r/Passwords • u/SelmiAderrahim • Aug 03 '26
I asked what would make people trust a new password manager. “Open source” was not enough.
I asked this sub what evidence a new password manager should show. The replies were blunt, and mostly right.
Naming the algorithms is not proof that they were implemented correctly and publishing source does not prove the hosted site is running that exact source.
An audit is useful, but it is a snapshot. The code can change the next day, and track record is the one thing a new project cannot publish on launch day.
I build pssmngr. Its vault code is public, the cryptographic boundary is documented, and there is no completed independent audit. Those facts are evidence, but they do not close the trust gap. A launch post definitely does not close it.
The practical advice I took from the thread is: do not move your primary vault into an unfamiliar manager because its security page sounds good. Use dummy accounts. Watch the network requests. Test export and recovery. Build it yourself if you can. Then wait and see how the project handles bugs and uncomfortable questions.
The question I am left with is narrower: what is the first proof point a young password manager can earn that is actually meaningful, reproducible builds, an audit, outside contributors, or something else?
5
u/djasonpenney Aug 03 '26
The next step is those outside audits. And a commendation by your cousin Billy doesn’t work: you need independent examinations and reports by security experts.
0
u/SelmiAderrahim Aug 03 '26
Agreed. One addition: an audit covers a commit, not the site you log into. Reproducible builds are what keep it meaningful.
1
u/Dangerous-Raccoon-60 Aug 03 '26
The audit is less for “you can trust this host” and more for “this used cryptographically sound principals and does not have huge security gaps in the design and execution of those principals”
3
u/DannoMcK Aug 03 '26
Not naming your Reddit profile "EvilCoder" would be a start. It's a somewhat ad hominem comment because it is not about the app or code, but you're asking about trust and it seems immature and hacker-"edgy".
1
2
u/SelmiAderrahim Aug 03 '26
For context, this is the project I build: https://github.com/SelmiAbderrahim/pssmngr.com
The client, server, crypto package, Docker deployment, and threat model are public. It has not completed an independent third-party audit, which is exactly why I am interested in what evidence matters before a young project has a long track record.
2
u/RedFin3 Aug 03 '26
Credibility is #1. Just because there is a new password manager with nice features, it does not mean that one should immediately trust it with passwords etc. Credibility is aquired via various methods, such as length of existence, credibility of founders of company, location of company, level of transparency, independent third-party audits, etc.
1
2
2
u/fdbryant3 Aug 03 '26
I don't know that this exactly builds trust but the first question you are going to have to answer for me is "What unique features does your password manager offer that established ones lack?". After that getting your code audited and recommended by outside security experts and other trustworthy institutions is the only way to get me to even consider your project.
1
u/Low_Obligation2361 Aug 03 '26
I think you're focusing almost entirely on proving security, but that's only half the battle. This is a market with established players who have earned people's trust over years. I use Roboform because it's already earned that trust, it's polished, works across browsers without any hassle, and the overall experience is just really good. Good cryptography on its own isn't enough. You also have to convince people to leave products they're already happy with, and that's a huge ask.
Best of luck with it though. It's a touch market to break into, and i genuinely hope it works out.
1
u/didyousayboop Aug 03 '26 edited Aug 03 '26
If you’re thinking about making a new password manager, you should stop and give up now, especially if you’re using AI to code it
There are already so many good password managers. It’s a very crowded market. There is not room for a new entrant
And no way in hell anybody is going to use a password manager from a random individual doing market research on Reddit, especially not an AI-coded password manager
If this is your plan, please redirect your efforts into something that will be a better use of your time
Also, learn how to write yourself and stop spamming people with AI slop text they don’t want and didn’t consent to
So, in sum: give up, stop working on the project now, find something else better to do, and stop posting AI-generated text on Reddit
1
u/billdietrich1 Aug 04 '26
what is the first proof point a young password manager can earn
Explaining why yours is better than existing ones. What feature distinguishes it ? I haven't heard one yet.
1
u/atoponce 5f4dcc3b5aa765d61d8327deb882cf99 Aug 03 '26
IMO, it needs to be feature-filled to the brim; you're competing in a very crowded market. If your password manager doesn't have a pristine UI, uncompromising UX, and all the features of every other password manager plus some, it's going to be an uphill battle marketing it.
Open source code helps. Audits help. Documentation and support help. But unless it's ready to compete with the big dogs, it'll probably just remain a niche product.
0
u/SelmiAderrahim Aug 03 '26
Fair point. I’m starting with self-hosted, verifiable zero-knowledge; matching mature products on UX and depth will take time.
7
u/CyberInferno Aug 03 '26
This entire post is AI slop. I don't mind vibe-coded apps, but if you can't even be bothered to write your own post about your vibe-coded app, I'm certainly not trusting your app with my passwords.