A password manager that syncs what it cannot read

Logins — a name, a username, a password, the websites it is for, notes, and a website's passkey when it has one — and beside them payment cards, addresses and notes, in one vault per browser profile. Any of them may have a folder and fields of your own, both sealed inside the item, so the server learns no folder's name, nor that there are any.

The extension can reach one server: Keyrook's, fixed when it is built. There is no service that fetches websites' icons and no breach check: each would tell a server every site you have an account on. Site icons are built into the extension.

• Your Keyrook account is the one Keyrook Authenticator uses, and each app has a key of its own in it: nothing Passhold holds opens Keyrook Authenticator's, nor the other way round.
• Your password never leaves the computer. It is reduced to a proof the server checks and a key that stays here; a server asking for a cheaper derivation is refused before anything is sent.
• Each item goes up as a record of its own, sealed under a key drawn from Passhold's and bound to that item and its revision. The server learns your email, when you sync, and how many records there are and how large — never a password, a name, a site or a folder.
• The server is not trusted. A record that will not open is skipped, an older revision is ignored, and a deletion counts only if Passhold sealed it: the server can sign a browser out, never empty it.
• A new computer signed in with Google or GitHub gets Passhold's key only after the same code shows on a browser already signed in, or from your passkey or recovery key — and only if that key opens what Passhold pinned, so a key the server chose is refused.
• Signing out takes the vault off this browser, once a last sync leaves nothing the account does not hold.

Where this is weakest. Your password opens your account, and with it every app's key: whoever has it has everything. So does your recovery key together with your email — keep the two apart.

• A random 256-bit key encrypts the vault with AES-256-GCM, bound to the vault's own identity, so a piece of another vault will not open in this one.
• Your password, through 600,000 rounds of PBKDF2-SHA256 with a random salt, makes the key that locks that random key. Changing the password locks it again; your logins are not touched.
• The settings for that stretching are checked when the vault is opened: too few rounds, too many, or an unknown method is refused.
• A vault made to open with Touch ID or Windows Hello can have no password at all: its file and backups are then sealed under a recovery key Passhold draws, with nothing to guess.

Where this is weakest. PBKDF2 is what browsers offer, and it is not memory-hard: someone who copies the vault file can try passwords on a graphics card, and a weak password will fall. The method is versioned, so a later release can move to a stronger one without re-encrypting a login.

• Touch ID, Windows Hello or a screen lock. A passkey for Passhold's own pages, which no website can ask, answers with 32 bytes that unlock the vault's key. Its copy may stay on disk: there is nothing in it to guess.
• A security key, beside the other ways in and never the only one: its own copy, opened only by its own answer, after its PIN and a touch.
• A PIN never guards anything on disk. Its copy lives in the browser's memory, allows five tries, and is gone when the browser closes.
• Setting up any of these, like exporting or making a backup, asks for proof that you are the owner — your password or recovery key, your fingerprint, or your security key — even while Passhold is open.

Whoever can satisfy the computer's own check can open Passhold: on most computers that includes whoever knows the computer's password. Settings says so before it is turned on.

• The opened key lives in the browser's session memory: never on disk, wiped when the browser closes, and readable only by Passhold's own pages — not by the script it runs in web pages.
• The vault locks after the time you choose, when the computer locks, and when you press Lock. Only your own clicks and keys in Passhold count as activity, never anything a web page does.
• A copied password is cleared from the clipboard after the time you choose.

• The list of logins is Passhold's own page, framed into the website in a way the website cannot read or imitate. The page you are on never holds the vault.
• Only logins for the frame's own site are listed. A site is its registrable domain, so alice.github.io and mallory.github.io are two sites. A page over plain http is offered only a login saved for exactly that address.
• A login is checked against the site again before it is sent, and once more before a character is typed. Only fields you can see are filled.
• A list the website has covered, faded or moved will not act. Nothing fills without a click, and nothing fills when a page loads.

• A card or an address belongs to no site, so it is filled only where you choose it, with a click, as a login is.
• A card fills only on a secure (https) page, however Passhold is asked, and the list names it by its network, last four digits and expiry — never its number or code.
• A card split across a payment provider's frames reaches that provider's frames in the tab, and no frame of any other site.
• A card offered for saving after a checkout is taken only from a secure page, and only if its number adds up.

• A passkey is made and signs only in Passhold's background worker. Its private key never reaches a web page, nor Passhold's own pages.
• A site may use a passkey only for itself, or a parent of it within the same site: alice.github.io cannot make one for github.io.
• You choose in Passhold's own frame, which the page cannot read. Anything Passhold cannot do — a request from a frame inside the page, a security key — is left to the browser, never half done.
• Passhold never keeps a passkey for account.keyrook.com, and runs no passkey script there: those passkeys open your account, and losing the computer must not lose both.

• A backup is the vault file itself, sealed exactly as it is on disk, so it is as safe in a cloud drive as on your computer — and as open to password guessing, which is why your password's strength matters.
• A backup opens with the password, or recovery key, in use when it was made. After one is exposed, old backups are worth deleting.
• Restoring treats the file as untrusted, adds what the vault lacks and removes nothing.
• Exporting to CSV asks for proof that you are the owner even while unlocked, and says what a CSV file is: your passwords, readable by anyone who has it.

• Malware on the computer, or another extension with broad permissions.
• Someone at the browser while Passhold is unlocked.
• A weak or reused password, against someone who has the vault file or a backup.
• A website that is itself compromised: it is the site the login is for.
• A page learning that Passhold is installed. At most it learns whether Passhold holds a passkey for that site, as it would at your next sign-in.

Passhold is open source under GPL-3.0. Its security design, with the test beside each claim, is in the repository, and its builds are the same every time: build the tag and compare it with the copy your browser installed.