KeePassXC is a cross-platform password manager (Qt Widgets GUI plus CLI) written in C++/Qt. In production it creates, stores, and retrieves credentials in KeePass 2 (KDBX 3/4) database files encrypted with AES, ChaCha20, or Twofish and keyed by Argon2/AES-KDF through the Botan crypto library. It is entirely local-file based — no hosted backend — and adds local integrations: Auto-Type keystroke injection (X11/Wayland/Windows/macOS), YubiKey challenge-response, RFC 6238 TOTP generation, an SSH agent implementing the ssh-agent wire protocol, a FreeDesktop.org Secret Service D-Bus daemon so Linux desktop apps can read stored secrets, browser-extension access via native messaging (including passkey/WebAuthn registration and authentication), and KeeShare encrypted group sharing. The CLI (keepassxc-cli, entry point src/cli/keepassxc-cli.cpp plus src/main.cpp for the GUI) exposes the same core model for scripting: create/edit/show/search/merge databases, generate passwords, analyze HIBP breach exposure, import/export, and dump to CSV/HTML. Architecture is a modular desktop monolith: a core domain layer (src/core: Database/Entry/Group, config, clock, search, password generation, password health), a crypto layer (src/crypto: ciphers, hashes, KDFs), a stream layer (src/streams: hashed/HMAC block streams that give the KDBX format tamper-evident framing), a format layer (src/format: KDBX3/4 readers and writers, CSV parser/exporter, HTML exporter, importers for 1Password OPVault/1PUX, Bitwarden, Proton Pass, KeePass 1), and feature modules (browser, fdosecrets, sshagent, keeshare, autotype, quickunlock) that feed both GUI and CLI surfaces. Platform abstraction lives in OSUtilsBase plus per-OS AutoType/device-listener/screen-lock implementations; background work uses AsyncTask (QtConcurrent) wrappers; several plugin-like interfaces (IReportsPage, IEditGroupPage, ISettingsPage, KeyComponentWidget) allow modular extension. External dependencies: Qt 6, Botan, libsodium, zxcvbn, libusb/PCSC for YubiKey, QuaZip/minizip, and vendored ykcore C code. The test suite is extensive (~100 unit/GUI test files covering format round-trips, crypto known-answer tests, streams, merge, CLI, and browser). Notable weaknesses: heavy conditional compilation (#ifdef for KPXC_FEATURE_BROWSER/NETWORK/SSHAGENT/FDOSECRETS plus platform), near-duplicate report widgets, and a suspected early-return bug in EditGroupWidget::apply() under the browser-feature #ifdef that can skip group save logic, all of which add maintenance friction.
Mentalist is a desktop GUI application for generating custom wordlists targeting password security auditing. Built with Python Tkinter, it allows users to construct chains of operations (base words, case changes, substitutions, appending/prepending) to produce wordlists or rule sets compatible with Hashcat and John the Ripper. The application follows an MVC architecture: the model handles chain/node/attribute logic, the view manages Tkinter UI components, and the controller mediates between them. Key features include real-time word count estimation, saving/loading chain configurations, and background threading for responsive UI during intensive operations. The tool is designed for authorized penetration testing and includes bundled word lists and reference data.