LSPV v0.2.6

Local Security Pass Vault (LSPV) — v0.2.6

A local-first password manager built in Rust. Your vault never leaves your machine — no cloud, no accounts, no subscriptions, no telemetry.

Downloads

Platform	File
Windows	Local.Security.Pass.Vault_0.2.6_x64-setup.exe
Linux	Local.Security.Pass.Vault_0.2.6_amd64.AppImage
macOS	Local.Security.Pass.Vault_0.2.6_aarch64.dmg

---

What LSPV does

Core Vault

• Zero cloud, zero telemetry — no background network activity, no analytics, no update pinging. The only network call the app ever makes is a manual, opt-in HaveIBeenPwned breach check on a single password.
• Multi-vault — separate encrypted databases for work / personal / family
• 6 item types — Login, Card, Note, Identity, SSH Key, Server
• Favorites, folders, source tagging — organize and filter the sidebar
• Encrypted-index search — instant search without decrypting every record

Security & Password Management

• Argon2id + XChaCha20-Poly1305 + SQLCipher — the vault is encrypted at rest with a memory-hard KDF (256 MB, 4 iterations) and authenticated encryption on every record
• Vault-unlock 2FA — require a TOTP code after the master password to open the vault at all
• Per-item TOTP codes — live 6-digit codes with a countdown ring, scan a QR straight from the clipboard
• Password generator — 8–64 chars, configurable character classes, entropy meter
• Password health report — one-click scan for weak, duplicate, and stale (>6mo) passwords
• Custom fields — hidden or visible fields on any Login entry
• Password history — every past password kept with a timestamp
• HaveIBeenPwned breach check — k-anonymity: only a 5-character hash prefix ever leaves the device
• Clipboard TTL — copied passwords clear after 30s, excluded from Windows Cloud Clipboard sync
• Screen-capture protection — the window is excluded from screenshots/recording while a password is shown in plaintext

Backup & Recovery

• BIP-39 24-word seed phrase — 256-bit entropy, shown once, never written to disk
• Encrypted .vbk backups — XChaCha20-Poly1305 + BLAKE3 integrity check
• Auto-backup rotation — 7 most recent copies kept automatically

Data Portability

• Import — Bitwarden JSON, Chrome/Firefox CSV
• Export — Chrome/Firefox-compatible CSV
• Trash bin — soft-deleted items are recoverable until purged

Browser Extension (Chrome, Edge, Firefox)

• Auto-fill — matched by eTLD+1 domain, filled via the native input setter (never touches browser autofill history)
• Ed25519-signed IPC — every message between the extension and the desktop app is signed and verified; a pipe-squatting attacker gets nothing usable
• Zero network — connect-src 'none' in the CSP; there is no code path in the extension that can reach the internet

OS Integration

• OS Keychain storage — the unlocked vault key lives in Windows Credential Manager / macOS Keychain / libsecret while the vault is open
• Auto-lock — configurable idle timer, lock-on-minimize, lock-on-screensaver
• System tray + optional autostart
• Process hardening — Windows DEP/CFG mitigations and DLL-hijacking protection, Linux seccomp-BPF syscall filtering, an owner-only-DACL named pipe on Windows and a $XDG_RUNTIME_DIR-scoped Unix socket on Linux/macOS
• Ransomware honeypot — a decoy file whose integrity is checked on every unlock; tampering triggers an immediate lockout warning

Appearance

• Dark / Light / System theme, live switching
• 8 accent-color presets plus a custom picker

---

What changed in this build

This release closes findings from a deep, multi-pass security review of the whole codebase (crypto core, desktop app, native messaging host, browser extension):

• Fixed: the browser extension's search/autofill was broken on Windows — vault decryption failed because the IPC handler bypassed the code path that unprotects DPAPI-encrypted keys between commands
• Fixed (security): the extension's Ed25519 signature check could be bypassed for forged responses sent before a signing key was pinned — closed so any credential-bearing response must now be validly signed once pairing has happened
• Hardened: TOTP brute-force protection is now a shared, persistent lockout instead of a counter that reset on reconnect
• Hardened: the Unix IPC socket moved off world-visible /tmp to a per-session, permission-restricted runtime directory
• Fixed a crash on non-ASCII card numbers / SSH key comments, corrected inaccurate "zero network" wording across the docs, and cleared a dependency advisory (anyhow)

Full technical changelog: CHANGELOG.md

License

Releases through v0.2.6 are MIT (see LICENSE-MIT). Releases after v0.2.6 move to the Business Source License 1.1 — free to read, self-host, and use (including inside a business); restricted from being resold as a competing product; converts automatically to GPL after 4 years.