[Crypto] Suckless password manager

I used passwordsafe in past, which maybe great, but I wanted something even simpler/minimalistic.

The simplest possible solution is just plain text file encrypted (symmetrically) with GnuPG. Both VIM and Emacs have plugins to call gpg automatically when open/save .asc or .gpg file.

As of Emacs, org-mode can be used as well, which I recommend -- I often run Emacs just for org-mode. It can be used for passwords and various account info as well, of course.

As of password generation:

% cat /dev/urandom | tr -dc 'a-zA-Z0-9!"#$%&()*+,-./:;<=>?[\]^_`{|}~' | fold -w 16 | head -n 1
...
j.d)$W-l&uo+$v^I
...
w|:L=5~Ux`uG8<=t
...
NC6;Tw~cd2.n.i+Q

Tune the tr's option as you wish.

If you are not into all that Unix geekery, even simpler option exists -- just plain text files encrypted with WinRAR. But use the -hp option, so that text file names would be hidden/encrypted as well:

  hp[password]  Encrypt both file data and headers
  p[password]   Set password

You can then open/edit such RAR files using FAR.

One downside should be kept in mind: all these temporary plain text files may be still recovered after erasing. A good (local) password manager should handle such sensitive data carefully. (Forget about online password managers running in web-browser.)

DO NOT USE online password managers. You just never know how your passwords are stored, encrypted, etc. I never trust such services.

It's just like storing your valuable family jewels in an automated luggage storage at railway station. Yes, railway station may be guarded by heavily armed security guards, and there may be no previous history for theft, but please, no.

It maybe OK for your dirty laundry and outdated gadgets, but nothing more valuable.

(Same applies for cloud storage services like dropbox, etc.)

Conscientious/decent/good-hearted developers may create insecure systems, this is life.

(the post first published at 20241116, updated 20241118.)


List of my other blog posts.

Subscribe to my news feed,

Yes, I know about these lousy Disqus ads. Please use adblocker. I would consider to subscribe to 'pro' version of Disqus if the signal/noise ratio in comments would be good enough.