vaultless

passwords from thin air

Your passwords, remembered by nobody

There is no vault. Your passphrase, your passwords and your oracle's key are never written to this computer or anywhere else — they are worked out fresh each time. The site remembers only which oracles you trust and which account you used last.

Deterministic derivation through a two-party oblivious PRF over ristretto255, with a verified oracle. No vault, no sync, no stored secret.

Watch first The whole thing in seven minutes Making your paper oracle, your first password, and coming back the next day — every step, on this very site. Watch on YouTube

one curve · three worlds · live y² = x³ − 3x + 5, over the reals, a finite field, and the complex numbers

No vault to stealNo secret is written down here — not your phrase, not your passwords, not your oracle's key, and no list of what your accounts are. This browser keeps only which oracles you trust.
Nothing leaves this pageYour phrase and your paper key are combined right here in the browser. Nothing is sent anywhere, to anyone.
Always the same answerThe same phrase and the same account number give the same password, on any computer, forever.

Your secret phrase

Pick something only you know and can always remember. It never leaves this device.

Master passphrase. Hashed with the index to a ristretto255 point; never transmitted.

Waiting for your phrase…

Which account is this for?

Every account gets its own number, so every account gets a different password. Which number you gave which account is yours to keep track of — nothing here writes that down.

Sub-index. Included in the hash-to-group input and the HKDF salt.

Choose a password style

Not sure? The first one is a good default. Some websites don't allow symbols — then pick letters & numbers.

Second-stage HKDF keyed by format name, rejection-sampled into the charset.

Strongest20 chars · with symbols

Letters & numbers16 chars · no symbols

Web-safe20 chars · base64url

Just digits6-digit PIN

Make my password

That's everything — press the big button. You can come back and change the account number any time; the same phrase and number always give the same password.

Derive with your paper oracle (S = k·P, computed here), or run the demo: the full blinded exchange against an in-browser simulated oracle with an ephemeral key that is never pinned.

⚠️ Demo only — this is not your real password

Your password will appear here

style: strongest · 20 chars source: —

protocol trace

— no handshake yet. derive a password to see the OPRF exchange step by step —

How does this work?

Think of your paper oracle as a key that only works together with your phrase.

You type your phrase. It stays in this browser — it is never sent anywhere.
Your browser scrambles the phrase and the account number into a point on a curve.
It stamps that point with the key from your paper, playing a little animation while it works.
The stamped result is turned into your password.

Because the answer depends on both your phrase and your oracle, someone who steals only one of them gets nothing. And because the same two things always produce the same answer, there's no vault to lose, back up, or have stolen.

Worth knowing: if you lose your paper with no copy, you lose the passwords it makes — print two and keep them apart. And anyone who photographs it and learns your phrase can make them all, so store it like cash.

vaultless is a deterministic password manager: every password is re-derived on demand from your master passphrase, an account number and a key printed on paper. Same inputs, same password, every time. Nothing to sync, back up, or leak.

Pure deterministic derivation lets anyone who steals the passphrase recompute every password offline. vaultless closes that with a second factor: a 256-bit scalar k, printed as a QR square and a typable code.

The browser hashes passphrase‖index to a ristretto255 point P.
It computes S = k·P with the key from your sheet, and checks the key's public half Y = k·G against the one this browser pinned on first use.
S is expanded through HKDF-SHA256 into the password.

S is exactly the output of a two-party oblivious PRF with key k, and the demo plays it that way against a simulated oracle: blind B = r·P, receive B′ = k·B with a DLEQ proof, unblind r⁻¹·B′ = k·P. The blinding cancels, so both roads reach the same point.

why this resists theft

Without k, a stolen passphrase alone regenerates nothing.
Without the passphrase, a stolen or photographed sheet regenerates nothing either.
A different sheet is caught: its public key must match the one pinned on first use.
The sheet is not encrypted under the passphrase — that would let the phrase alone rebuild k, collapsing two factors into one.
k is in this browser's memory while the sheet is loaded, so only scan it on a computer you trust. It is dropped after 5 minutes idle, on Forget, and on reload.
Nothing is persisted: not the passphrase, not k, not the password.

source

github.com/Ak1ra00/vaultless

derivation: ristretto255 · S = k·H(phrase ‖ account) · HKDF-SHA256

This page did not arrive over a secure connection

You are reading over plain HTTP. Anyone between you and the server — a network, an ISP, whoever runs the Wi-Fi — can change this page before it reaches you, and a changed page can send your master phrase and every password it makes straight to them.

This site is refusing to make passwords here. That is deliberate: its whole premise is that the code you audited is the code that runs, and over HTTP nobody can promise that.

One thing is already broken and is not your device's fault: the camera requires HTTPS, so it reports as missing on every machine you try.

If this is your site: serve it over HTTPS and turn on "Enforce HTTPS". If you are a visitor: try the https:// address, and do not type your phrase until it loads.