Everything Saltcellar does, and how.

Saltcellar runs on Windows 10 or 11, 64-bit, with WebView2, which is built into Windows 11 and into any Windows 10 kept up to date.

• Download Saltcellar-<version>.exe and SHA256SUMS.txt from the same release, under Assets on the latest release.
• Check the download, as below.
• Run it. The builds are not code-signed yet, so SmartScreen asks first: choose More info, then Run anyway.
• Put the exe wherever you keep your tools. To remove Saltcellar, delete it.

Check the download

The checksum proves the file is the one the release published. The two hashes must be identical.

(Get-FileHash .\Saltcellar-<version>.exe -Algorithm SHA256).Hash.ToLower()
Get-Content .\SHA256SUMS.txt

The attestation proves the file was built by this repository's release workflow from a tagged commit. It needs the GitHub CLI.

gh attestation verify Saltcellar-<version>.exe --repo akshit-bansal11/saltcellar

The master password must be at least 15 characters, and Saltcellar refuses passwords that appear in public lists of leaked passwords. A few random words make a strong password that is easy to remember. Once it is entered, everything is open: reading, adding, editing, copying and deleting. Deleting asks you to confirm.

Then you choose what happens if you forget it:

• A recovery key (recommended). Saltcellar shows a 32-character key once, and asks you to type it back to prove you saved it. Write it on paper and keep it away from the PC. If you forget the master password, the recovery key opens the vault and you choose a new password; you then get a new recovery key and the used one stops working.
• No recovery. Only the master password opens the vault. Forget it and everything in it is gone, for you and for anyone else.

• Type a name and value in the last row and press Enter to add a key.
• Show, copy, edit and delete are on each row. Values stay hidden until you show one, and only one is shown at a time.
• Copying clears the clipboard after 30 seconds, and a thin line in the status bar counts it down. Copied values stay out of Win+V history and cloud clipboard.
• Generate a password with the dice button or Ctrl+G: a length from 8 to 128, and which characters to use. Copy it, or choose Use as new key to put it in the last row.
• Projects keep the same key name apart: DATABASE_URL can exist once in web and once in api. New keys go to default unless you pick another.
• Names use letters, digits and _ - . /, and match regardless of case.
• The app locks itself after 5 minutes without use, on Ctrl+L, and whenever it is closed. The window is hidden from screenshots and screen sharing.

The keyboard

Everything works from the keyboard. Press F1 (or ?) for the full list: Ctrl+N adds a key, Ctrl+Shift+N makes a project, Ctrl+PgUp and Ctrl+PgDn switch projects, Ctrl+F searches, Ctrl+G opens the generator, Ctrl+, opens settings and Ctrl+L locks. In the rows, Up, Down, Home and End move, Enter shows, Ctrl+C copies, F2 edits and Del deletes.

Settings → Export backup… asks for your master password again, then where to save. The backup is the vault file itself, still encrypted: it opens with the master password, or the recovery key, the vault had when you exported it. Keep one on a USB drive or another disk.

To move to a new PC, or after losing the disk, start Saltcellar with no vault and choose Restore from a backup…. Saltcellar never restores over an existing vault.

• vault.lokey: the vault.
• vault.lokey.bak: the version before the last change.
• lockout.json: the count of wrong passwords, shared by every window.
• migration.log: only if a lokey vault was copied in, or a copy failed.

Set SALTCELLAR_DIR (or the older LOKEY_DIR) to keep them somewhere else. Local, not roaming: Windows never syncs the folder. The files keep the .lokey extension from the app's previous name; the format inside is the same.

Two Saltcellar windows can be open at once: every change takes a lock on the file, reads it fresh, applies one change and writes it back whole, so the two never overwrite each other.

• Close lokey first, every window of it.
• Start Saltcellar. If %LOCALAPPDATA%\lokey holds a vault and %LOCALAPPDATA%\saltcellar does not, it copies vault.lokey, vault.lokey.bak and lockout.json across, then asks for your master password as before. The status bar says the vault was copied, and migration.log records it.
• Once Saltcellar has opened your vault and you have checked your entries, delete %LOCALAPPDATA%\lokey and lokey.exe yourself. Saltcellar never does.

What the copy does and does not do

• It copies, never moves. The lokey folder is only read: nothing in it is changed, moved or deleted, so lokey still opens it if anything goes wrong.
• It happens once. If the Saltcellar folder already holds a vault, nothing is copied and both are left alone.
• It is skipped when SALTCELLAR_DIR or LOKEY_DIR is set: Saltcellar opens the folder you chose.
• If the copy fails, Saltcellar shows the reason instead of offering to create a new vault, records it, and tries again on the next start.
• The vault format is unchanged. Backups made by lokey restore in Saltcellar.

How the vault is sealed

• Your entries are encrypted with AES-256-GCM under a random 256-bit data key.
• The data key is stored at most twice, each copy encrypted: once under a key derived from your master password, and once under a key derived from the recovery key if you have one. Both derivations use Argon2id at 64 MiB, 3 passes and 1 lane, with a random 16-byte salt.
• Changing the master password, or making or removing a recovery key, replaces the data key. An old password or recovery key opens only copies of the file made before the change.
• Every header field an attacker could weaken, among them the salt and the cost settings, is bound into the encryption. A changed file fails to open rather than opening weakened or wrong. A file asking for less than 19 MiB, or more than 1 GiB, is refused.
• Wrong passwords and recovery keys wait 1 second, doubling to 30, and 10 in a row lock the vault for 15 minutes.
• Exporting a backup, changing the master password and making or removing a recovery key each ask for the master password again, even with the vault open.
• Keys, decrypted entries and generated passwords are wiped from memory when they are dropped.

What it cannot protect you from

• Malware already running as you, which can record the password as you type it or read the screen.
• A weak or reused master password. Anyone with a copy of the file can guess offline for as long as they like; the lockout lives beside the vault and does not slow them.
• Someone who finds your recovery key. It opens the vault as fully as the password does.
• Someone at your PC while the vault is unlocked, until it locks.
• Old copies: a backup or vault.lokey.bak opens with the password and recovery key it had.
• SSDs keeping old blocks after a file is rewritten. Full-disk encryption (BitLocker) covers that, and the stolen-laptop case.

npm ci
npm run check                 # format, lint, type-check, all tests, build the page
npx tauri build --no-bundle   # target/release/saltcellar.exe

npm run check:ci runs the same checks without changing any file; CI runs that. Releases are built by GitHub Actions from a tagged commit that passed every check, with each third-party action pinned to an exact commit, and carry SHA256SUMS.txt and a signed build attestation. CONTRIBUTING.md has the rest.