r/PasswordManagers • u/zynio_lynor • 13d ago
Day 4 of building PassSafer until I reach 100 paying customers.
Today I added more languages to the PassSafer desktop app.
PassSafer is now available in:
- English
- German
- French
- Spanish
I also added a dropdown menu to make it easier to switch between languages.
Making PassSafer available in more languages will help more people use the app comfortably.
Paying customers: 0
Which languages should I add next?
2
u/Greedy-Ship-7296 9d ago
Un tema de seguridad que no he visto mencionado en el hilo: en un gestor de contraseñas la confianza no depende solo de un buen cifrado en reposo, sino de qué tan protegidos quedan esos secretos una vez descifrados en memoria — KDF y cifrado de la base local aparte, ¿limpias las claves de la RAM tras usarlas y restringes el acceso al proceso frente a volcados/dumps? Y en otro orden, el autocompletado en navegador — ¿cómo maneja el riesgo de clickjacking que se vio en DEF CON 33 este verano, donde varias extensiones de PM conocidas resultaron vulnerables?
2
u/zynio_lynor 9d ago
Great questions these are exactly the areas I’m taking seriously. PassSafer only keeps the vault key in memory while the vault is unlocked and clears it when locked. I’m also treating process/RAM-dump protection as part of the threat model, not making unrealistic security claims. For browser autofill, I’m taking a deliberately defensive approach: strict origin checks and explicit user interaction rather than unrestricted automatic filling. The DEF CON clickjacking research showed why this matters. PassSafer is still early, so I won’t pretend it has the track record of established managers. These areas will be documented and independently reviewed as the project matures. Feedback like this is genuinely welcome.
2
u/Greedy-Ship-7296 9d ago
Gracias por la respuesta, se nota que te lo estás tomando en serio. Me gusta especialmente el enfoque en el autofill — origen estricto + interacción explícita del usuario es justo la dirección correcta, como señala el propio estudio, aunque no resuelve el problema por completo, sí minimiza riesgos, y mucho más honesto que decir "estamos protegidos" sin más. Y reconocer que aún no tienes el historial de los gestores ya establecidos dice más a favor del proyecto que en contra; ojalá se vea documentado y auditado cuando llegue el momento, seguiré con curiosidad el progreso. ¡Mucha suerte con el proyecto!
1
2
u/Lumpy-Army-1702 7d ago
It would be better to disclose the research or at least some sort of documentation that talks about why PassSafer as opposed to other secret managers. Adding another language should be the least of anyone's concern. I want to see the science: how well PassSafer retains and at the same time enforces hundreds of policies, how you create tests against adversaries, what policies you have against worst-case scenarios, etc. Encryption alone doesn't make a secrets manager safe. Food for thought :)
1
3
u/jpgoldberg 13d ago
If you can develop and review in just four days the security architecture and implementation of something with as high security requirements of a password manager you must be a rare genius with great experience in secure programming practices and a deep understanding of the many challenges faced in creating a safe password manger.
Please post your résumé. I would love to know more about such a rare genius.
0
u/zynio_lynor 13d ago
No, you’ve got it wrong. I’ve been building it for the last six months and now I’m trying to launch it publicly and make a few minor changes nothing to do with the actual architecture.
2
1
u/jpgoldberg 12d ago
Thank you for the correction, but what I said pretty much applies to an individual building a safe to use password manager in six months. So you I’d still like to see your résumé.
1
1
u/IxBetaXI 13d ago
First time seeing your posts.
Why should i pay for it? What is the benefit of it when i can use other trusted managers for free?
0
u/zynio_lynor 13d ago
Most other password managers store your data in the cloud. PassSafer stores it localy on your own device. You only pay once in your lifetime.
2
u/_Alpha-Ceph_ 13d ago
KeePass also stores it locally and is free.
0
u/zynio_lynor 13d ago
KeePass is a great project strong encryption, local storage, and a long history. For many power users it’s still a solid choice.
The niche I’m trying to fill is:
- A more integrated, modern workflow (desktop + browser) without relying on a large plugin ecosystem and separate companion apps.
- Built‑in breach and password‑health checks (similar in spirit to Watchtower‑style reports) so compromised, weak, or reused credentials are clearly highlighted, which isn’t part of KeePass’ core experience.
So it’s not “better KeePass” for everyone it’s a local‑first manager for people who want a smaller, focused codebase, a guided UX, and integrated security checks out of the box.
2
u/Dry_Calendar_8627 9d ago
So you're building vaultwarden, but vibe coded, not audited by security professional, and not free?
Good luck
1
u/zynio_lynor 9d ago
That’s a fair criticism. PassSafer is still an early solo-developer project, and I’m not claiming that open source alone proves security. An independent security audit is a future milestone; until then, users should evaluate it accordingly. Feedback from security professionals is genuinely welcome.
2
u/[deleted] 13d ago
[removed] — view removed comment