Local Password Manager

What "stored locally" really means here

Most password managers you've heard of — Bitwarden, 1Password, your browser's built-in one — keep an encrypted copy of your vault on a company's servers so it can sync between your phone and laptop. This tool does something deliberately narrower: every entry you add lives in your browser's localStorage, a small key-value store tied to one browser on one device, under the key pm_local_vault_v1. Nothing is ever transmitted, and there is no account to create. You can prove it by opening the tool, adding an entry, then disconnecting from the internet — everything still works, because there is no server in the loop at all.

The flip side of that privacy is its biggest limitation: your vault does not follow you. Open the page in a different browser, on a different computer, or in a private/incognito window, and the vault will appear empty. Clearing your browsing data, or a browser that auto-purges site storage, will erase it for good. That makes this tool a fit for low-stakes, single-device convenience — not a replacement for a synced, audited manager holding your bank and email logins.

How the optional master-password encryption works

If you leave the master-password field blank, each password is simply Base64-encoded before being written to storage. Base64 is not encryption — it's a reversible text encoding, so anyone who opens your browser's developer tools can decode it in one step. Setting a master password switches on a light XOR cipher: every character of the password is combined with a character of your master key using the bitwise XOR operator, cycling through the key for strings longer than it, and the result is then Base64-encoded for storage.

A concrete look at the mechanism: XOR with a key of K turns the byte for A (65) into 65 ⊕ 75 = 10, an unprintable character. Apply the same key again and 10 ⊕ 75 returns 65 — the original. That self-reversing symmetry is why the same master password both locks and unlocks the vault. The honest caveat is that a short, repeating XOR key is trivially breakable by anyone who knows cryptanalysis; it stops a casual glance at localStorage from showing plaintext, and nothing more. For anything you truly care about, use a manager built on a vetted algorithm like AES-256.

A worked example of a session

1. You type a master password and click Unlock. The tool reads the stored vault, XOR-decrypts each password with your key, and shows how many entries it loaded.
2. You click + Add Entry, fill in Site = GitHub, Username = you@example.com, a password, and an optional note, then Save. The entry is re-encrypted and written back to localStorage immediately.
3. Later you type git in the search box. The list filters live by matching the text against site and username fields (case-insensitive), so GitHub surfaces instantly.
4. You click Copy next to the password; it goes to your clipboard via the browser's clipboard API. Show reveals the masked value when you need to read it.

Backing up with CSV export

Because the vault is locked to one browser, an occasional export is your safety net. Export CSV writes every field — site, username, the plaintext password, notes, and a creation timestamp — into a standard comma-separated file with quoted fields, downloaded as passwords.csv. Spreadsheet apps open it directly, and most other password managers can import this format. Treat that file with care: it is unencrypted by design so other tools can read it. Store it somewhere safe (an encrypted disk image or archive), and delete stray copies from your Downloads folder once you've moved it.

Common mistakes to avoid

• Forgetting your master password. There is no recovery. The key only exists in your head; lose it and the stored ciphertext becomes permanently unreadable.
• Assuming it syncs. Entries added on your laptop will not appear on your phone. Export and re-import if you need them elsewhere.
• Relying on it for critical accounts. The XOR encryption is intentionally lightweight. Keep banking, primary email, and work logins in a dedicated, audited manager with real key-derivation and zero-knowledge sync.
• Leaving the CSV lying around. The export is plaintext. Move it to encrypted storage and clear the unprotected copy.
• Using a shared or public computer. Anyone with access to that browser profile can open the vault — especially with no master password set.