VaultZero: a password manager with nowhere to phone home

The vault is a single encrypted file in the user's home directory. There is no server component, no sync service and no account. Nothing is transmitted because there is nowhere for it to be transmitted to.

That choice has a cost, and Efe Canbolat made it deliberately: there is no recovery option. Forget the master password and the data is gone. Zero knowledge only means something when it is enforced against the author too.

Content is encrypted with AES-256-GCM — Galois/Counter Mode, so the ciphertext is authenticated as well as confidential, and tampering is detected rather than silently decrypted into garbage.

The master password is stretched with Argon2id configured at 64 MB of memory across 4 threads, which makes large-scale offline guessing expensive rather than merely inconvenient. Every vault gets its own 32-byte random salt, so two identical passwords never produce the same key.

VaultZero is written with Wails, pairing a Go backend with a React and TypeScript interface, and ships for Windows, macOS and Linux from one codebase. The repository is public under the MIT licence.

The interface is a modern dark-mode UI that fetches service favicons so credentials are identifiable at a glance, and copied passwords clear from the clipboard automatically after thirty seconds — security that does not require the user to remember to be careful.