PassRepo
A zero-knowledge password vault where passwords are encrypted on the device and the server never sees the contents.
Not having to trust the server
In a password manager, the vault should stay unreadable even if the server is compromised.
Encryption only on the client
I did key derivation with Argon2id and encryption with XChaCha20-Poly1305 entirely on the device; the server only syncs the encrypted vault.
Client-side encryption
Argon2id key derivation, XChaCha20-Poly1305 encryption.
Lock
PIN and biometric lock.
Recovery kit
A recovery kit if the master password is forgotten.
Sync
Vault sync through its own server or WebDAV.
QR web login
Sign in on the web by scanning a QR with the phone vault.
Browser extension
A Manifest V3 extension paired with the phone.
Why zero knowledge
Everything sent to the server is encrypted. The master password never leaves the device; nobody without it, the server owner included, can open the vault.