Web-based smart password manager with deterministic password generation. Generate, manage, and retrieve passwords without storing them. Your secret phrase never leaves your browser.
Decentralized by Design: Unlike traditional password managers that store encrypted vaults on central servers, smartpasslib stores nothing. Your secrets never leave your device. Passwords are regenerated on-demand — no cloud, no database, no trust required. The server stores only metadata (description, length, public key) for verification — never your secret phrase or actual password. Internet connection is only needed to load the page and sync metadata; all cryptographic operations happen locally in your browser.
By using this software, you agree to the full disclaimer terms.
Summary: Software provided "AS IS" without warranty. You assume all risks.
Full legal disclaimer: See DISCLAIMER.md
⚠️ This version uses smartpasslib-js v4.0.0, which is NOT backward compatible with v1.x.x or v2.x.x
Smart passwords created with older versions cannot be regenerated using v4.0.0.
What changed:
- Dynamic iterations: private key 15-30 steps (was fixed 30), public key 45-60 steps (was fixed 60)
- Expanded Google-compatible character set (26 special chars + A-Z + a-z + 0-9)
- Secret phrases now require minimum 12 characters (was 4)
- Password length now limited to 100 characters (was 1000)
- Key derivation with salt separation ("private"/"public")
- No secret exposure in iteration logs
📖 Full migration instructions → see MIGRATION.md
- Zero-Storage Security: No passwords or secret phrases are ever stored or transmitted
- Decentralized Architecture: No central servers, no cloud dependency, no third-party trust required
- Deterministic Regeneration: Passwords are recreated identically from your secret phrase
- Metadata Only: Store only descriptions and verification keys
- Client-Side Generation: All cryptographic operations happen in your browser
- On-Demand Discovery: Passwords exist only when you generate them
- Decentralized & Serverless: No central database, no cloud lock-in, complete user sovereignty
- Smart Password Generation: Deterministic from secret phrase
- Client-Side Processing: Secret phrase never leaves your browser
- Cross-Platform Compatible: Same passwords as desktop, CLI, and mobile apps
- Public Key Verification: Verify secret knowledge without exposure
- Dynamic Iteration Counts: 15-30 for private key, 45-60 for public key (deterministic per secret)
- Web-Based Interface: Access from any device with a browser
- Secure Input: Hidden secret phrase entry with show/hide toggle
- Copy to Clipboard: One-click password copying
- Export/Import: Backup and restore your password metadata
- QR Code Export: Transfer password metadata to Android app via QR code
- User Authentication: Secure login with Django
- PostgreSQL Backend: Reliable data storage
- Proof of Knowledge: Public keys verify secrets without exposing them
- Decentralized Trust: No third party needed — you control your secrets completely
- Deterministic Security: Same secret + length = same password, always
- Metadata Separation: Non-sensitive data stored on server
- Local Processing: Secret and password never leave your browser
- No Recovery Backdoors: Lost secret = permanently lost access (by design)
- Pointer-Based Security Paradigm - Architectural Shift from Data Protection to Data Non-Existence
- Local Data Regeneration Paradigm - Ontological Shift from Data Transmission to Synchronous State Discovery
Powered by smartpasslib-js — JavaScript implementation of deterministic password generation.
Key derivation (same as Python/Go/Kotlin/C# versions v4.0.0):
| Key Type | Iterations | Purpose |
|---|---|---|
| Private Key | 15-30 (dynamic) | Password generation (never stored, never transmitted) |
| Public Key | 45-60 (dynamic) | Verification (stored on server) |
Character Set (Google-compatible):
!@#$%^&*()_+-=[]{};:,.<>?/ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz
Validation Rules:
- Secret phrase: minimum 12 characters
- Password length: 12-100 characters
Decentralized Architecture:
- No central authority required
- Metadata can be synced via any channel
- Your security depends only on your secret phrase
- Python 3.8+
- PostgreSQL
# Arch Linux
sudo pacman -S postgresql
# Ubuntu/Debian
sudo apt-get install postgresql postgresql-contrib
# Initialize database cluster (Arch Linux)
sudo su - postgres -c "initdb --locale en_US.UTF-8 -D '/var/lib/postgres/data'"
sudo systemctl start postgresql
sudo systemctl enable postgresql# Clone repository
git clone https://github.com/smartlegionlab/smart-password-manager-web.git
cd smart-password-manager-web
