🔐 Mis Contraseñas

A secure, portable password manager that runs entirely in your browser — no server, no account, no tracking. Just one HTML file standing between your passwords and the world.

→ Open the app

Why

Most password managers ask you to trust a company with your data. This one doesn't ask — because it can't. There's no backend to send anything to. Everything happens on your own device, encrypted before it ever touches disk.

Features

• Strong encryption at rest — AES-256-GCM with a PBKDF2-derived key (250,000 iterations) from your master password
• Installable PWA — add it to your home screen and it works offline, on phone or desktop
• Enforced strong master password — minimum 8 characters with upper/lowercase, numbers, and symbols
• Optional biometric unlock — Face ID / Touch ID / fingerprint via WebAuthn, never replacing your master password, only speeding up access on your own device
• Breach checking — check your passwords against Have I Been Pwned using k-anonymity, so your real password never leaves your device
• Password health dashboard — flags reused, weak, old, or breached passwords at a glance
• Encrypted backup & restore — export a single encrypted .json file, import it on any device with the same master password
• CSV import — bring in passwords exported from Chrome or other browsers without overwriting what you already have
• Auto-lock — locks itself after inactivity or when backgrounded, with a short grace period so you can still paste a copied password
• Dark mode, categories, favorites, trash, and drag-to-reorder

How it's built

A single index.html file — vanilla HTML, CSS, and JavaScript. No frameworks, no build step, no dependencies. Encryption is handled entirely by the browser's native Web Crypto API.

index.html   → the entire app
sw.js        → service worker (offline support)
manifest.json → PWA metadata

Running it yourself

No installation needed — just open index.html in a browser. To serve it locally (required for installable PWA features and the master-password strength checks to work the same way they do in production):

# any static file server works, for example:
npx serve .

Security model, briefly

• Your master password is never stored, never leaves your device, and can't be recovered if you forget it.
• The exported backup file only contains your encrypted vault (plus your optional password hint, in plain text) — nothing else. No settings, no biometric data, nothing that could help an attacker without your master password.
• Biometric unlock (if enabled) is bound to the specific device's secure hardware — it can't be used on another device, even with the same backup file.

License

Personal project, shared as-is.