.