# Create virtual environment
python -m venv venv
source venv/bin/activate
# Install dependencies
pip install --upgrade pip
pip install -r requirements.txt
# Install PostgreSQL adapter
pip install psycopg2-binary-- Access PostgreSQL shell
sudo -u postgres psql
-- Create database
CREATE DATABASE smart_password_manager_db
OWNER postgres
ENCODING 'UTF-8'
LC_COLLATE 'en_US.UTF-8'
LC_CTYPE 'en_US.UTF-8'
TEMPLATE template0;Create .env file in project root:
# Core Settings
DJANGO_ENV=development
SECRET_KEY=your-generated-secret-key-here
DEBUG=True
# Database Settings
DB_NAME=smart_password_manager_db
DB_USER=postgres
DB_PASSWORD=postgres
DB_HOST=localhost
DB_PORT=5432
# Email settings
EMAIL_ON=True
EMAIL_HOST=smtp.server.com
EMAIL_HOST_USER=email@example.com
EMAIL_HOST_PASSWORD=passwordGenerate secret key:
python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"# Apply migrations
python manage.py migrate
# Create superuser
python manage.py createsuperuser
# Collect static files
python manage.py collectstaticpython manage.py runserverAccess the application at: http://localhost:8000 Admin interface: http://localhost:8000/admin
- Minimum 12 characters (enforced)
- Case-sensitive
- Use mix of: uppercase, lowercase, numbers, symbols
- Never store digitally
- NEVER use your password description as secret phrase
- Smart/Strong/Base passwords: 12-100 characters
- Authentication codes: 4-100 characters (if using code generator)
✅ "MyStrongSecretPhrase2026!" — mixed case + numbers + symbols
✅ "P@ssw0rd!LongSecret" — special chars + numbers + length
✅ "КотБегемот2026НаДиете" — Cyrillic + numbers
❌ "short" — too short, rejected
❌ "GitHub Account" — using description as secret (weak!)
❌ "password" — dictionary word, too short
❌ "1234567890" — only digits, too short
There is no "forgot password" button. This is by design:
- No central server can reset your passwords
- No support team can recover your access
- Your secret phrase is the ONLY key
This is the price of true decentralization — you are completely in control.
The web application allows you to export password metadata to the Smart Password Manager Android app via QR code:
How to use:
- In the password list, click the QR button next to any password
- A modal dialog with QR code will appear containing the password metadata
- Open the Android app and scan the QR code
- The password entry will be automatically added to your mobile device
What's included in QR:
- Password length
- Public verification key
What's NOT included:
- Password description (shown in dialog for reference, but not embedded in QR)
- Your secret phrase (never leaves your device)
- The actual password
- Any sensitive information
Security Note: QR codes contain only metadata that is already stored on the server. Your secret phrase and actual passwords are never embedded in QR codes.
Smart Password Manager Web supports seamless metadata transfer across all platforms:
Methods:
- QR codes - Transfer password metadata from Web to Android app instantly
- Export/Import - JSON export/import works across all platforms (Web, Desktop, CLI, Android)
Cross-platform compatibility:
- Same JSON format for export/import on all platforms
- QR code format is identical across Web and Desktop versions
- Metadata sync without cloud dependency
- Backend: Django 5.2+ (only for auth, metadata storage, and session management)
- Database: PostgreSQL
- Frontend: HTML5, CSS3, JavaScript
- Client Crypto: smartpasslib-js v4.0.0 (Web Crypto API)
Smart Password Manager Web produces identical passwords to:
| Platform | Application |
|---|---|
| Desktop | Desktop Manager |
| CLI | CLI PassMan / CLI PassGen |
| Android | Android Manager |
| Python | smartpasslib |
| Go | smartpasslib-go |
| Kotlin | smartpasslib-kotlin |
| C# | smartpasslib-csharp |
Data transfer: Use QR codes or Export/Import to sync metadata across all platforms.
Core Libraries:
- smartpasslib - Python
- smartpasslib-js - JavaScript
- smartpasslib-kotlin - Kotlin
- smartpasslib-go - Go
- smartpasslib-csharp - C#
CLI Applications:
- CLI Smart Password Manager (Python)
- CLI Smart Password Generator (Python)
- CLI Smart Password Manager (C#)
- CLI Smart Password Generator (C#)
Desktop Applications:
Other:
| Version | Generation | smartpasslib | Status | Migration Required |
|---|---|---|---|---|
| v1.x.x and below | Server-side | v1.x.x | ❌ Deprecated/Unsupported | Must migrate to v4.x.x |
| v2.x.x | Client-side | v1.x.x | ❌ Deprecated/Unsupported | Must migrate to v4.x.x |
| v4.0.0+ | Client-side | v4.0.0 | ✅ Current | N/A |
BSD 3-Clause License
Copyright (©) 2026, Alexander Suvorov
Alexander Suvorov - GitHub
- Issues: GitHub Issues
- Documentation: This README