Not Yet Another Password Manager written in Go using libsodium

Overview

secrets

Secure and simple passwords manager written in Go. It aims to be NYAPM (Not Yet Another Password Manager), but tries to be different from others by following UNIX philosophy of doing only one thing and doing it well.

Features

  • stores your secrets encrypted at rest;
  • secrets can be anything from passwords, 2FA backup codes, diary entries to private keys;
  • does not leak count nor nature of your secrets;
  • uses an alternative easy to use secure cryptography provided by libsodium and Argon2id;
  • supports multiple vaults with different passwords;
  • has CLI and Web interface pre-built binaries for macOS, Linux and Windows, but can be compiled for many other platforms too due to usage of underlying Go language;
  • may be used as an independent Go library.

Anti-Features

  • does not sync your secrets to any cloud - you have complete control over them;
  • does not allow to recover any passwords when vault password has been forgotten - there's no built-in backdoor;
  • does not leak anything to 3rd parties - only you know about your secrets;
  • does not generate any passwords - use proper tools for that, but avoid improper ones;
  • does not auto-fill any passwords anywhere (you don't want that anyway) - it's up to you how you will fill your passwords;
  • does not have any mobile apps nor browser plugins - less possible attack vectors;
  • does not remove already existing features - always possibility to create your own fork since it is an open-source software and will be like that.

Is it secure?

Yes, as long as its underlying cryptography is not broken. However, there are no 100% secure systems and there's no way to guarantee that. All in all, I'd say that using this is more secure than using any SaaS as a password manager because everything is under your control. The most secure system is not a software itself, but it's how and where you use it.

Usage

It is possible to use secrets from command line, as a self-hosted web application or as a library.

Development

Retrieve dependencies and run tests

git clone https://github.com/jarmo/secrets.git
cd secrets
make

Background Story

I've used LastPass and mitro in the past to store my secrets, but didn't feel too secure with either of them due to security vulnerabilities and/or one of them being shut down. I've got enough of switching between different managers and decided to write my own. I did write a version of secrets in Ruby a few years ago, but decided to give Go a try due to its portability features and here's the result. I've also decided to use a cryptographic library called libsodium, which is secure and has an easy API for avoiding making stupid mistakes.

Owner
Jarmo Pertman
Jarmo Pertman
Password generator written in Go

go-generate-password Password generator written in Go. Use as a library or as a CLI. Usage CLI go-generate-password can be used on the cli, just insta

Miles Croxford 20 Jul 24, 2021
Create strong passwords using words that are easy for you to remember

Grasp Create strong passwords using words that are easy for you to remember A way to circumvent password complexity rules and restrictions while only

Luca Sepe 17 Apr 5, 2021
Container Signing

cosign Container Signing, Verification and Storage in an OCI registry. Cosign aims to make signatures invisible infrastructure. Info Cosign is develop

sigstore 717 Jul 23, 2021
Secure software enclave for storage of sensitive information in memory.

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being expos

Awn 2k Jul 14, 2021
Validate the Strength of a Password in Go

go-password-validator Simple password validator using raw entropy values. Hit the project with a star if you find it useful ⭐ Supported by Qvault This

Lane Wagner 283 Jul 19, 2021
:key: Idiotproof golang password validation library inspired by Python's passlib

passlib for go Python's passlib is quite an amazing library. I'm not sure there's a password library in existence with more thought put into it, or wi

Hugo Landau 245 Jul 15, 2021
How to systematically secure anything: a repository about security engineering

How to Secure Anything Security engineering is the discipline of building secure systems. Its lessons are not just applicable to computer security. In

Veeral Patel 6.1k Jul 23, 2021
Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories: www.shhgit.com

shhgit helps secure forward-thinking development, operations, and security teams by finding secrets across their code before it leads to a security br

Paul 3.2k Jul 22, 2021
🔑 A decentralized key derivation protocol for simple passphrase.

Throttled Identity Protocol (TIP) is a decentralized key derivation protocol, which allows people to obtain a strong secret key through a very simple passphrase, e.g. a six-digit PIN.

Mixin Network 15 Jul 10, 2021
A Go Library For Generating Random, Rule Based Passwords. Many Random, Much Secure.

Can Haz Password? A Go library for generating random, rule based passwords. Many random, much secure. Features Randomized password length (bounded). T

null 7 May 30, 2021
A light package for generating and comparing password hashing with argon2 in Go

argon2-hashing argon2-hashing provides a light wrapper around Go's argon2 package. Argon2 was the winner of the Password Hashing Competition that make

Andrey Skurlatov 12 May 15, 2021
Argon2 password hashing package for go with constant time hash comparison

argon2pw Argon2 password hashing package with constant time hash comparison Preface: Argon2 was selected as the winner of the Password Hashing Competi

Raja Bhatia 85 Jul 14, 2021