Skip to content

LocalPass v0.1.0 (MVP preview)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@RMV-Coder RMV-Coder released this 10 Jul 15:51
· 58 commits to main since this release
v0.1.0
cc3e52c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LocalPass is a fully local, open-source password & secrets manager with a developer focus — .env secrets, API keys, SSH keys, TOTP, and sync across your own machines with no cloud.

⚠️ Pre-1.0 — do not store real secrets yet. This is the first tagged milestone (MVP). It is not independently audited and the on-disk format may still change before 1.0. Use it for evaluation only. There is no cloud reset: losing your master password, Secret Key, and devices means the data is gone by design.

Highlights

  • Local-only, encrypted at rest — XChaCha20-Poly1305 under a key hierarchy rooted in your master password and a locally generated 128-bit Secret Key, so a stolen vault file can't be brute-forced offline. Every ciphertext is bound to its exact vault/item/version (no cut-and-paste), and every change is a signed, hash-chained operation.
  • Desktop app (Tauri + Svelte) — create your account, browse/search, item CRUD, reveal/copy, live TOTP, password/passphrase generator, .env secure documents, encrypted file attachments, and device linking + sync. The app bundles the daemon and starts it automatically.
  • CLI (localpass) — init/vault/item/search/generate, run/env secret injection into dev servers, totp, ssh (vault-backed SSH agent), backup, import/export, sync, device, kit.
  • Vault-backed SSH agent — serves your stored SSH keys on the OpenSSH-compatible endpoint; keys never leave the daemon.
  • Sync across your own devices — signed op-log with deterministic merge, file-based shipping, cross-device key sharing, and content-addressed encrypted attachment blobs. (Live LAN/mDNS transport is a documented follow-up.)
  • Cross-platform — CI green on Windows, Linux, and macOS.

Install (Windows)

Download LocalPass_0.1.0_x64-setup.exe (NSIS) or the .msi below and run it. The daemon ships inside the installer and auto-starts — nothing else to set up.

The installer is unsigned (pre-1.0), so Windows SmartScreen shows an "unrecognized app" prompt → More info → Run anyway.

Other platforms / from source: see the README — cd apps/desktop && npm run bundle produces the installer for your OS.

Verify the download (SHA-256)

Because the installer is unsigned, verify its checksum against SHA256SUMS.txt before running (Get-FileHash .\LocalPass_0.1.0_x64-setup.exe):

79f69e92784d5d3df45de7d1b913000686eb64c412b9118b3a77314ca85bcbd1  LocalPass_0.1.0_x64-setup.exe
8a2511c70b2da660b25fae45621542681035a93cc52684494e6666175a3bacd4  LocalPass_0.1.0_x64_en-US.msi

Notable fixes since the MVP

  • Cross-platform daemon transport (macOS getpeereid, per-username Unix socket, Linux stop-race handling).
  • Forward-only migration for vaults created before attachment sync (created_at column).
  • GUI: live vault-count refresh, and editing an env-set now loads its existing variables instead of silently replacing them.

Security

See SECURITY.md for the threat model and disclosure process. Again: not yet audited — don't put real secrets in it.

🤖 Release notes generated with Claude Code

Assets 5
Loading