SaltcellarLocal · Encrypted · Windows
Your secrets, sealed on your own PC.
Saltcellar keeps your passwords, environment keys and backup codes in one encrypted file on your Windows PC. One window, one file, one master password. No account, no sync, and no network code at all.
- No account
- No cloud
- No telemetry
- MIT licensed
- Cipher
- AES-256-GCM
- Key derivation
- Argon2id, 64 MiB, 3 passes
- Network code
- None
- Runs on
- Windows 10 and 11, x64
What it stores
The secrets that should stay put.
Keys and values, grouped by project, in a sheet you drive from the keyboard. Everything is in one file, encrypted as a whole.
Environment keys
The DATABASE_URL, the API token and the signing secret for each thing you build, kept by project, so the same key name can exist once in web and once in api.
Passwords
Anything you would otherwise keep in a text file. Values stay hidden until you show one, and only one is shown at a time.
Backup codes
The one-time codes a site gives you once and never again. A value can be up to 64 KiB.
New passwords
The generator (the dice button, or Ctrl+G) draws from the operating system's random number generator: 8 to 128 characters, from the sets you choose, every chosen set present at least once.
Kept off the clipboard's record
A copied value is kept out of Win+V history and cloud clipboard, and cleared after 30 seconds unless you copied something else.
Hidden from the screen
The window is left out of screenshots, recordings and shared screens, so a value on show does not end up in a video call.
Why local-only
No cloud is the feature.
A password manager with sync is a service you trust to keep a copy of every vault. Saltcellar has no copy to keep.
There is nothing to breach
No account, no server and no sync means no database of vaults anyone can take at once. Your vault is one file, and it is on your disk.
Nothing can phone home
The app contains no network code at all. Its content security policy allows only its own files and the channel to its Rust side, so the window cannot make a request even if asked to.
Nothing syncs behind your back
The vault lives under %LOCALAPPDATA%, not the roaming profile, so Windows never copies it to another machine. A backup goes only where you save it.
How the encryption works
Two keys, one file.
Standard primitives from RustCrypto's aes-gcm and argon2 crates, combined in Rust you can read in crates/saltcellar-core.
- 1
Your password becomes a key
Argon2id turns the master password and a random 16-byte salt into a 256-bit key, using 64 MiB of memory and 3 passes. Every guess against a stolen file pays that cost again.
- 2
That key seals a random data key
A random 256-bit data key is sealed with AES-256-GCM under the password's key and, if you made one, under the recovery key's. Changing either replaces the data key, so an old password opens only old copies.
- 3
The data key seals your entries
The entries are sealed with AES-256-GCM under the data key. The salt and the cost settings are bound into the encryption, so an edited file fails to open instead of opening weakened.
Guessing at the prompt
Wrong passwords wait 1 second, doubling to 30, and 10 in a row lock the vault for 15 minutes. That stops someone at the keyboard; against a copied file only the password's strength and Argon2id's cost stand in the way, which is why a new master password must be at least 15 characters and not on a list of leaked ones.
The cost
What it will not do.
Keeping everything on one PC has a price. Nothing here is hidden because it is inconvenient.
- Sync. Nothing leaves the PC, so the vault is not on your phone or your other computers.
- Bring a vault back without a backup. If the disk dies, an exported backup is the only way back.
- Let you in without the master password or the recovery key. There are no hints, no security questions and no reset by email.
- Protect you from malware already running as you. A program that can read your keystrokes or your screen can read your vault as you use it.
- Run anywhere but Windows, for now. The clipboard and window protections are Windows APIs.
- Come signed. The exe is not code-signed yet, so SmartScreen warns the first time; the checksum and the build attestation are how you check it.
Get it
One portable exe.
No installer, no administrator rights, nothing written outside your own user folder. Download Saltcellar-<version>.exe and SHA256SUMS.txt from the same release, check them, and run it.
- 1Download the exe and SHA256SUMS.txt from the latest release.
- 2Check the hash, and the attestation if you have the GitHub CLI.
- 3Run it. SmartScreen asks first: More info, then Run anyway.
- 4Choose a master password, and a recovery key to write on paper.
gh attestation verify Saltcellar-<version>.exe --repo akshit-bansal11/saltcellarProves the file came from this repository's release workflow, at a tagged commit. Coming from lokey? The first start copies your vault across and leaves the old one alone.