Ask HN: Feedback on my stateless password manager (no stored secrets)

1 yoyo250 0 9/9/2025, 1:00:29 PM

Hi HN,

I built a prototype password tool that never stores passwords or vaults. Instead, it derives them on the fly using:

* A hardware OpenPGP key (smartcard/YubiKey/etc.)

* User inputs (domain + login + a simple passphrase)

* Deterministic signing + KDF

So as long as you have the hardware key and the same inputs, you can always reproduce the same password. Nothing is stored locally.

Current status:

* Python CLI, pre-release v0.9.0

* Tested only on Windows 10 with RSA4096 keys

* Requires GPG installed

* English default + Chinese i18n (basic)

Limitations:

1. Not audited (research/PoC)

2. Only RSA tested

3. No GUI (TUI planned)

4. Not tested on other platform

5. Some sites may reject the generated charset (You can edit, but it may cause a mess.)

Looking for feedback on:

1. Security flaws in this design?

2. Portability to Linux/macOS and non-RSA keys

3. Possible ways to use hardware keys without shelling out to GPG

4. Usability / UX ideas (TUI, i18n, etc.)

Links:

GitHub: https://github.com/biliyoyo520/paasword/

Blog: https://blog.yoyo250.fun/archives/coding/16.html

Thanks!

US ends international push to combat fake news from hostile states (ft.com)

The Art of Incident Management Pt. 1 (rootly.com)

Trusted Publishing for NPM Packages (docs.npmjs.com)

Replacing SGX with GitHub Actions: Or How to Turn GitHub Actions into a Trusted (ethanheilman.com)

Ukraine Unmanned Drone Tracker (sbs-group.army)

OCR and RAG for Tables (mrm1001.github.io)

Rabbit have overhauled the OS as rabbitOS2 (rabbit.tech)

How to Build Python Code with Bazel (and Why) (ohadravid.github.io)

Show HN: Bifrost – The Build Service for NativePHP Apps (bifrost.nativephp.com)

AQAP likely to encourage further popular protests in Hadramaw (janes.com)

Google to Obey South Korean Order to Blur Satellite Images on Maps (barrons.com)

All unimaginery internet futures are in one place.(free) try now (sites.google.com)

Show HN: DJI360 – DJI Product News and Buying Guide Platform (dji360.com)

How to Use Claude Code Subagents to Parallelize Development (zachwills.net)

India turns to alternative motors amid China's rare earth cut offs (reuters.com)

Could a giant dam save the Atlantic currents that keep Europe warm? (science.org)

Eat Your Vegetables Before AI Dessert (writings.alethia.news)

Toolkit to help you get started with Spec-Driven Development (github.com)

Goals per Week: A Proven Productivity Method for Stem Professionals – Execute3 (execute3.com)

Show HN: Run any GUI app in the terminal with term.everything (github.com)

$1.1M for a Logo, Austin [video] (youtube.com)

I love UUID, I hate UUID (blog.epsiolabs.com)

Show HN: I built a Markdown to HTML converter that fixes AI-generated quirks (markdownhtmlgen.com)

Show HN: Find Your Perfect Pair of Overalls (overallsshop.com)

Show HN: AI agent that clones viral content structures to automate social growth (synthmind.app)

New Data Science LLM Benchmark (proud-botany-7dd.notion.site)

Microsoft inks AI infra deal with Yandex cofounder's biz for nearly $20B (theregister.com)

Preparing for the Worst (daniel.haxx.se)

'It's back to the future': the 13th-century castle built by hand in France (theguardian.com)

Show HN: Next Home Game – Crowd-avoidance alerts for UK football matches (nexthomegame.co.uk)

A Love Letter to Internet Relay Chat (hackaday.com)

Burger King attackers 'impressed by commitment to terrible security practices' (tomshardware.com)

Peon – Prefixed Entry Object Notation (bartoszsypytkowski.com)

A Napa Wine Tour Owner Built One of the Most Efficient Shared Kitchens (thefoodcorridor.com)

mailbox becomes the digitally sovereign workplace (mailbox.org)

The US Tightens the Dollar's Death Grip on Brazilian Democracy (project-syndicate.org)

Why is Bob Smith termination for Ethernet recommended if it's wrong? (electronics.stackexchange.com)

Show HN: Open-source counter strike clone, from scratch, no game engine (solcloud.itch.io)

Show HN: Azure CI/CD Starter Kit with Terraform and GitHub Actions (github.com)

Text Format Feature Matrix (keenwrite.com)

Ask HN: Feedback on my stateless password manager (no stored secrets)

Show HN: Narcissistic Abuse Simulator exposes toxic patterns (narcissisticabusesimulator.com)

Recommended Books for Learning Ruby (rubynewbie.org)

Rendering the Mandelbulb (4rknova.com)

How we SSH into GitHub Actions (blacksmith.sh)

Accessibility might be AI's biggest breakthrough (arstechnica.com)

Show HN: CLI tool to transfer your chats from Telegram to WhatsApp (github.com)

Humanoid Olympic Games (generalrobots.substack.com)

Unredacted Magazine (September 2025 issue) [pdf] (inteltechniques.com)

Air pollution can drive dementia (theguardian.com)

Ask HN: Feedback on my stateless password manager (no stored secrets)

Comments (0)