AeroPad
Secrets stay in your browser. Vault content is encrypted at rest. No account. No telemetry.
AeroPad is a static web application for people who want a focused, local-first place to work with TOTP credentials, QR codes, and private notes. It has no backend, account system, remote search index, or analytics pipeline.
Why AeroPad?
Most authenticator apps optimize for cloud sync. AeroPad optimizes for a different workflow: a small, inspectable, offline-friendly security workbench that can be opened locally, used during a migration or recovery session, and backed up as an encrypted portable file.
| Capability | What you get |
|---|
| Live TOTP vault | RFC 6238 codes with SHA-1, SHA-256, SHA-512, 6/8 digits, and per-account periods |
| QR studio | Generate QR codes and decode otpauth://totp/ imports in the browser |
| Encrypted vault | One versioned IndexedDB snapshot protected with AES-256-GCM and PBKDF2-HMAC-SHA256 |
| Encrypted recovery | Export and restore a versioned .aeropad backup; no plaintext secret export flow |
| Private notes | Markdown editor, local search, metrics, and text/Markdown export |
| Self-hosted runtime | Vendored fonts and QR libraries, self-only CSP, and a standalone HTML build |
Screenshots
Security model
AeroPad encrypts vault bytes before persistence and keeps the master-key material in the unlocked browser session. The vault is a web application, so plaintext necessarily exists in memory and selected DOM controls while it is open.
The practical boundary is important:
- AeroPad does not upload vault content.
- A compromised deployment, malicious update, hostile same-origin script, browser extension, or compromised browser can read data while the vault is unlocked.
- There is no master-password recovery. Forgetting the password can make the vault unrecoverable.
- Browser storage can be cleared or evicted. Keep an encrypted
.aeropad backup somewhere you control and test restoring it.
- The project is not a substitute for an independent security audit or a provider’s account-recovery plan.
Read the complete threat model and data-handling policy in docs/SECURITY-AND-PRIVACY.md.
Supported languages
English, Tiếng Việt, 简体中文, 한국어, 日本語, Español, Bahasa Indonesia, العربية (RTL), हिन्दी, and Português.
Run locally
Requirements: Node.js 20+ and npm.
git clone https://github.com/oaichu/aeropad.git
cd aeropad
npm ci
npm run verify
npm run build
Serve the repository over HTTP for local use, for example:
python3 -m http.server 4173
Then open http://127.0.0.1:4173/. Use HTTPS or localhost when testing browser APIs in a deployment-like environment.
Build outputs
src/ is the canonical source tree. The build produces the deployable root bundle, dist/, public/, and the standalone file.
src/ canonical application and security modules
tests/ unit and contract tests
scripts/e2e-verify.mjs browser-level regression suite
vendor/ self-hosted fonts and QR dependencies
docs/screenshots/ repository screenshots used above
dist/ Cloudflare Pages artifact
public/ Vercel/static artifact
aeropad-standalone.html single-file build
npm run verify runs the claim-policy check, unit tests, browser-level E2E checks, build, artifact parity checks, and dependency validation.
Contributing
- Read DESIGN.md, docs/architecture.md, and the relevant files in
specs/.
- Keep crypto and storage behavior in
src/; do not duplicate production engines in generated bundles.
- Add a regression test for security, parsing, storage, or accessibility changes.
- Run
npm run verify before opening a pull request.
Please report security issues privately rather than publishing an exploit in a public issue. See docs/SECURITY-AND-PRIVACY.md for the current disclosure boundary.
💖 Support & Buy Me a Coffee
AeroPad is 100% free, local-first, and open-source, with zero telemetry and zero server dependencies.
If AeroPad helps you protect your 2FA credentials or simplifies your offline security workflows, please consider supporting ongoing maintenance and updates:
License
AeroPad is released under the MIT License. Shipped third-party assets are documented in THIRD_PARTY_NOTICES.md.
