Skip to content

LSPV v0.2.6

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jul 19:00
v0.2.6
3b33a63

Local Security Pass Vault (LSPV) — v0.2.6

A local-first password manager built in Rust. Your vault never leaves your machine — no cloud, no accounts, no subscriptions, no telemetry.

Downloads

Platform File
Windows Local.Security.Pass.Vault_0.2.6_x64-setup.exe
Linux Local.Security.Pass.Vault_0.2.6_amd64.AppImage
macOS Local.Security.Pass.Vault_0.2.6_aarch64.dmg

What LSPV does

Core Vault

  • Zero cloud, zero telemetry — no background network activity, no analytics, no update pinging. The only network call the app ever makes is a manual, opt-in HaveIBeenPwned breach check on a single password.
  • Multi-vault — separate encrypted databases for work / personal / family
  • 6 item types — Login, Card, Note, Identity, SSH Key, Server
  • Favorites, folders, source tagging — organize and filter the sidebar
  • Encrypted-index search — instant search without decrypting every record

Security & Password Management

  • Argon2id + XChaCha20-Poly1305 + SQLCipher — the vault is encrypted at rest with a memory-hard KDF (256 MB, 4 iterations) and authenticated encryption on every record
  • Vault-unlock 2FA — require a TOTP code after the master password to open the vault at all
  • Per-item TOTP codes — live 6-digit codes with a countdown ring, scan a QR straight from the clipboard
  • Password generator — 8–64 chars, configurable character classes, entropy meter
  • Password health report — one-click scan for weak, duplicate, and stale (>6mo) passwords
  • Custom fields — hidden or visible fields on any Login entry
  • Password history — every past password kept with a timestamp
  • HaveIBeenPwned breach check — k-anonymity: only a 5-character hash prefix ever leaves the device
  • Clipboard TTL — copied passwords clear after 30s, excluded from Windows Cloud Clipboard sync
  • Screen-capture protection — the window is excluded from screenshots/recording while a password is shown in plaintext

Backup & Recovery

  • BIP-39 24-word seed phrase — 256-bit entropy, shown once, never written to disk
  • Encrypted .vbk backups — XChaCha20-Poly1305 + BLAKE3 integrity check
  • Auto-backup rotation — 7 most recent copies kept automatically

Data Portability

  • Import — Bitwarden JSON, Chrome/Firefox CSV
  • Export — Chrome/Firefox-compatible CSV
  • Trash bin — soft-deleted items are recoverable until purged

Browser Extension (Chrome, Edge, Firefox)

  • Auto-fill — matched by eTLD+1 domain, filled via the native input setter (never touches browser autofill history)
  • Ed25519-signed IPC — every message between the extension and the desktop app is signed and verified; a pipe-squatting attacker gets nothing usable
  • Zero network — connect-src 'none' in the CSP; there is no code path in the extension that can reach the internet

OS Integration

  • OS Keychain storage — the unlocked vault key lives in Windows Credential Manager / macOS Keychain / libsecret while the vault is open
  • Auto-lock — configurable idle timer, lock-on-minimize, lock-on-screensaver
  • System tray + optional autostart
  • Process hardening — Windows DEP/CFG mitigations and DLL-hijacking protection, Linux seccomp-BPF syscall filtering, an owner-only-DACL named pipe on Windows and a $XDG_RUNTIME_DIR-scoped Unix socket on Linux/macOS
  • Ransomware honeypot — a decoy file whose integrity is checked on every unlock; tampering triggers an immediate lockout warning

Appearance

  • Dark / Light / System theme, live switching
  • 8 accent-color presets plus a custom picker

What changed in this build

This release closes findings from a deep, multi-pass security review of the whole codebase (crypto core, desktop app, native messaging host, browser extension):

  • Fixed: the browser extension's search/autofill was broken on Windows — vault decryption failed because the IPC handler bypassed the code path that unprotects DPAPI-encrypted keys between commands
  • Fixed (security): the extension's Ed25519 signature check could be bypassed for forged responses sent before a signing key was pinned — closed so any credential-bearing response must now be validly signed once pairing has happened
  • Hardened: TOTP brute-force protection is now a shared, persistent lockout instead of a counter that reset on reconnect
  • Hardened: the Unix IPC socket moved off world-visible /tmp to a per-session, permission-restricted runtime directory
  • Fixed a crash on non-ASCII card numbers / SSH key comments, corrected inaccurate "zero network" wording across the docs, and cleared a dependency advisory (anyhow)

Full technical changelog: CHANGELOG.md

License

Releases through v0.2.6 are MIT (see LICENSE-MIT). Releases after v0.2.6 move to the Business Source License 1.1 — free to read, self-host, and use (including inside a business); restricted from being resold as a competing product; converts automatically to GPL after 4 years.

Assets 5
Loading