SpiritByte

Local-first retro password manager

A secure, fully customizable password manager with a retro CRT/pixel aesthetic. Built with Tauri 2 (Rust) + React/TypeScript. Your data never leaves your device.

Features · Security · Install · Build · Architecture

---

Screenshots

MSI Installer (WiX)	Onboarding — Master Key Setup

Theme customization

Solid	Gradient	Image / GIF

Features

Cryptography

• Argon2id key derivation + XChaCha20-Poly1305 authenticated encryption
• Envelope encryption: a random DEK encrypts the vault, wrapped twice (master password + BIP39 recovery phrase)
• 12-word BIP39 recovery phrase for full access recovery
• All secrets are zeroized in memory — the DEK and master password never leave the Rust process

Vault Management

• Entries with title, username, password, URL, and notes
• Nested folders with custom icons and colors
• Favorites, full-text search, and keyboard-driven workflow
• Configurable password generator with entropy strength meter
• Auto-lock on inactivity and automatic clipboard clearing

Customization

• Multiple preset palettes + custom color editor (live preview)
• Retro typography (Press Start 2P, VT323, Geist Pixel) with adjustable font size
• Backgrounds: solid, gradient, or custom image
• CRT effects: scanlines, glow, flicker, and Bayer 8x8 dithered splash screen

Cross-platform

• Native installers for Windows (MSI via WiX, NSIS), macOS, and Linux
• Multilingual: English and Spanish with runtime switching

Tip

SpiritByte stores everything locally in your OS app-data directory. No servers, no accounts, no telemetry. Your encrypted vault is the only artifact that matters.

Security Model

Artifact	Contents	Encryption
vault.dat	Entries and folders	XChaCha20-Poly1305 (DEK)
vault.meta.json	Salts, Argon2 params, wrapped DEK (x2)	No plaintext secrets
settings.json	UI preferences	Plaintext (non-sensitive)

Master Password ──┐
                  ├──(Argon2id)──> DEK ──> XChaCha20-Poly1305 ──> vault.dat
Recovery Phrase ──┘

Warning

If you lose both your master password and your 12-word recovery phrase, the vault is unrecoverable by design. There is no backdoor.

Installation

Pre-built binaries

Download the latest installer from the Releases page:

Platform	Installer
Windows	.msi (WiX) or -setup.exe (NSIS)
macOS	.dmg
Linux	.deb / .AppImage

Building from source

Prerequisites

• Node.js 18+ and pnpm
• Rust toolchain (cargo)
• Platform-specific Tauri prerequisites

Development

pnpm install
pnpm tauri dev

Production build

pnpm tauri build

Run crypto tests

cd src-tauri
cargo test --lib

Architecture

src/                       Frontend (React + TypeScript)
  components/              UI primitives, SplashFox, StrengthMeter
  features/                generator, entries, settings
  screens/                 Onboarding, Unlock, VaultApp
  store/                   Zustand state (useVault, useSettings)
  theme/                   Palettes + theme application (CSS vars)
  lib/                     API bridge, clipboard, auto-lock, types

src-tauri/src/             Backend (Rust)
  crypto.rs                Argon2id, XChaCha20-Poly1305, BIP39
  vault.rs                 Data model, on-disk format, operations
  generator.rs             Password generator + strength estimation
  state.rs                 Session state (DEK in memory)
  commands.rs              Tauri IPC commands exposed to frontend

Tech stack

Layer	Technology
Desktop runtime	Tauri 2
Backend	Rust (argon2, chacha20poly1305, bip39, zeroize)
Frontend	React 18, TypeScript 5.6
State	Zustand 5
Styling	Tailwind CSS 3.4
Icons	Lucide React
Fonts	Press Start 2P, VT323, Geist Pixel (5 variants)

Roadmap

• CSV import/export
• Browser extension autofill

Contributing

Contributions are welcome. Please open an issue first to discuss what you would like to change.

1. Fork the repository
2. Create a feature branch (git checkout -b feat/my-feature)
3. Commit your changes
4. Open a pull request

Support

If you find SpiritByte useful, consider supporting the project:

License

MIT