I don’t think every password manager is bad.
I think the problem is worse than that: I often have no idea what I’m actually trusting.
At some point, most password managers ask me to accept a black box. Where is my vault stored? What metadata is visible? What touches my secrets before encryption? What happens during sync? What does account recovery really imply? Which service, extension, update system, employee permission, dependency, or cloud provider am I silently trusting?
Maybe the answers are good.
But “maybe” is not a word I like around passwords.
That’s why I built Passly: a small command-line vault for passwords and private documents.
No hosted service.
No account.
No subscription.
No runtime dependencies.
Just encrypted files on my machine, unlocked by one master password, and synced through git if I choose to sync them.
I wanted to know exactly where my secrets are
The core idea behind Passly is intentionally boring: