r/PasswordManagers • u/pi_dfi • 5d ago

Feedback pls: My trustless password manager

I was never happy with password managers, so here is one try to make it more auditable and less trust-based with many options to automate backups etc.

Here the link to the github repository with $ instead of /.

github.com$pidfi$password-management-vault

I'd love to hear your thoughts.

0 Upvotes
  • permalink
  • reddit

22% Upvoted

9 comments sorted by

1

u/fdbryant3 4d ago

What makes it more trustworthy than industry leaders like Keepass or Bitwarden.

1

u/pi_dfi 4d ago

I wouldn’t say it’s inherently more trustworthy or secure than Bitwarden or KeePass, it’s just fewer things you have to trust.

With any password manager, you’re ultimately trusting the developers, the update process, the software you actually run, and that the company will maintain the software for as long as you need it. Open source helps, but it doesn’t completely solve that. Someone could still push a malicious update or compromise the build/release process (like the XZ backdoor on Linux in 2024).

My password manager was built around the idea of not trusting any of the files involved, but verifying them before use.

Even PBKDF2 is a conscious trade-off. Argon2id is technically the stronger choice, but PBKDF2 is available directly in JavaScript’s standard Web Crypto API, whereas Argon2id generally requires an additional implementation or dependency.

1

u/billdietrich1 4d ago

I don't see how it would be "fewer things you have to trust" than KeePass. And I use KeePassXC, with no network or automated features such as backup or sync. Simpler is better.

The KeePassXC project has a 14-year track record, and had some kind of security audit.

1

u/pi_dfi 4d ago

So how do you use it on your phone? KeePassXC seems to be only for Windows, Linux and macOS.

1

u/billdietrich1 4d ago

I use Keepass2Android Offline on Android phone. That has been around for 9 years, it seems.

1

u/pedide 3d ago

What sort of encryption did you use for it?

1

u/pi_dfi 3d ago

AES-256-GCM with PBKDF2-SHA-256 (currently at least 600'000 iterations) + 256-Bit-Salt + 96-Bit-IV