Show HN: Paasword – a password vault that never stores your passwords

1 yoyo250 2 9/14/2025, 1:00:29 PM github.com ↗

Warning: pre-release, unaudited, not for production use. (Though my password was generated with it)

Instead of saving secrets, it derives them on demand using domain + username + a short passphrase + a physical OpenPGP key (smartcard/YubiKey).

Passwords are reproducible but never persisted.

Currently tested only with RSA4096 on Windows + GnuPG 2.4.x.

Comments (2)

zahlman · 2h ago

> a physical OpenPGP key (smartcard/YubiKey)

I don't know how you get a reproducible value from this, but in the use described it isn't actually contributing a second factor.

yoyo250 · 1h ago

You're right — it's not a true "second factor" in the 2FA sense.

The idea is to bind password derivation to a physical OpenPGP key.

Without the smartcard/YubiKey inserted, the program can't generate the same password, even if someone knows the domain/username/phrase.

So the key isn't used as extra entropy, but as an essential part of the derivation process.

EPA Seeks to Eliminate Critical PFAS Drinking Water Protections (earthjustice.org)

Models of European Metro Stations (stations.albertguillaumes.cat)

Fukushima Insects Tested for Cognition (news.cnrs.fr)

CorentinJ: Real-Time Voice Cloning (2021) (github.com)

Observable Notebooks Data Loaders (observablehq.com)

Geedge and MESA leak: Analyzing the great firewall’s largest document leak (gfw.report)

Refurb Weekend: Silicon Graphics Indigo² Impact 10000 (oldvcr.blogspot.com)

A single, 'naked' black hole confounds theories of the young cosmos (quantamagazine.org)

SpikingBrain 7B – More efficient than classic LLMs (github.com)

Gemini (2023) (geminiquickst.art)

Two Slice, a font that's only 2px tall (joefatula.com)

Show HN: A store that generates products from anything you type in search (anycrap.shop)

macOS Tahoe is certified Unix 03 [pdf] (opengroup.org)

Pass: Unix Password Manager (passwordstore.org)

MIT-MC CP/M archive files, 1979-1984 (github.com)

The PC was never a true 'IBMer' (thechipletter.substack.com)

Cat Aquariums (cataquariums.com)

Dynamic Bird Migration Map (explorer.audubon.org)

The unreasonable effectiveness of modern sort algorithms (github.com)

Will AI be the basis of many future industrial fortunes, or a net loser? (joincolossus.com)

The Socratic Journal Method: A Simple Journaling Method That Works (mindthenerd.com)

How the restoration of ancient Babylon is drawing tourists back to Iraq (theartnewspaper.com)

Repetitive negative thinking is associated with cognitive function decline (bmcpsychiatry.biomedcentral.com)

AMD’s RDNA4 GPU architecture (chipsandcheese.com)

A Trick for Backpropagation of Linear Transformations (tripplyons.com)

Recreating the US/* time zone situation (rachelbythebay.com)

486Tang – 486 on a credit-card-sized FPGA board (nand2mario.github.io)

Myocardial infarction may be an infectious disease (tuni.fi)

RIP pthread_cancel (eissing.org)

The case against social media is stronger than you think (arachnemag.substack.com)

My first impressions of Gleam (mtlynch.io)

The rules behing Rust functions (blog.cuongle.dev)

Four-year wedding crasher mystery solved (theguardian.com)

Adding OR logic forced us to confront why users preferred raw SQL (signoz.io)

Visual programming is stuck on the form (interjectedfuture.com)

Lexy: A parser combinator library for C++17 (github.com)

Safe C++ proposal is not being continued (sibellavia.lol)

How Ruby executes JIT code (railsatscale.com)

Show HN: CLAVIER-36 – A programming environment for generative music (clavier36.com)

Logfire – OpenTelemetry based tracing SaaS (pydantic.dev)

Show HN: Ultraplot – A succint wrapper for matplotlib (github.com)

The Software Engineers Paid to Fix Vibe Coded Messes (404media.co)

An Inline Cache Isn't Just a Cache (mgaudet.ca)

Open Source SDR Ham Transceiver Prototype (m17project.org)

Why are so many young, fit, non-smoking women getting lung cancer? (theguardian.com)

Harvard Students prove Meta glasses could find anyone in seconds (reddit.com)

Java 25's new CPU-Time Profiler (mostlynerdless.de)

Orange rivers signal toxic shift in Arctic wilderness (news.ucr.edu)

Perceived Age (2024) (sdan.io)

How to get samples back from Mars (caseyhandmer.wordpress.com)

Show HN: Paasword – a password vault that never stores your passwords

Comments (2)