Case study
2026
LoPW
A password manager for Windows and Android with no server at all. Devices sync straight to each other over the local network.
- Client Personal project
- Discipline Desktop App
- Duration Ongoing
- Budget band Personal project
The problem
Every mainstream password manager asks you to put the one thing you least want on somebody else’s computer onto somebody else’s computer. The encryption is usually sound. The architecture still means a breach of their infrastructure is a problem for you.
What I did
Local only, for Windows and Android. Every secret is sealed in Rust: Argon2id derives the key, XChaCha20-Poly1305 encrypts the vault, and the plaintext is zeroized immediately after use rather than left in memory.
The vault never touches a server. Devices sync directly to each other across the local network over an encrypted Noise handshake, paired by QR code or a short code, merging on last write.
Removing the server removes an entire category of risk. There is no account to breach, no hosting to trust, and nothing to keep paying for.
Outcome
A working vault on two platforms with no backend, no account, and no subscription.
It is on this site because it is the clearest example of a habit worth having: ask whether the server is load bearing at all. Often the honest answer is that it exists to create a subscription rather than to solve a problem.