Keeper

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

You should not build your own password manager, and this entry exists to explain why rather than to hand you a prompt.

**A password manager is the single worst place for a homemade bug.** Every other tool on this site fails visibly: a chart is wrong, an email does not send. This one fails silently and completely — a weakness in the key derivation or the sync protocol means every credential you own is exposed, and you will not find out until it matters.

What you would have to get right, all of it, with no mistakes:
- Key derivation with correct parameters, and a plan for when those parameters need to change
- Authenticated encryption, with nonces that are never reused, for every record
- A sync protocol where the server never learns the key, including during sharing
- Recovery that does not become a backdoor
- Browser autofill that cannot be tricked into filling a credential into the wrong origin — this is a subtle and much-attacked surface
- Clipboard handling, memory hygiene, and a locked state that is genuinely locked

WHAT TO DO INSTEAD
- **Use KeePassXC with a synced database file.** Free, open source, audited, works offline, and the file is yours. Sync the file with anything — a private cloud drive, or Syncthing between your own machines
- Or use Bitwarden, and self-host Vaultwarden if you want the server on your own machine. That is a legitimate way to stop paying for a password manager without writing cryptography
- Either way: a long unique passphrase for the vault, and a hardware key or an authenticator app as a second factor

WHAT YOU CAN BUILD, IF YOU WANT SOMETHING HERE
- **An audit over your existing vault's export**: reused passwords, weak ones, ones that have not changed in years, ones for domains that no longer exist, and accounts missing a second factor. Run it locally, on an export, and delete the export afterwards
- A check against a breach corpus using the k-anonymity range API, which never sends a full hash anywhere
- A shared-credential register for a team: what exists, who has it, when it was last rotated — the metadata, with the secrets staying in the real manager

WHAT MATTERS MOST
Do not write this. Run Vaultwarden or KeePassXC and spend the effort on the audit tooling around them, which is genuinely useful and cannot hurt you.