passman

Secure offline password & file manager

Features

Industry standard encryption - AES-256-GCM + Argon2id
Windows Hello - Unlock with face/fingerprint/PIN Built-in 2FA - Generate TOTP authenticator codes offline Offline-first - No cloud, no network, no telemetry, never Encrypted everything - Service names, metadata, all encrypted
Secure File Vault - Encrypt documents, images, keys

Quick Start

# Windows
.\passman.exe

# Linux  
./passman

First time: Set master password → optionally enable Windows Hello

Vault Types

PassMan uses the .psmn file format for secure storage:

Vault	File	Purpose
Passwords	store.psmn	Credentials, TOTP secrets
Files	files.psmn	Encrypted documents, images, keys

Commands

Command	Description
1-6	Credential management
7	File Vault Manager (NEW)
8	TOTP/2FA manager
9-10	Password rotation & change
11-12	Export/Import backup
13-14	Settings & Help

File Vault Features

• Add files - Encrypt any file (PDFs, images, keys, certificates)
• Compression - Optional gzip compression before encryption
• Tags & Categories - Organize files with tags
• Search - Find files by name, tag, or content type
• Integrity Check - SHA-256 checksum verification
• Batch Extract - Export all files at once
• 100MB limit - Per file (configurable)

Security

• Encryption: AES-256-GCM authenticated encryption
• Key derivation: Argon2id (256MB memory, 3 iterations)
• Storage: Custom .psmn format with multi-layer encryption
• Windows Hello: TPM-backed, FIDO2 biometric authentication
• Memory: Auto-zeroing sensitive data, no core dumps
• Atomic writes: Temp file + rename for crash safety

Store Location

• Windows: C:\Users\<user>\AppData\Local\PassMan\<hostname>_<user>\
  • store.psmn - Password vault
  • files.psmn - File vault
• Linux: ~/.config/passman/<hostname>_<user>/
  • store.psmn - Password vault
  • files.psmn - File vault

Building

# Local
go build -o passman .

# Windows cross-compile (from Linux/WSL)
CC=x86_64-w64-mingw32-gcc CGO_ENABLED=1 GOOS=windows GOARCH=amd64 go build -o passman.exe .

Requirements: Go 1.21+, GCC (for SQLite CGO)

Use Cases

Personal

• Store passport scans, tax documents, crypto wallet seeds
• Keep SSL certificates and private keys secure
• Encrypt sensitive photos and documents

Developer

• API keys + SSL certificates in one vault
• .env files and deployment credentials
• SSH keys and configuration files

Business

• Client credentials + contracts
• Signing keys and certificates
• Secure document handoff

License

EULA License - See LICENSE

---

v3.1.0 | Enterprise-grade password & file security