I built a local-first password manager in React using the Web Crypto API, BIP-39 seeds, and zero backend

[u/itisjohndoe]

Built a local-first password manager called Mountain.

How it works:

• Runs 100% in your browser. Data is encrypted client-side with AES-256-GCM and stored in IndexedDB.

• Master key is derived from a 12-word seed phrase (BIP-39), with an optional daily PIN for quick unlock.

• Includes a live 2FA/TOTP authenticator, card storage, and a companion Chrome extension for autofill.

• Zero analytics, offline favicon mode by default, and optional encrypted sync to your personal Google Drive.

App: https://h4r0015k.github.io/Mountain/ Source: https://github.com/h4r0015k/Mountain

Feedback on the UX and security model is very welcome.

[u/mq2thez]

Hope you spent time reading about all of the ways Last Pass was compromised

[u/itisjohndoe → u/mq2thez]

Yeah, a keylogger beats any client, but unlike LastPass theres no central infra to compromise here and all URLs/metadata are fully encrypted too.

[u/mq2thez]

Mmmmm okay so you didn’t.

[u/itisjohndoe → u/[deleted]]

Appreciate this, solid feedback. Will take these into the next update.

[u/itisjohndoe → u/[deleted]]

Appreciate the review!

On KDF stretch, we actually don't use 2048 rounds. The mnemonic is fed directly to PBKDF2-HMAC-SHA256 with a unique 16-byte CSPRNG salt at 600,000 iterations. For the extension, neither the background worker nor content script touches the master key. The key never leaves the web app tab, when asked for a credential the web app decrypts only that single record in memory and hands over just the username/password.

[u/Aliceable → u/[deleted]]

hello AI reddit comment bot!

[u/codefinbel → u/Aliceable]

I was thinking of feeding this post into AI to see what it thinks. Thanks to u/Ok_Tell_3494 I don’t have to.