cout970-password-manager

A browser extension that derives your passwords instead of storing them.

Every password is recomputed from your master password and a short service code whenever you need it. The vault holds the recipe, the alphabet, the length, the algorithm, never the password itself. Nothing to leak, and the same master password on a fresh install regenerates exactly the same passwords.

For the things you cannot regenerate, recovery codes, PINs, API keys, TOTP seeds, the vault stores the value encrypted with AES-256-GCM instead.

master password + service code + alphabet + length ──PBKDF2-SHA-512──> password

Derivation is v3 (PBKDF2-SHA-512, 100 000 iterations). Modes v0, v1 and v2 still exist so vaults exported by older versions keep generating the same passwords; new items always use v3.

An alphabet is the ordered set of characters a password is drawn from. Order is part of the derivation, so editing an alphabet changes every password made from it, the UI warns before letting that happen. Built-in alphabets are immutable for the same reason; duplicate one to make your own.

Items live in groups, and each group has its own master password. One group is nominated to encrypt the vault file itself.

• The master password is never written to disk. While you are using the extension it lives in storage.session (memory only), and is forgotten after five minutes of inactivity.
• The vault file is a single AES-256-GCM blob keyed by PBKDF2-SHA-512.
• Passwords are derived on demand, in the popup, and never sent anywhere.
• The remote copy is optional and only ever receives the already-encrypted export. The service stores an opaque blob and cannot decrypt it.
• Copied passwords are cleared from the clipboard after a configurable delay, best-effort while the popup is open.