Password Vault

A password manager is only as trustworthy as its architecture. That is why the Passwort-Tresor is built strictly zero-knowledge: every entry is encrypted on your device before it is stored anywhere. Encryption runs through your browser Web Crypto API with AES-256-GCM, and the key is derived from your master password via PBKDF2 with 1,000,000 iterations. Your passwords exist in plain text only in the moment you look at them.

The master password never leaves your device. It is not stored, not transmitted, not hashed and kept anywhere - it is used solely to derive the key locally. The honest flip side: if you forget it, nobody can reset it. No support, no reset link, not even us. That is the whole point of the architecture: what we do not know, we cannot lose or hand over.

In daily use the vault behaves like a tidy desk. Entries have a title, username, password, URL and notes, can be sorted into categories, marked as favorites and searched. The built-in generator creates strong passwords right when you add an entry, removing the classic excuse of not being able to think of one.

The security audit shows you where it hurts: weak passwords, reused passwords and entries that have not been changed in ages. That is how you work off the legacy from the era when the same password with an exclamation mark at the end was used everywhere.

Switching over does not mean starting from zero: CSV exports from LastPass, Bitwarden and KeePass import directly. In the other direction you create an encrypted JSON export as a backup - and even that leaves your device only as ciphertext.

For everyday protection there are the mechanisms you only miss once they are gone: auto-lock after a configurable idle time (5 to 60 minutes or never), and copied passwords are automatically removed from the clipboard after 30 seconds. An open vault on an unattended computer remains a risk though - even the best encryption does not protect against the colleague walking past your unlocked screen.