Media
3 items
Description
Zero-knowledge password manager: autofill, password generator, 2FA (TOTP), passkeys, CSV import, and free multi-device sync. Spassword is a free, zero-knowledge password manager for Chrome, with a companion web vault you can use with or without installing the extension. WHAT "ZERO-KNOWLEDGE" MEANS Your master password never leaves your device, and it is never sent to our servers — not even in encrypted form. Everything is encrypted and decrypted locally in your browser using AES-256-GCM, with your encryption key derived from your master password via Argon2id (a memory-hard key derivation function) and HKDF. Our Cloudflare-based backend only ever stores ciphertext plus an authentication verifier. If our database were ever breached, there would be no readable passwords to leak — because we never had them in the first place. If you forget your master password, we cannot recover it for you either; that is the tradeoff of a true zero-knowledge design, and we tell you this upfront rather than after the fact. CORE FEATURES - Save & autofill: Spassword detects login forms as you submit them and offers to save the credentials; on sites you've already saved, it can autofill your username and password automatically. - Built-in password generator: create strong, random passwords with one click, right from the save/edit screen. - Two-factor authentication (TOTP) built in: store and view live, auto-refreshing 6-digit 2FA codes alongside a saved login, or as a standalone 2FA-only entry (for services where you manage the password elsewhere but still want your authenticator codes handy) — no separate authenticator app required. - Passkey (WebAuthn) support: on sites that support passkeys, Spassword can act as a software authenticator — creating and using standard WebAuthn passkeys the same way a hardware key or your OS's built-in authenticator would. Passkeys are encrypted and synced across your devices exactly like passwords and 2FA secrets. Every passkey creation or sign-in shows an on-page confirmation you have to approve first — nothing happens silently. - Import from Chrome/Google: bulk-import passwords from a CSV file exported via Chrome's own password manager, instead of adding them one by one. - Password breach checking: check any saved password against known data breaches with one click, or run a one-click scan across your entire vault. This uses a k-anonymity design (the same approach behind Have I Been Pwned's password API): your password is hashed locally on your device, and only the first 10 characters of that hash are ever sent over the network — the full password, and even the full hash, never leaves your browser. - Multi-device sync: install the extension on multiple computers and sign in with the same account to keep your vault in sync. Sync happens automatically in the background; only encrypted data ever touches the network. - Standalone window mode: since Chrome automatically closes the extension popup whenever it loses focus, Spassword can also open in its own persistent window — useful when you need to switch tabs mid-edit to copy a real username or password. An in-progress entry is also auto-saved as a draft so it's never lost even if the popup does close unexpectedly. - Web vault, no extension required: sign in at spassword.net to view, add, edit, and search your passwords from any browser, on any device — useful when you're on a computer where you can't install extensions. - Works entirely client-side: all cryptographic operations (key derivation, encryption, decryption, hashing) happen locally in your browser via WebAssembly and the Web Crypto API. Nothing is computed on our servers. WHY WE BUILT THIS Most "free" password managers make money by limiting device sync, gating basic features behind a paywall, or — worse — by being vague about what they can technically see about your data. Spassword's core promise is architectural, not a marketing claim: because of how the encryption is designed, we could not read your passwords even if we wanted to, and even if legally compelled to hand over our database. Multi-device sync is free, not a premium upsell. HONEST ABOUT LIMITATIONS We believe transparency matters more than marketing. Spassword has not yet undergone a formal third-party security audit — we're a small, independent project, and we say so plainly on our security page rather than implying otherwise. Our authentication design uses a verifier-based scheme rather than full SRP-6a. Passkey support is a software-only authenticator, not an OS-level platform authenticator, and does not yet support conditional UI (the autofill-style suggestion dropdown some sites show). We plan to pursue an audit as the project grows. If security transparency matters to you, read our full write-up at spassword.net/security.html before trusting us with your passwords. PERMISSIONS, EXPLAINED - Host permissions (all sites): required so the extension can detect login forms and autofill saved credentials on any site you visit. This processing happens entirely on your device; page content is never uploaded to our servers. - Content scripts on all frames, including one running in the page's own JavaScript context ("MAIN world"): required specifically for passkey support. Intercepting a page's navigator.credentials.create()/get() calls is the only way for an extension to act as a WebAuthn authenticator, and those calls only exist on the page's own window object — they can't be observed from the extension's isolated script context. All-frames injection is needed because some sites (including some of Google's own account settings pages) render their passkey UI inside an iframe. No credential data is read or transmitted unless you first approve an on-page confirmation prompt. - Storage: used to cache your encrypted vault locally (so it's available offline) and to hold your decryption key in memory only while the vault is unlocked (chrome.storage.session — cleared when your browser closes). - Alarms: used to periodically sync your vault with our backend in the background. We do not sell or share your data with third parties, and we do not use your data for advertising. PRICING Spassword is free to use, including multi-device sync. We're an independent, self-funded project — see spassword.net for what's included and what we're considering for the future. SUPPORT & CONTACT Questions, bug reports, or security concerns: security@spassword.net. We aim to acknowledge security reports within 3 business days. Full privacy policy and terms of service are available at spassword.net/privacy.html and spassword.net/terms.html.