Show HN: What I learned building a local-only password manager (PassForgePro) | Hacker News Reader

Show HN: What I learned building a local-only password manager (PassForgePro)

github.com

5 pointscan-deliktas3 comments

Show HN: What I learned building a local-only password manager (PassForgePro)

Hi HN,

I built PassForgePro as a learning project to better understand password manager design, local-first security, and common cryptographic pitfalls.

The goal was not to replace mature tools like Bitwarden or KeePass, but to explore:

* how a local-only, zero-knowledge style design can work * key derivation with PBKDF2 and encrypted SQLite vaults (AES-256-GCM) * handling sensitive data in memory and clipboard cleanup * defining a realistic threat model and its limitations

This project is experimental and unaudited. I’m sharing it mainly to get feedback on the architecture, crypto choices, and overall approach, and to discuss what I got wrong or could improve (audits, reproducible builds, testing, etc.).

I’d really appreciate feedback, especially from people with security or cryptography experience.

Repo: https://github.com/can-deliktas/PassForgePro Docs / demo: https://can-deliktas.github.io/PassForgePro

Open articleView on HN

The README talks a lot about crypto. But the interesting bit is how you can access the passwords. Is there an API? If yes, how does it protect your passwords from malicious software? If not -- are you sure? (Have you checked for example accessibility APIs by the platform?)

PassForgePro does not have any API for accessing passwords. It’s a local-only, offline-first project. There is no remote service, no API endpoint, no cloud sync, and no server communication at all.

All passwords are stored in an encrypted local SQLite vault with AES-256-GCM, and the key is derived using PBKDF2. Decryption happens only in memory after the vault is unlocked by the user.

You can find more information about how the project works and its security model in the FAQ: https://can-deliktas.github.io/PassForgePro/faq.html

There is no interface that exposes secrets outside the app. When I talk about cryptography and design in the README and FAQ, the focus is on local protection, not on a remote API.

As I mention in the FAQ, PassForgePro is an experimental learning project, not a production-grade password manager. It does not claim to defend against a fully compromised OS or malicious local software — that’s outside its threat model.

So if someone assumes there must be an API or external access, that assumption doesn’t match the actual architecture.

OPEN SOURCE Code: https://github.com/can-deliktas/PassForgePro/blob/main/PassF...

https://coderlegion.com/10449/passforge-pro

Reply on news.ycombinator.com