| ▲ | Show HN: Sesame - a local-first, open-source password manager(usesesame.app) |
| 22 points by d0mkaaa 4 hours ago | 22 comments |
| I have been working on Sesame, an open-source password manager that keeps your vault local by default. You don't need an account to create or use a vault, and the hosted service never receives the vault itself.
It's still early software and the independent security review isn't finished yet, so I am mainly interested in feedback, testing, and people looking through the code. (Linux support is yet to be released on v0.1.2, but currently is in the works.) |
|
| ▲ | thehamkercat an hour ago | parent | next [-] |
| A vibe-coded password-manager? Sure! where do i sign up? |
|
| ▲ | danielmartins an hour ago | parent | prev | next [-] |
| I still don’t get why password managers builders think it’s a great idea to store MFA token together with the password, totally defeating the purpose of MFA in the first place. |
| |
| ▲ | epihelix 24 minutes ago | parent | next [-] | | I use this for MFA that's forced upon me, rather than MFA I request and want. (It still protects against a password leak, though, so doesn't entirely defeat the purpose of MFA.) | |
| ▲ | mirzap 15 minutes ago | parent | prev [-] | | Not really. MFA still protects against the much more common case where the password itself is compromised, either through a breach, reuse, phishing, interception, bad storage, etc. An MFA code is short-lived and can’t simply be reused later, unlike a password. Keeping the password and MFA secret in the same password manager reduces separation (if someone fully compromises your vault, they will gain access to both factors). But that doesn’t make MFA pointless; it just means it doesn’t protect you against that particular failure mode. And if someone has full access to your password manager, you already have a much bigger problem. |
|
|
| ▲ | gregable 2 hours ago | parent | prev | next [-] |
| How does it compare to KeePassXC? |
| |
| ▲ | d0mkaaa 2 hours ago | parent [-] | | KeePassXC is definitely much more mature right now. I mean, Sesame is similar in being local-first and not requiring a cloud service, but I am aiming for a more modern consumer style experience. There is still a lot of work ahead to get it up to speed. I might also build more products around it eventually, so there’s a consistent ecosystem. (and of course, it would be great to eventually surpass some of the existing projects :) ) | | |
| ▲ | gonzalohm an hour ago | parent [-] | | What do you mean by a "consumer style experience"? | | |
| ▲ | NewsaHackO 5 minutes ago | parent [-] | | subscription style paid program, of course. Starting at 1 dollar a month now, until they get market penetration, then they will jack up prices (for increased opex, ostensibly). The classic SaaS playbook. |
|
|
|
|
| ▲ | arlattimore 2 hours ago | parent | prev | next [-] |
| I like that this could be self hosted. I don't have anything against the big password managers (I use and pay for one), but they are a massive target for hackers for obvious reasons. If everyone could self host their own vault on a personal domain, the reward for hackers is much more difficult to get access to. |
| |
| ▲ | d0mkaaa an hour ago | parent [-] | | I don't really have anything against the big password managers either. I just don't love having to pay for a full year upfront with some of them. More than that though, a lot of them just don't quite fit what I want, or they feel a bit dated to use, like KeePassXC. That's a big part of why I started building Sesame. (and hoping to expand later on to have a more pleasurable ecosystem) |
|
|
| ▲ | ramon156 4 hours ago | parent | prev | next [-] |
| how does this compare to vaultwarden + bitwarden? my only concern there is that VW can throw self-host support out the door whenever they like. not that they'd have a reason to |
| |
| ▲ | d0mkaaa 4 hours ago | parent [-] | | vaultwarden + bitwarden is way more mature right now, but the main difference is that sesame is local-first by design. Vaultwarden also depends on staying compatible with bitwarden's clients/api, while this owns the whole stack | | |
| ▲ | alacritas0 an hour ago | parent [-] | | bitwarden clients are open source, so it would be possible to fork them if bitwarden ever makes user unfriendly decisions |
|
|
|
| ▲ | vladkens an hour ago | parent | prev | next [-] |
| Again Tauri. How then it different from Bitwarden? Desktop != Web |
|
| ▲ | majorchord an hour ago | parent | prev | next [-] |
| No offense but you might want to consider a different styling for the app/site because IMO this one screams "Claude vibe-code style". |
| |
| ▲ | d0mkaaa an hour ago | parent | next [-] | | Yeah I can see what you mean, but it wasn't really intentional. I mainly wanted to avoid the usual black/blue security-product look. I will probably keep the general direction but give it more of its own identity over time. Thank you for sharing your opinion! | |
| ▲ | thehamkercat an hour ago | parent | prev | next [-] | | it _is_ vibe-coded, you can read the commit descriptions in sesame-desktop repo I wouldn't trust any password manager or critical applications like this written after 2024 bitwarden/KeePassXC are already more than enough | |
| ▲ | Hamuko an hour ago | parent | prev [-] | | It's good that vibecoded software look vibecoded, because I then immediately know not to trust that it works, not to trust that it's secure, and not to trust that the maintainer will give a shit about it in six months. |
|
|
| ▲ | oscarcp an hour ago | parent | prev | next [-] |
| How does it compare to a local deploy of PSONO? |
|
| ▲ | konaraddi 2 hours ago | parent | prev | next [-] |
| Does it purge passwords from memory on vault lock? |
|
| ▲ | cyberax 2 hours ago | parent | prev [-] |
| I don't see the support for passkeys listed anywhere? |
| |
