# PasswordSafely

> PasswordSafely is a free, local-first, zero-knowledge vault and laboratory for passwords, keys, and secrets. Encryption runs in the browser. PasswordSafely does not hold a master key, a copy, a hint, or a recovery escrow.

## Site
- Home: https://passwordsafely.com/
- Laboratory: https://passwordsafely.com/tools/
- Contact: hello@passwordsafely.com
- Publisher: Estatem — https://estatem.com

## What PasswordSafely is
A client-side chamber for secrets. Ciphertext can rest on a disk. The meaning of it cannot leave the user’s device. Forgotten is forgotten — that is the cost of having no master key on the operator’s side.

The homepage bench forges a credential, seals plaintext with AES-256-GCM, and autopsies passphrase strength. Twelve laboratory instruments sit at /tools/. Each tool runs in the tab. Close the tab and working memory is gone.

## What PasswordSafely is not
- Not a cloud password manager
- Not an account, identity, or sync service
- Not a recovery / escrow service — lost passphrases cannot be reset
- Not a place that receives vault plaintext, PINs, Wi-Fi keys, or pasted secret lists
- Not legal advice, not a warrant, not a backdoor

## How sealing works
1. The user types a secret and a passphrase in the browser
2. The passphrase is stretched with PBKDF2-SHA-256 (310,000 iterations)
3. AES-256-GCM seals the secret (IV + ciphertext + auth tag)
4. The JSON blob is inert without the passphrase. Nothing is uploaded to PasswordSafely

## Privacy model
Zero-knowledge / local-first: passphrases, vault plaintext, recovery phrases, PINs, Wi-Fi keys, and pasted lists are not uploaded. There is no PasswordSafely account, no identity cookie, and no advertising pixel.

The only network exception is the breach check (LAB.02): a SHA-1 hash is computed in the tab; only the first five hexadecimal characters are sent to Have I Been Pwned’s k-anonymity range API (api.pwnedpasswords.com), with padding. The remainder of the hash never leaves the tab. Email lookups open on HIBP’s own site.

Ordinary hosting logs (IP, user-agent, path), if present, are infrastructure — not content. They cannot reconstruct what was typed into the vault.

## Laboratory (all client-side)
- LAB.01 Entropy — https://passwordsafely.com/tools/entropy — crack-time / search-space calculator
- LAB.02 Breach — https://passwordsafely.com/tools/breach — HIBP k-anonymity password check
- LAB.03 Migrate — https://passwordsafely.com/tools/migrate — offline converter (Chrome, LastPass, Bitwarden, 1Password exports)
- LAB.04 Wi-Fi — https://passwordsafely.com/tools/wifi — printable guest Wi-Fi QR plate
- LAB.05 PIN — https://passwordsafely.com/tools/pin — 4- and 6-digit PIN pattern autopsy
- LAB.06 Decoy — https://passwordsafely.com/tools/decoy — honeypot identities and Luhn-valid test cards marked DECOY (not payment instruments)
- LAB.07 Derive — https://passwordsafely.com/tools/derive — site-bound password from a master phrase + host
- LAB.08 Split — https://passwordsafely.com/tools/split — Shamir k-of-n over GF(256)
- LAB.09 Reuse — https://passwordsafely.com/tools/reuse — local reuse / near-duplicate scan (masked report)
- LAB.10 Duress — https://passwordsafely.com/tools/duress — one blob, two passphrases (truth / prepared lie)
- LAB.11 Stego — https://passwordsafely.com/tools/stego — hide sealed JSON in a PNG field plate
- LAB.12 Questions — https://passwordsafely.com/tools/questions — forged security-question answers for the user’s own accounts

## Key terms
- Zero-knowledge — the operator cannot read user secrets because they never arrive
- Local-first — cryptography and laboratory tools run in the browser
- No master key — PasswordSafely cannot unseal a blob or reset a passphrase
- k-anonymity (HIBP) — only a 5-character SHA-1 prefix is queried; the password itself is not sent

## Lawful use
Defensive instruments. Do not use the laboratory to commit fraud, traffic in stolen credentials, or evade lawful process. Decoy records and test cards are marked as such. Security-question forgeries are for protecting the user’s own accounts — not impersonation.

## Also in the house
Sister privacy tools published by Estatem (not PasswordSafely):
- Privacyimage — https://privacyimage.com — client-side image privacy; nothing leaves the tab
- BrowserSpaces — https://browserspaces.com — your browser, your space, your data
- SandboxGate — https://sandboxgate.com — reclaim your digital real estate
- FaceIV — https://faceiv.com — Invalidate Vision; client-side photo protection against unauthorized face recognition

## Publisher
Proudly powered by Estatem.com — Tech for Good | Securing Your Digital Real Estate