cout970-password-manager by cout970

A browser extension that derives your passwords instead of storing them.

Every password is recomputed from your master password and a short service code whenever you need it. The vault holds
the recipe, the alphabet, the length, the algorithm, never the password itself. Nothing to leak, and the same master
password on a fresh install regenerates exactly the same passwords.

For the things you cannot regenerate, recovery codes, PINs, API keys, TOTP seeds, the vault stores the value encrypted
with AES-256-GCM instead.


master password + service code + alphabet + length ──PBKDF2-SHA-512──> password


Derivation is v3 (PBKDF2-SHA-512, 100 000 iterations). Modes v0, v1 and
v2 still exist so vaults exported by older versions keep generating the same passwords; new items always use v3.

An alphabet is the ordered set of characters a password is drawn from. Order is part of the derivation, so editing
an alphabet changes every password made from it, the UI warns before letting that happen. Built-in alphabets are
immutable for the same reason; duplicate one to make your own.

Items live in groups, and each group has its own master password. One group is nominated to encrypt the vault file
itself.

• The master password is never written to disk. While you are using the extension it lives in storage.session (memory
  only), and is forgotten after five minutes of inactivity.
• The vault file is a single AES-256-GCM blob keyed by PBKDF2-SHA-512.
• Passwords are derived on demand, in the popup, and never sent anywhere.
• The remote copy is optional and only ever receives the already-encrypted export. The service stores an opaque blob and
  cannot decrypt it.
• Copied passwords are cleared from the clipboard after a configurable delay, best-effort while the popup is open.

Source code available on Github https://github.com/cout970/PasswordManagerExtension