The server holds nothing a password guess can open.
Lockmast keeps your passwords, 2FA codes and passkeys in an encrypted vault in your browser. Sync is optional, and the sync server stores only what it cannot read.
Get Lockmast Read the threat model
In your browser
- Name
- GitHub
- Site
- github.com
- Username
- ada@example.org
- Password
- ••••••••••••••••
- 2FA code
- 492 716
On the server
- Item
- 7f3a91c2
- Revision
- 12
- Size
- 412 bytes
9c1e 44b0 a7f2 03d8 e5b1 6a09 f37c 2d4e 81aa 5f60 c9d3 7b12 0e8f b46a 3c75 d1e9 62fb 08a4 97cd 5e31 fa0b 4c86 d27e 19b5 a3f0 6d48 e7c1 520a bb93 0f6e 84d7 31c5 7a2f e09b 46d3 c81e 5fb7 2a64 9d0c f318
What it keeps
Logins
Lockmast fills a login only when you ask, with the Fill button or Alt+Shift+L. A login saved for an HTTPS site is never filled into HTTP, and each login keeps its password history.
2FA codes
Codes show live beside the login, and filling a login copies its code. Add one by scanning the QR code on the page, which is decoded on your machine, or by pasting its link.
Passkeys
Passkeys live in the vault and sync with it. Every use needs your approval in Lockmast's own window, which can also hand the request to the browser or a phone.
It also generates passphrases and random passwords, imports a Bitwarden export with its 2FA codes and passkeys, writes an encrypted backup file and prints a recovery key. It runs in Firefox and in Chromium browsers.
What the sync server holds
Without sync, nothing leaves your browser. With it, the server holds this, and no more.
It stores
- Your email address, to sign you in with a mailed code.
- Your vault, encrypted in your browser.
- One copy of the vault key, wrapped under your recovery key, so a new browser can join.
- A label for each signed-in browser, such as “Firefox on Linux”.
It never has
- Your master password, or anything derived from it.
- The names, addresses, usernames or contents of your items.
- Advertising, analytics or tracking of any kind.
The vault is sealed with XChaCha20-Poly1305 under a key derived from your master password with Argon2id. The cryptography is written in Rust and runs in the browser as WebAssembly.
What Lockmast does not protect against
- Malware in your browser. While the vault is unlocked, a compromised browser profile or a malicious extension sees what you see.
- Losing both the master password and the recovery key. There is no back door, so the vault is gone.
- A recovery key in the wrong hands. With a copy of the server's data, the recovery key alone opens the vault. If yours may have been seen, replace it from any unlocked browser.
The threat model lists every adversary Lockmast is built against and every risk it accepts.
Open to inspection
Free software
The extension and the server are under the GNU Affero General Public License, version 3.
Reproducible build
Build the extension from source and compare it, file for file, with the published one. Nothing is minified, and no code is downloaded at run time.
Your own server
The sync server is one small program with a SQLite database. Run it yourself and point the extension at it.