DEV Community

shc_dev
shc_dev

Posted on

Why I Built a Local-First Password Manager Instead of Another Cloud Vault

#flutter #privacy #security #software

Most password managers solve the same problem the same way: encrypt locally, then ship a synced copy to their cloud.

That model works. It’s also a huge blast radius. One vendor outage, one account takeover, one compliance surprise—and every device that trusts that sync plane is in the story.

I wanted a different default: your vault lives on your devices. Sync is optional, and when you use it, it stays on your network—not a hosted vault backend you have to trust forever.

That’s SafeVault (Password Safe Vault): a Flutter password manager with AES-256-GCM encryption, a security dashboard, and desktop workflows built for people who live in a keyboard.

The problem I kept hitting

  1. Cloud sync is convenient until it isn’t. Privacy-conscious users (and a lot of developers) don’t want a third party holding an encrypted blob of their entire digital life by default.
  2. Desktop managers often feel like mobile apps stretched sideways. Searching and copying a password should be a hotkey, not a full-window safari.
  3. Security theater is easy; hygiene is hard. Weak, reused, and ancient passwords need a dashboard you actually open—and a one-tap path to fix them.

What SafeVault does

Core vault

  • Store credentials by category (email, social, banking, custom)
  • Unique titles per category (no silent duplicates)
  • Strong password generator (length, charset, live strength)
  • Fast search / filter; pin a category from search
  • JSON import / export with merge that respects updatedTime

Security

  • AES-256-GCM for vault data at rest
  • Platform secure storage for keys (Keychain, Credential Manager, etc.)
  • PIN lock + biometric unlock where the OS supports it
  • Auto-lock, manual lock, optional clipboard auto-clear
  • Security dashboard: score + weak / reused / old passwords, with inline fixes

Multi-device, without “upload your vault to us”

SafeVault’s multi-device story is local-first: move data between your devices over nearby / local-network sync paths you control. Your hardware stays the source of truth.

Desktop (macOS & Windows)

  • Close window → hide to background (tray + hotkeys keep working)
  • System tray: Show / Quick Search / Quit
  • Global Quick Search: ⌘⌃P (macOS) / Ctrl+Alt+P (Windows) — find and copy without opening the full vault UI

Platforms & languages

iOS, Android, macOS, Windows — with 13 locales including English, 简体中文, 繁體中文, Japanese, Korean, and more.

Technical notes (for the curious)

SafeVault is built with Flutter / Dart. Encryption uses industry-standard AES-GCM. Sensitive material is kept out of casual storage APIs; keys lean on OS secure storage. On desktop, window/tray/hotkey behavior is wired so the app stays useful as a background utility, not only as a full window.

I’m not claiming “unbreakable.” I’m claiming a clear threat model: minimize who can ever see ciphertext of your vault, and keep sync under your physical control when you need more than one device.

Who it’s for

  • Developers and power users who want local-first defaults
  • People tired of “free” managers funded by upsells and feature gates
  • Anyone who wants a security dashboard that leads to actual password fixes
  • Desktop users who want hotkey → copy password → done

Who it might not be for

  • Teams that need enterprise admin, shared company vaults, and SSO-gated policies out of the box
  • Users who want zero-effort sync across continents without touching local network / device transfer flows

That’s fine. Different tools, different trust models.

Try it

If you try it, I’d love feedback on:

  1. Does local-first sync match how you actually move between phone and laptop?
  2. Is Quick Search the right desktop primitive, or do you want browser autofill first?
  3. What would make the security dashboard something you open weekly?

Closing

Cloud vaults aren’t evil. They’re a tradeoff.

SafeVault is my bet on the other side of that tradeoff: encryption you can reason about, storage you can point to, and sync that doesn’t require believing in someone else’s infrastructure forever.

Your passwords. Your devices. Your vault.

Top comments (0)