GitPassword is a Git-powered, locally encrypted, all-in-one digital vault crafted for developers, engineers, and privacy-conscious teams.
Rooted in the philosophy of true data sovereignty, GitPassword ensures that all sensitive data is encrypted locally using zero-knowledge cryptography before leaving your device. Your remote Git repository serves purely as an encrypted storage medium and synchronization channel, delivering full offline availability, verifiable Commit history, and multi-device roaming.
Three Core Vaults
GitPassword organizes your digital assets into three dedicated vaults with tailored protection and intuitive workflows:
1. Passwords & Credentials Vault
- Comprehensive Credential Archiving: Store website accounts, server SSH credentials, API tokens, database connection strings, payment cards, and identity documents.
- Rich Structured Fields: Title, Username, Password, Website URL, TOTP 2FA Dynamic Codes, Folders, Favorites, and Notes.
- Built-in Password Generator: Quickly generate cryptographically secure, randomized passwords with customizable length and character sets.
- Secure Clipboard Protection: Automatically clears copied passwords from your clipboard after a configurable timeout to prevent background snooping.
2. Encrypted Notes
- Private & Developer Notes: Securely write seed phrases, recovery codes, server configurations, and personal journals in full ciphertext.
- Pure Markdown Experience: Clean layout with structured rendering for seamless writing and reading.
- Encrypted Draft Persistence: Edits are continuously encrypted and saved locally in real time. In the event of a sudden power outage or forced quit, your uncommitted changes can be recovered across app restarts.
- Confidential Document Storage: Archive SSH private keys, TLS/SSL certificates, scanned IDs, and business contracts with one click.
- Large Files & Git LFS Support: Decouples large file payloads from Git metadata, supporting chunked streaming for large files.
- In-App Plaintext-Free Streaming Preview:
- Images & Text: Instant in-memory decryption and preview.
- Audio & Video Media: Stream and play encrypted media directly inside the application without writing plaintext temporary files to disk.
- Safe Export: Decrypt and export original files to any designated local folder whenever needed.
Clean UI Layout
GitPassword features an intuitive 3-column layout:
- Left Navigation: Switch effortlessly between Passwords, Notes, Files, Favorites, and Trash. Conflicts are highlighted immediately when detected.
- Middle Item List: Instant text and fuzzy search with millisecond response times.
- Right Detail Workspace: Real-time editing, password visibility toggle, one-click copying, live TOTP countdowns, and automatic draft protection.
Git Synchronization & Conflict Resolution
- Local-Only Vault Mode: Works entirely offline with zero network connectivity if no remote URL is configured—ideal for air-gapped environments.
- Remote Git Sync: Connect to GitHub, GitLab, Gitee, or self-hosted Gitea / bare Git servers. Automatic lightweight sync (Pull/Push) triggers on login and save.
- Visual Conflict Arbiter: If concurrent modifications happen across offline devices, GitPassword never blindly overwrites data. A visual conflict resolver displays side-by-side field diffs, allowing you to choose "Keep Local", "Use Remote", or "Save as New Item".
Security Model & Cryptographic Foundations
- Master Password is the Sole Key: Your master password never leaves your device. GitPassword uses a zero-knowledge design and cannot recover or reset forgotten master passwords.
- Ciphertext-Only Remote: Data pushed to remote Git repositories is completely encrypted. Even if your repository is exposed or the Git provider is compromised, attackers cannot read your plaintext data without your master password and Vault Secret.
- Modern Cryptographic Standards:
- Argon2id v1.3 Memory-Hard KDF: Configured with
m=32 MiB, t=6, p=4 to neutralize GPU and ASIC offline brute-force attacks. - AES-256-GCM AEAD Authenticated Encryption: Eliminates padding oracle attacks and prevents ciphertext tampering.
- Optional 128-bit Vault Secret (2nd Secret): Generates a local hardware-protected second secret aligned with top-tier industry security benchmarks.
- 64 KiB Authenticated Chunk Streaming: File chunks are independently authenticated with bound AAD metadata against reordering or truncation.
Next Steps