Vaultwarden is a self-hosted, open-source password manager server that provides a full Bitwarden-compatible API. Written in Rust using the Rocket web framework, it implements the entire Bitwarden client API for vault management, organizations, SSO/OIDC authentication, two-factor authentication (TOTP, WebAuthn, Duo, YubiKey, email), secure file storage, send functionality, emergency access, event logging, and push notifications. The architecture is a monolithic web service backed by Diesel ORM supporting SQLite, MySQL, PostgreSQL, and CockroachDB. File attachments are stored via an OpenDAL abstraction (local filesystem or S3). The server is deployed as a single binary or Docker container, serving its own web vault UI and an admin panel. External dependencies include the Bitwarden push relay service for mobile notifications and the upstream Bitwarden protocol for client compatibility. The codebase is well-structured with clear separation of concerns, extensive migrations, and a comprehensive Playwright test suite. It is actively maintained and widely adopted with over 68k stars.
KeePassXC is a cross-platform password manager (Qt Widgets GUI plus CLI) written in C++/Qt. In production it creates, stores, and retrieves credentials in KeePass 2 (KDBX 3/4) database files encrypted with AES, ChaCha20, or Twofish and keyed by Argon2/AES-KDF through the Botan crypto library. It is entirely local-file based — no hosted backend — and adds local integrations: Auto-Type keystroke injection (X11/Wayland/Windows/macOS), YubiKey challenge-response, RFC 6238 TOTP generation, an SSH agent implementing the ssh-agent wire protocol, a FreeDesktop.org Secret Service D-Bus daemon so Linux desktop apps can read stored secrets, browser-extension access via native messaging (including passkey/WebAuthn registration and authentication), and KeeShare encrypted group sharing. The CLI (keepassxc-cli, entry point src/cli/keepassxc-cli.cpp plus src/main.cpp for the GUI) exposes the same core model for scripting: create/edit/show/search/merge databases, generate passwords, analyze HIBP breach exposure, import/export, and dump to CSV/HTML. Architecture is a modular desktop monolith: a core domain layer (src/core: Database/Entry/Group, config, clock, search, password generation, password health), a crypto layer (src/crypto: ciphers, hashes, KDFs), a stream layer (src/streams: hashed/HMAC block streams that give the KDBX format tamper-evident framing), a format layer (src/format: KDBX3/4 readers and writers, CSV parser/exporter, HTML exporter, importers for 1Password OPVault/1PUX, Bitwarden, Proton Pass, KeePass 1), and feature modules (browser, fdosecrets, sshagent, keeshare, autotype, quickunlock) that feed both GUI and CLI surfaces. Platform abstraction lives in OSUtilsBase plus per-OS AutoType/device-listener/screen-lock implementations; background work uses AsyncTask (QtConcurrent) wrappers; several plugin-like interfaces (IReportsPage, IEditGroupPage, ISettingsPage, KeyComponentWidget) allow modular extension. External dependencies: Qt 6, Botan, libsodium, zxcvbn, libusb/PCSC for YubiKey, QuaZip/minizip, and vendored ykcore C code. The test suite is extensive (~100 unit/GUI test files covering format round-trips, crypto known-answer tests, streams, merge, CLI, and browser). Notable weaknesses: heavy conditional compilation (#ifdef for KPXC_FEATURE_BROWSER/NETWORK/SSHAGENT/FDOSECRETS plus platform), near-duplicate report widgets, and a suspected early-return bug in EditGroupWidget::apply() under the browser-feature #ifdef that can skip group save logic, all of which add maintenance friction.
This is the official Bitwarden password manager for Android, a production-grade Kotlin application with a modular monorepo structure. It implements a full-featured password manager including vault management (ciphers, folders, collections, sends), autofill (standard and accessibility-based), FIDO2/WebAuthn passkey support, TOTP authenticator, password/username generator, secure credential exchange (CXF), and enterprise features like SSO, Duo, and policy enforcement. The architecture follows an MVVM pattern with Jetpack Compose UI, Dagger/Hilt dependency injection, Room SQLite for local persistence, Retrofit/OkHttp for networking, and the Bitwarden SDK for cryptographic operations. The codebase is organized into multiple Gradle modules: `app` (main app), `authenticator` (standalone TOTP app), `authenticatorbridge` (AIDL-based cross-app communication), `network` (API client), `data` (data sources and repositories), `ui` (reusable Compose components), `core` (platform utilities), `cxf` (credential exchange), and `testharness` (Credential Manager API testing). Key entry points include `MainActivity`, `CredentialProviderActivity`, `AuthCallbackActivity`, and `BitwardenApplication`. Data flows involve syncing vault data from Bitwarden servers to local Room databases, processing autofill requests from other apps via Android's Autofill and Credential Manager frameworks, and securely sharing TOTP secrets between the main app and authenticator app via the encrypted bridge. External dependencies include the Bitwarden SDK, AndroidX libraries (Compose, Navigation, Room, Biometrics, Credentials, etc.), Retrofit, OkHttp, kotlinx.serialization, and optional Firebase for push notifications and crash reporting.
