PWDnow

Spec sheet

Purpose

PWDnow is a zero-knowledge, local-first password manager whose Rust daemon handles cryptography while the web interface exchanges encrypted data with it.Read 12 Oct 2026 · github.com

Product

PWDnow is a zero-knowledge, local-first password manager.Read 12 Oct 2026 · github.com

Deployment

PWDnow can run offline on one machine or be deployed behind Nginx with TLS for LAN or self-hosted server access.Read 12 Oct 2026 · github.com

Authentication

It supports WebAuthn and FIDO2 hardware keys and platform authenticators, TOTP and HOTP, passkeys, and configurable per-account MFA enforcement.Read 12 Oct 2026 · github.com

Breach checks

PWDnow checks passwords against a local Have I Been Pwned corpus filter, without a network lookup for each password.Read 12 Oct 2026 · github.com

Credential storage

Credentials can include passwords, TOTP secrets, notes, and custom fields, organized in folders.Read 12 Oct 2026 · github.com

Credential tools

Credentials can be organized into folders and include passwords, TOTP secrets, notes, and custom fields; the app also scores password strength and detects reuse and common passwords.Read 12 Oct 2026 · github.com

Cryptography

The project describes hybrid X25519 and ML-KEM key encapsulation enabled by default, ML-DSA signatures, Argon2id key derivation, and AES-256-GCM and XChaCha20-Poly1305 encryption.Read 12 Oct 2026 · github.com

Data protection

The project says vault data is stored in an SQLCipher-encrypted database and that master and derived keys remain in the daemon rather than the browser layer.Read 12 Oct 2026 · github.com

Imports and exports

PWDnow imports Bitwarden, 1Password, and NordPass exports, and supports JSON, CSV, KeePass-compatible XML, and its encrypted .p2w export format.Read 12 Oct 2026 · github.com

Install requirements

Building from source requires Node.js 24 or newer, Rust 1.94 or newer, protoc, and development headers for libsodium, SQLCipher, and libfido2.Read 12 Oct 2026 · github.com

License and pricing

The repository identifies the project as MIT-licensed and does not state a product price or subscription plan.Read 12 Oct 2026 · github.com

Local-first design

The project says cryptographic operations run in a Rust daemon on the machine where the vault lives, while the web interface forwards encrypted requests and does not hold key material.Read 12 Oct 2026 · github.com

Offline use

It can run offline on one machine, with no cloud sync by default and no telemetry.Read 12 Oct 2026 · github.com

Optional strict mode

An optional CNSA 2.0 strict mode restricts the daemon to the algorithms listed in the README for that mode.Read 12 Oct 2026 · github.com

Passkey support

YesRead 16 Sep 2026 · github.com

Password checks

It scores password strength, detects reuse and common passwords, and checks breaches against a local Have I Been Pwned corpus filter without a per-lookup network call.Read 12 Oct 2026 · github.com

Passwordless account login

YesRead 16 Sep 2026 · github.com

Security modes

Features include duress mode, travel mode, lockout backoff after failed unlock attempts, and time-delayed emergency access for a trusted contact.Read 12 Oct 2026 · github.com

Security reporting

The project asks vulnerability reporters to use GitHub private vulnerability reporting or contact the maintainers directly instead of opening a public issue.Read 12 Oct 2026 · github.com

Security reports

The project asks users to report vulnerabilities through GitHub's private vulnerability reporting or directly to maintainers, rather than through a public issue.Read 12 Oct 2026 · github.com

Supported platforms

Linux,web interface,self-hostedRead 16 Sep 2026 · github.com

Supported systems

The project says it is developed and tested primarily on Ubuntu 26.04 LTS, and its installer also supports Debian-derived and Fedora or RHEL-family distributions; it has no macOS or Windows build.Read 12 Oct 2026 · github.com

Vault storage

The vault daemon stores credentials in an encrypted SQLCipher database, and the project says there is no cloud sync by default.Read 12 Oct 2026 · github.com

Where Specifiction places it

• Password Managers#75 of 1047.5