lasbolt
A self-hosted password manager.
In development. Not released yet.
- Server
- One Go binary with SQLite built in. It runs on a machine you control. Encrypted at rest, with scheduled encrypted backups.
- Master password
- Argon2id runs on your device. The server gets a derived auth key, never the password or the encryption key.
- End-to-end folders
- Per-folder keys sealed with HPKE over ML-KEM-768 and X25519. The server stores ciphertext it cannot read.
- Integrity
- Every change is signed by the device that made it. Clients sign checkpoints and stop writing if the server shows an older vault.
- Sync
- Merges field by field. Edits made offline on two devices combine without a conflict dialog. Every version is kept.
- CLI and agents
- Scoped keys limited to a folder or an item, with expiry and per-use approval. An MCP server with no tool that returns a secret value.
- Clients
- macOS with Touch ID, Safari, Chrome, Firefox, the web and the command line.
$ lasbolt run \ --env AWS_SECRET_ACCESS_KEY=lasbolt://Personal/infra/aws-prod/password \ --purpose "terraform apply" \ -- terraform apply waiting for approval on your devices … approved