This repository is a curated collection of website-specific 'quirks' (hard-coded behaviors) for password managers, maintained by Apple. It contains structured JSON datasets including password rules (to generate compatible passwords), shared credential relationships (domains that share login backends), change-password URLs, 2FA appending sites, and web browser extension distribution information. The repo also includes reference implementations: a Password Rules language parser (JavaScript) and a regex-to-Password-Rules converter, along with validation and formatting scripts. While primarily a data curation project, the tools are reusable components for any password manager implementation. The data is validated against JSON schemas and linted in CI, ensuring high quality. The repository is actively maintained with frequent contributions from the community.
git-credential-keepassxc is a Rust-based Git credential helper that enables Git and shell scripts to store and retrieve credentials from KeePassXC. It implements the KeePassXC browser protocol to communicate with the password manager via socket/named pipe interfaces. The application provides subcommands for getting credentials (get), generating TOTP codes (totp), storing credentials (store), managing configuration (configure), verifying caller identity (caller), and other auxiliary functions. It features optional security enhancements including strict caller verification, YubiKey-based encryption of configuration files, and desktop notifications. The architecture follows a modular Rust CLI pattern with clear separation between argument parsing, configuration management, core protocol implementation, and utility functions.
PearPass Desktop is an Electron/React password manager with a local-first architecture: encrypted vaults are stored on-device and synchronized peer-to-peer through Pear Runtime, with no central cloud account. The renderer is a large React application handling vault/record CRUD (logins, credit cards, identities, notes, Wi-Fi, passphrases, custom fields), folders, favorites, TOTP authenticator codes, import/export from other password managers, and extensive settings. The Electron main process spawns a Bare-sidecar vault worklet, exposes a preload bridge, and coordinates secure native messaging with a browser extension. The repo also includes Flatpak/Snap/AppImage/MSIX packaging, an Appling installer, and a Playwright E2E suite. Security is taken seriously: there is an encrypted session handshake (X25519 ECDH, Ed25519 transcript signatures, secretbox, sequence numbers), a method registry separating public vs secure IPC methods, master-password verification, auto-lock, and platform-specific clipboard cleanup. The codebase has extensive Jest unit coverage and Playwright E2E coverage for every record type. However, much of the actual vault crypto and UI kit logic lives in internal @tetherto packages, making this repository primarily application glue around private dependencies. Maintainability is mixed. The README explicitly states development is paused, and there are signs of drift: mixed JS/TS, duplicated attachment/schema logic across many modal forms, a frozen legacy UI component tree, commented-out E2E tests, a likely bug in pairing-token hash construction, and feature stubs marked UNSUPPORTED. It remains a well-organized and functional password manager, but a significant refactor would be needed to fully modernize it.
This is an Emacs major mode for managing the password-store (pass) keychain. It provides a directory-tree buffer listing password entries and directories, with keybindings to copy passwords, usernames, and URLs to the kill ring, edit, rename, delete, insert entries, and browse URLs. The package integrates with password-store-otp for two-factor authentication, displaying OTP tokens and countdown timers in entry view buffers. The architecture is a single-file Emacs Lisp library defining two major modes: `pass-mode` for the main store buffer and `pass-view-mode` for viewing individual encrypted files. It relies on external Emacs packages `password-store`, `password-store-otp`, and `f`, and ultimately the system `pass` CLI. The code is well-structured, follows Emacs Lisp conventions, uses macros for common patterns, and provides proper configuration options. However, the test suite is essentially empty, which limits confidence in long-term stability. The package is published on MELPA and integrates with common Emacs workflows, making it a practical tool for password management within Emacs.