No recovery. On purpose.
Password managers get breached through the doors they leave open for you. rspm has no reset flow, no support override, no escrow. Lose your credentials and the data is gone — which is exactly why nobody else can get to it.
A really simple password manager
Your vault is public.
On purpose.
rspm encrypts everything on your device, then stores it as identical 4 KB blocks in a bucket anyone can download. There is no database to breach. There is nothing to leak. There is only noise — unless you’re you.
- 0
- dependencies
- 4096
- bytes per block
- 128-bit
- Account Key
api.rspm.me/v1 — public, read-only
Try it
This is everything our server will ever see.
Type a secret. Your browser seals it into a real rspm block with AES-256-GCM — the same format the app uses. On the left, the bytes before encryption. On the right, the bytes that get published.
Every block is the same size. A one-letter note and a thousand-password vault look identical from the outside. Change a single character and every byte changes. Nothing above leaves this page.
Principles
Simple enough to trust. Strict enough to deserve it.
The server is untrusted.
Our worker can create blocks and delete them with a token. That’s it. It never sees a key, a username, or which blocks belong together. If it lies or rolls back your vault, your device notices.
Every block looks the same.
Exactly 4,096 bytes. Names derived from your keys, so blocks can’t be linked to each other or to you. Vaults are padded to a power of two, so nobody can count your passwords.
Zero dependencies.
No frameworks, no packages, no build-time surprises. WebCrypto, WebAssembly we wrote by hand, and plain JavaScript you can read in an afternoon. The whole app ships as one HTML file.
How it works
Three secrets in. Indistinguishable noise out.
-
usernamepasswordAccount Key
You bring three things.
Your username and password stay in your head. The Account Key is a random 128-bit code generated on your device and printed on your Emergency Kit — it makes your vault unguessable even if your password isn’t perfect.
-
Argon2id · 64 MiB · HKDF
Your device derives the keys.
A memory-hard function turns your secrets into a locator key and an encryption key. It runs in WebAssembly we wrote instruction by instruction, tested against the RFC and a reference implementation.
-
block = AES-256-GCM(key, padded data)
Your vault becomes blocks.
Compressed, split, padded and sealed into 4,096-byte blocks, each named by an HMAC of your key. Each save writes a fresh generation and deletes the last — atomically, across all your devices.
-
PUT b/x7k2q… ← proof of work
Anyone can hold them. Only you can open them.
Blocks go to a public bucket. A tiny worker checks a proof of work and rejects anything that isn’t obviously ciphertext — so the bucket can’t become free storage — and then forgets you were there.
For developers
Your secrets, in your shell. Not in your repo.
Store environment variables as an item and inject them straight into any command. No .env files lying around, no secrets in shell history.
- Environments — named sets of variables, pasted from a
.envor typed in. - Two-factor codes — live TOTP codes in the app and in the CLI.
- One file — the CLI runs on Node, Bun or Deno with nothing to install.
$ rspm run --env billing-api-prod -- npm start Password: •••••••••••••••• Account Key: •••••••••••••••••••• ▲ server listening on :8080 (STRIPE_SECRET_KEY, DATABASE_URL set) $ rspm totp aws 482 019 $ rspm get github --field username [email protected]
Sharing
Share a secret. Watch it disappear.
Links that expire on their own — after an hour, a day, or a single view. The key travels in the part of the URL your browser never sends to a server.
Security, honestly
What rspm can’t do.
Every security product has limits. Ours are written down.
It can’t protect a compromised device.
Malware on your computer sees what you see. Encryption ends where your screen begins.
It can’t get your vault back.
Lose your username, password or Account Key and the data is gone. We can’t help — that’s the point.
It can’t unshare a secret.
Expiry deletes the ciphertext. It can’t make someone forget what they read. Rotate what matters.
It can’t make the web app trustless.
Whoever serves the page could change it. So you can check it — or run your own copy.
Don’t trust us. Check.
The app is a single, deterministic HTML file. Rebuild it from the tagged source and compare hashes — or save it and run it from your own disk, forever.
$ curl -s https://rspm.me | shasum -a 256 $ git checkout v0.1.0 && node tools/build.js $ shasum -a 256 dist/rspm.me/index.html
Read every line.
rspm is MIT-licensed. The protocol, the threat model, the hand-written WebAssembly and the tests are all in one small repository. If something looks wrong, it’s on the page.