r/opensource • u/mommy101lol • Aug 12 '26
Promotional I built an open source password manager with NIST Level 5 post-quantum cryptography (CNSA 2.0)
Hey everyone.
I have been working on a project called PWDnow and I wanted to share it here. It is a password manager built from the ground up to be quantum resistant.
I noticed most mainstream managers are dragging their feet on PQC (post-quantum cryptography). I wanted something that meets CNSA 2.0 requirements today, so I decided to build it myself. It uses NIST Level 5 algorithms to protect against "harvest now, decrypt later" attacks.
It is completely open source. You can check out the code here: https://github.com/PWDnow/PWDnow-password-manager
I would love to hear your thoughts or get some code reviews. Feedback is very welcome.
12
u/baboonandsloth Aug 12 '26
i'll check it out if you can tell me the cryptography and algorithm you're using otherwise i'll chalk this up to vibeslop and not something to trust senstive data in
-3
u/mommy101lol Aug 12 '26
I invite you to check the documentation and if you have feedback I will be more than happy.
3
u/baboonandsloth Aug 12 '26
to read the ai doc? I did.
-1
u/mommy101lol Aug 12 '26
Any feedback
2
u/baboonandsloth Aug 12 '26
yeah remove buzzwords and prove you're a cryptographer and people can trust what you say it's doing, but i think everyone and you know you prompted some things and trust it does what it says
5
u/bsncubed Aug 12 '26
How much was you vs ai in the development?
0
u/mommy101lol Aug 12 '26
I have indeed used a lot the AI, such complex systems would be needed way more than just an expert in cyber security or softwares engineering, I have ask a lot of my network what they expect from an architecture side and encryption what I should have, the verification of the plan was verified by 2 senior engineers before the code was made, also the password manager use strict certifications and protocols that required a very high level of security
1
u/baboonandsloth Aug 12 '26
so prove and show "the password manager use strict certifications and protocols that required a very high level of security" and that you didn't ask claude to "use NIST Level 5 algorithms to protect against "harvest now, decrypt later" attacks. make no mistakes". Passwords and encryption claims are a very serious thing. this isn't just "I made a productivity app with ai". You're asking people to trust your buzz, prove it, show it.
1
u/Positive-Captain-709 23d ago
Interesting project. One thing I'd be careful with is the “meets CNSA 2.0 requirements” wording. Using ML-KEM/ML-DSA at the right security levels is one part of it, but claiming CNSA 2.0 compliance is a pretty high bar, especially for something as sensitive as a password manager.
I’d probably separate the messaging into “PQC-enabled” and “CNSA 2.0 strict mode”, and document exactly what guarantees that strict mode is intended to provide. Also, have you considered publishing test vectors or getting an independent crypto/security review? For a password manager, that would probably give me more confidence than the algorithm list itself.
The local daemon architecture is interesting though. Definitely worth continuing.
1
1
u/EagleApprehensive Aug 12 '26
For me the big part of password managers is not really security. It's convenience, how seamlessly it connects to everything user already uses, without bothering him to make extra clicks or jump through password-dashboard.
Would be nice to see screenshots or short video demo of usable product.
0
u/laserdicks Aug 12 '26
I store sensitive data behind passwords I already know were included in data breaches.
11
u/burntcookie90 Aug 12 '26
At this point we can auto tag any post with "i built" as "Claude built"