Password Manager

What Is a Local Password Manager

A password manager stores your logins so you only need to remember one master password. This one is different from cloud services such as Bitwarden or 1Password in one important way: there is no account, no sync, and no server. Your entries are encrypted with AES-256-GCM in the browser and saved to this browser's local storage. The encrypted blob never travels over the network, so there is no company, no breach target, and no subscription fee.

The trade-off is portability. A local vault lives in one browser on one device, and clearing site data deletes it permanently. For credentials you cannot afford to lose, keep the entries in a synced password manager as well, or store a copy of the important ones somewhere safe. This tool is ideal for shared computers, temporary workstations, testing accounts, and anyone who refuses to put their secrets in someone else's cloud.

How the Encryption Works

When you create the vault, your master password is stretched into an encryption key with PBKDF2-HMAC-SHA256 using 600,000 iterations and a random 16-byte salt. That key never leaves memory and is never stored. Every time the vault is saved, the entire entry list is serialized to JSON and encrypted with AES-256-GCM using a fresh random initialization vector, which both hides the contents and makes tampering detectable. The stored payload contains only the salt, the iteration count, the IV, and the ciphertext.

Because the key is derived from the master password and nothing else, there is no recovery mechanism. If you forget the master password, the data cannot be decrypted by you or by anyone else. That is the point: it also means nobody can reset your vault. Choose a long, unique master password and memorize it, or write it down and store it somewhere physically safe.

How to Use It

1. Create a master password of at least 8 characters. Longer is dramatically better, and a multi-word passphrase beats a short jumble of symbols.
2. Use Add Entry to save a login: site or account name, username, password, and optional notes for recovery codes or security questions.
3. Use Generate Strong Password inside the entry form when you want a fresh 20-character random password with letters, digits, and symbols.
4. Search filters the list by site, username, or notes as you type.
5. Reveal shows a password on screen, and the copy button sends it to your clipboard for pasting into a login form.
6. Lock Vault clears the decrypted data from the page. You will need the master password to open it again.

Practical Security Advice

• Use a different password for every account. Reuse is how one breach becomes ten.
• Make the master password longer than any password inside the vault. It is the single key to everything.
• Prefer the copy buttons over typing. Clipboard data is far less likely to be captured by a keylogger than a long typed string.
• Lock the vault when you step away from a shared machine. Locking discards the derived key from memory.
• Remember that local storage is readable by any script running on this origin, which is why the vault is encrypted at rest. Keep your browser and extensions trustworthy.
• Back up anything critical elsewhere. Clearing browser data, reinstalling the OS, or using private mode wipes a local vault.

For creating the credentials you will store here, pair this tool with the Strong Password Generator, and check how much punishment a password can take with the Password Strength Analyzer and the Password Entropy Calculator. For one-time codes you can keep alongside your logins, use the OTP Generator, and for encrypting text files instead of passwords, try Encrypt Decrypt.

Local Vault vs Cloud Password Manager

A cloud manager syncs across devices, fills forms automatically, and can share vaults with a family or team. A local vault offers none of that. What it does offer is a smaller attack surface: there is no account to phish, no sync token to steal, and no service that can be breached. The encrypted data sits in your own browser profile. Many people run both: a cloud manager for everyday logins, and a local vault for a handful of secrets they refuse to sync anywhere, such as recovery codes, seed phrases for hardware wallets, or credentials for air-gapped systems.

What Happens If You Forget the Master Password

Nothing can decrypt the vault without the master password, including this tool. There is no backdoor, no hint system, and no support line that can help. The only way out is to delete the vault and start over, which permanently discards every saved entry. Treat the master password with the same care as the keys to a safe: store a written copy somewhere physically secure, or use a memorable passphrase of four or more unrelated words.