Tool not found.
Back to Home
Self-hosted, zero-knowledge password manager with AES-256-GCM client-side encryption, mandatory TOTP 2FA, blind URL hashing, and a Flutter app across Android, iOS, web, and desktop.
Zero Password Manager is a privacy-first, self-hosted password manager built on a zero-knowledge architecture, where the vault runs on infrastructure the user physically controls — a home server, VPS, or Raspberry Pi — rather than a third-party cloud. All encryption happens client-side using AES-256-GCM before any data leaves the device, with the vault key derived via PBKDF2-SHA256 at 600,000 iterations (legacy accounts auto-migrate from 100,000). Even site URLs are never stored in plaintext — they're hashed with HMAC-SHA256, so a compromised database reveals nothing about which sites a user has credentials for. TOTP two-factor authentication is mandatory and cannot be disabled, with optional per-operation OTP gating on sensitive reads and writes, WebAuthn/FIDO2 passkey support, and biometric unlock with PIN fallback. The vault supports unlimited credentials, folders, and tags, full password history with per-entry restore, password rotation reminders, emergency access for trusted contacts, secure credential sharing without exposing the master key, CSV import from major competitors, and a complete append-only audit log of every access. The client is built in Flutter for Android, iOS, web, and desktop, backed by a self-hosted FastAPI server using SQLite. Zero Password Manager is released under the PolyForm Noncommercial License 1.0.0, which permits personal use, self-hosting, and modification but prohibits commercial use or SaaS deployment without a separate commercial license.
