Login

u/MegagramEnjoyer

r/PasswordManagers r/webdev r/sideprojects r/ShitLiberalsSay
▲ 9 r/PasswordManagers

Bramble: Open source, local-only password manager - Now on Android!

Couple weeks ago I posted about a PM that I'm developing, Bramble. Initially I released the Chrome extension, but recently I also published the Android app and iOS is pending Apple's approval. Besides that, the latest version also includes passkey storage for all platforms!

About Bramble

  • Free, open source, GPLv3 licensed
  • Local password manager, no cloud storage
  • Peer-to-peer sync between your extension and devices via a Nostr relay (can be self hosted)
  • EVERYTHING encrypted with AES-256-GCM - zero metadata leakage
  • Smart autofill (username, password, TOTP, credit cards)
  • Auto form submit for passwords of your choice
  • TOTP storage
  • Passkey storage
  • Unlock with security key (Chromium) or biometrics (mobile)
  • Import from 1Pass, ProtonPass, Bitwarden, KeePass
  • Very fine-tunable settings

Android app:

I'm still deciding whether to publish the app on Play store or simply provide the signed APK which users can sideload. Reason for that is Google's plan to lock down Android and take away ownership from its users. Read more about it here: https://keepandroidopen.com/

The app uses no Play APIs whatsoever and will perfectly perform in GrapheneOS, where I actually did all my testing.

I'm primarily building this as an alternative for cloud-based password managers who are constantly raising prices and heading towards enshitification. With Bramble you own your data.

https://github.com/flythenimbus/bramble

https://chromewebstore.google.com/detail/bramble/kmokhdhoggbdcgoepifeckhgbfakaknm

Questions, feedback, feature requests - all welcome!

reddit.com
u/MegagramEnjoyer — 3 days ago
▲ 1 r/webdev

Local-only, file-based password manager for Chromium

https://preview.redd.it/7zyoph5kig8h1.png?width=1280&format=png&auto=webp&s=85a497b506068eb11e3c806431251ab3f5bf2b64

I’m in close to completing the development of phase one of a local-only password manager. This first phase is Chromium-browser only, with plans for Firefox and mobile next. It’s completely open source and GPLv3 licensed.

Core features are:

  • Local-only, no telemetry, no cloud whatsoever
  • Vault is a single file that you store anywhere you like
  • Can import from: KDBX4, Bitwarden and 1Password
  • Store: logins with password and TOTP, credit cards, notes, SSH keys (more to come)
  • Unlock with master pass, security key or recovery code
  • Modern UI and easy to use
  • Login and credit card forms autofill (can be disabled)
  • Save new login popup (can be disabled)
  • P2P sync exists, but kinda useless until mobile apps are made

Coming after release:

  • Passkey storage
  • Export as KDBX4

Security Architecture

The security aspects are shifted to a WebAssembly Rust module which does all the crypto heavy lifting. In Rust memory is manually managed, which allows me to zero data when it’s not needed, eg. once the master password hash is derived, it is immediately zeroed from the heap. This is the heart of extension and it lives as a separate module which will later be used in the mobile app as well (and it is heavily heavily tested).

More on this in the GitHub repo where I go in depth on key derivation / unlock process.

This is a solo effort project and I don’t intend to make money out of this. My goal is to get ahead of the inevitable enshittification of the cloud password managers (I currently use Bitwarden).

I want the community to win from this and own their data. Data sovereignty is the way forward and a path to resistance in the current anti-privacy climate.

P2P Cross-device Sync

If I see interest in this PM, I will inevitably create mobile apps for it. I was looking for a no central database way to sync across devices, which is why I did the single file export to begin with, but that turned out to be a PITA with Firefox not supporting full-disk access like Chromium does. After some brainstorming, I decided to use a P2P sync approach using the Nostr relay protocol. The relay is a dumb pipe that lets your devices find each other. By default it uses my hosted Nostr instance, but you can swap it for your own or some public relay if you want (sovereignty).

This behaves similarly to how you would load Signal or WhatsApp chats into your desktop: by scanning a QR code with another device/browser, and from that point on they stay synced whenever the devices are open and in the same network. That's the important bit to keep in mind, must be in the same wifi connection. The sync method is merge, on conflict pick the latest item.

-

Check it out

https://github.com/flythenimbus/bramble

https://chromewebstore.google.com/detail/bramble/kmokhdhoggbdcgoepifeckhgbfakaknm

reddit.com
u/MegagramEnjoyer — 16 days ago
▲ 6 r/PasswordManagers+1 crossposts

Local-only, file-based password manager for Chromium

Preface:

I’m a senior software engineer with over a decade of experience. I’m deep in the data privacy and security space. I have recently shifted my attention to building local first software with data sovereignty as the main focus. I do utilize LLM for my work, but never ever do I hand off decision making or architectural decisions to the AI. I plan, review, and test everything it produces, and I wrote the core modules myself. The security-critical code especially.

-

I’m in close to completing the development of phase one of a local-only password manager. This first phase is Chromium-browser only, with plans for Firefox and mobile next. It’s completely open source and GPLv3 licensed.

Core features are:

  • Local-only, no telemetry, no cloud whatsoever
  • Vault is a single file that you store anywhere you like
  • Can import from: KDBX4, Bitwarden and 1Password
  • Store: logins with password and TOTP, credit cards, notes, SSH keys (more to come)
  • Unlock with master pass, security key or recovery code
  • Modern UI and easy to use
  • Login and credit card forms autofill (can be disabled)
  • Save new login popup (can be disabled)
  • P2P sync exists, but kinda useless until mobile apps are made

Coming after release:

  • Passkey storage
  • Export as KDBX4

Security Architecture

The security aspects are shifted to a WebAssembly Rust module which does all the crypto heavy lifting. In Rust memory is manually managed, which allows me to zero data when it’s not needed, eg. once the master password hash is derived, it is immediately zeroed from the heap. This is the heart of extension and it lives as a separate module which will later be used in the mobile app as well (and it is heavily heavily tested).

More on this in the GitHub repo where I go in depth on key derivation / unlock process.

This is a solo effort project and I don’t intend to make money out of this. My goal is to get ahead of the inevitable enshittification of the cloud password managers (I currently use Bitwarden).

I want the community to win from this and own their data. Data sovereignty is the way forward and a path to resistance in the current anti-privacy climate.

P2P Cross-device Sync

If I see interest in this PM, I will inevitably create mobile apps for it. I was looking for a no central database way to sync across devices, which is why I did the single file export to begin with, but that turned out to be a PITA with Firefox not supporting full-disk access like Chromium does. After some brainstorming, I decided to use a P2P sync approach using the Nostr relay protocol. The relay is a dumb pipe that lets your devices find each other. By default it uses my hosted Nostr instance, but you can swap it for your own or some public relay if you want (sovereignty).

This behaves similarly to how you would load Signal or WhatsApp chats into your desktop: by scanning a QR code with another device/browser, and from that point on they stay synced whenever the devices are open and in the same network. That's the important bit to keep in mind, must be in the same wifi connection. The sync method is merge, on conflict pick the latest item.

-

I need the community’s help with feedback, testing and evaluating of this extension. I’m also open to feature requests.

https://github.com/flythenimbus/bramble

https://chromewebstore.google.com/detail/bramble/kmokhdhoggbdcgoepifeckhgbfakaknm

Happy to answer any questions!

u/MegagramEnjoyer — 17 days ago