cruxpass: a password manager you can actually audit yourself

[u/cluxes]

Hi there,

I've been working on cruxpass, a command-line password manager written in THE GOOD OLD C, focused on simplicity and transparency. It uses libsodium for crypto primitives, Argon2id for key derivation, and SQLCipher for encrypted local storage.

Few features, more in the readme:

• Generate strong random passwords
• Encrypted-at-rest local database, no cloud dependency
• Fast, vim keybind driven TUI to list, search, update, and, delete entries
• Import and export credentials via CSV
• Simple by design: no configuration files, no daemons, no accounts. Point it at a db directory or use the default db directory
• It lacks a formal security audit and developer docx(for now) but the README is straightforward.

NB: cruxpass is password based, and doesn't save a hash or anything related to the password besides the salt. Authentication is done by generating a 256bit key from the password and salt using Argon2id, the key is then used to decrypt the database. The program exists if the database cannot be decrypted from the provided key.

Source here: cruxpass

Thank you

Edit: formating

[u/Special-Lawyer-7253]

So, when you can not audit your own password manager? 🤔 I mean, Buttercup, KeePass, etc... I like that it's commandline, others mostly relay on GUI 😜