DevVault Local password vault
Secure Credential, Secret & Security Academy Tracker
Password safety
This web app stores passwords locally. Copy and paste into other apps; it cannot provide iOS system Password AutoFill. Keep encrypted backups in Files.
Switching apps locks immediately. Clipboard clearing requires a tap and can fail if iOS denies access.
Offline setup pending
All Stored Items
Showing 0 itemsSecurity Academy
Building secure applications requires robust threat modeling, zero-trust mindset, and rigorous credential hygiene. Explore our curated best practices for offline vault management, API token lifecycles, passkeys, and cryptography.
1. Master Passwords & Entropy
Your master password is the cryptographic seed that protects all stored items through PBKDF2 (100,000 iterations) and AES-GCM encryption. Never reuse your master password anywhere else.
- Use random passphrases or 20+ character generated strings.
- Store your encrypted backup JSON across multiple offline drives.
- Never store your master password in plaintext notes or sticky notes.
2. WebAuthn & Passkeys
Passkeys replace passwords with cryptographic key pairs bound securely to your hardware (Windows Hello, Touch ID, or YubiKey). They are phishing-proof because private keys never leave your device.
- Immune to credential stuffing and phishing websites.
- Biometric verification confirms physical device presence locally.
- Always maintain your master password as a secure fallback.
3. API Key & Secret Rotation
Leaked API keys (AWS, Stripe, GitHub PATs) are automatically scraped by bots within minutes. Treat every API secret with extreme confidentiality and establish regular rotation schedules.
- Never commit `.env` files or hardcode secrets into client-side JS.
- Restrict API key IAM permissions to least privilege necessary.
- Rotate keys immediately if an endpoint or repository is exposed.
4. Zero-Trust & Clipboard Security
Operating offline ensures zero data telemetry leaves your local machine. Furthermore, clipboard security measures automatically wipe sensitive data from your system memory after 45 seconds.
- 45-second auto-clearing timer prevents clipboard hijacking.
- 100% client-side Web Crypto API execution with zero cloud storage.
- Portable single-file HTML lets you run securely from encrypted USB drives.