A password manager that lives on my own machine, in my own file, behind my own master password — with no cloud, no account, no telemetry, and, most importantly, no back door. It sits quietly in the system tray, fills login forms in Edge from a keystroke, keeps secure notes blurred until I ask for them, and generates passwords that are either pure noise or a saying I can actually remember. If the master password is gone, the data is gone. That is not a shortcoming. That is the entire point.
Why I Built This
I have used commercial password managers for years, and for years I told myself the trade-off was fine: convenience in exchange for trusting somebody else’s servers, somebody else’s code, and somebody else’s promises. I do not tell myself that any more. Big vaults are big targets, and the news has repeatedly shown what happens when one of them is breached — encrypted blobs walk out of the door together with enough metadata to make them worth attacking at leisure.
But the breaches are not really what pushed me over the edge. What pushed me was the direction of travel in politics, and especially here in the EU. Under the banner of fighting crime — and it is always a banner nobody can argue with — there is a steady, patient push into the private sphere of ordinary citizens: proposals to scan private messages before they are encrypted, recurring attempts to require “lawful access” to encrypted systems, ever-broader data retention. Each individual step is presented as narrow, proportionate and temporary. Taken together, they describe a world in which the default assumption is that your private data should be readable by somebody other than you.
Here is the thing that gets lost in those debates: there is no such thing as a back door that only the good guys can walk through. A key that exists can be stolen, subpoenaed, leaked or abused. A scanning mechanism built for one purpose is a mechanism that can be pointed at another purpose by the next government, or the one after that. The only architecture that cannot be quietly repurposed is the one where the key never existed anywhere but in the user’s head.
So I built HWSecret — a personal vault where I can read every line of the code that touches my secrets, where nothing ever leaves the machine, and where there is provably nothing to hand over. No recovery key, no escrow, no “account recovery” flow, no support line that can reset anything. Lose the master password and the vault is a brick. I would rather carry that risk myself than outsource it to somebody who can be compelled.
HWSecret is the first of my tools that was built 100% vibe coded, from the very first empty folder — with the help of Claude Opus it grew from “encrypt a file with a password” into a complete tray application with browser form filling, global hotkeys, a Windows 11 interface and a two-mode password generator. I only had to step in and change code myself a handful of times. Most of it was a conversation: I described what I wanted, tried it on real hardware, said what still bothered me, and the vault sharpened itself one small step at a time.
What Is HWSecret?
HWSecret is a self-contained Windows password manager. It keeps web logins and secure notes in a single encrypted file called vault.hwsecret, which lives next to the executable — so the whole thing is portable: copy the folder to a stick and your vault comes with it. There is no installer, no service, no database engine, no account, and not a single network call except the one optional feature that explicitly asks the internet for a saying.
Day to day it lives in the system tray. A global hotkey — Ctrl+W by default — brings the window up from anywhere, and so does a double-click on the tray icon or its context menu. The icon itself tells you the state at a glance: a closed padlock when the vault is locked, an open one when it is not. Unlock it once with the master password and everything is there; walk away and it locks itself again.
The Encryption — and Why There Is No Back Door
This is the part that matters, so let me be precise rather than vague. The master password is never stored anywhere, in any form. It is stretched into a key using PBKDF2-HMAC-SHA-256 with 600,000 iterations and a 32-byte random salt that is unique to your vault. That derived key does not encrypt your data directly — it only unwraps a 512-bit vault key that was generated from the operating system’s cryptographic random source when the vault was created. The vault key then protects the actual payload with AES-256 in CBC mode, authenticated with HMAC-SHA-256 in an encrypt-then-MAC construction, with a separate 256-bit key for the MAC and a context string mixed in so a block from one part of the file can never be replayed into another.
The practical effect of that indirection is nice: changing the master password re-wraps the vault key with a fresh salt and never touches a byte of the encrypted payload. And the authentication code means a tampered vault file is rejected, not silently half-decrypted into garbage.
So How Strong Is That, Really?
Honest answer: the cipher is not the weak link, and it never was. Nobody is going to brute-force a 256-bit AES key — 2256 is not a big number, it is a number with no physical meaning. The only realistic attack on a file like this is to guess the master password, and that is exactly what the 600,000 iterations are for. They make every single guess expensive.
Some arithmetic to put it in perspective. Public hashcat benchmarks put a high-end consumer GPU at roughly 1.75 million PBKDF2-HMAC-SHA-256 hashes per second at 1,000 iterations. That rate scales inversely with the iteration count, so at 600,000 iterations the same card manages on the order of 3,000 guesses per second — not billions, thousands. Now take a 16-character password from HWSecret’s own generator using its default character sets (72 possible characters): that is about 5 × 1029 combinations. Against a single such GPU you are looking at something like 1026 seconds. Hand the attacker a billion of those GPUs running in parallel and they are still on the order of the age of the universe.
The flip side is equally honest: none of that helps if the master password is your dog’s name. Slow hashing multiplies the attacker’s cost, it does not create entropy out of nothing. A short or common password will fall to a dictionary run regardless of how many iterations sit in front of it. That is precisely why the generator is a first-class part of the app rather than an afterthought — and why the app deliberately refuses to impose complexity rules on the master password itself. Your vault, your judgement.
- No recovery. There is no escrow key, no reset link, no secret second password. The code contains nothing that could decrypt the vault without the master password, because no such thing was ever written.
- No network. Nothing is uploaded, synced, phoned home or checked for updates. There is no server to breach and no account to compromise.
- Nothing to hand over. If somebody demands the data, there is genuinely nothing to give but an encrypted file — and I cannot be forced to produce a key I never wrote down.
Say it plainly: if the master password is lost, the passwords are lost. That is not a bug to be fixed in a later version. It is the guarantee.
Web Logins That Actually Fill the Form
A vault you have to copy and paste out of is a vault you stop using. So web logins carry two separate address fields, and the distinction turns out to matter. Website is the page you want to go to — the target of the “Goto site” button. URL match is just a fragment of text that has to appear in the browser’s address for this entry to be considered relevant, for example contoso.com. HWSecret watches the address of the active Microsoft Edge tab, and when it matches, a small green dot lights up next to the field so you can see at a glance that this entry belongs to the page in front of you.
Filling is done the way a human would: the credentials are typed into whatever field currently has the focus, as real keystrokes. No browser extension, no injected JavaScript, no automation interface into the browser’s password store — and therefore no extra attack surface sitting inside the browser. There are two buttons, Fill user and Fill password, deliberately separate, because plenty of sites nowadays ask for the username first, think about it, and only then show the password box.
Without Ever Opening the Window
Since the field has to have the focus anyway, the fastest path skips the app entirely. Two global hotkeys — Ctrl+1 for the username and Ctrl+2 for the password by default, both freely configurable — do the filling directly. Click the username box in Edge, press the hotkey, done. The neat part is that those hotkeys are only registered while a matching login exists for the page you are on, and the tray icon shows a green badge to tell you so. On every other page the keys belong to the browser again, exactly as they should.
Secure Notes That Do Not Shout
Recovery codes, licence keys, the answer to a security question you invented years ago — the things that do not fit into a username-and-password shape. Secure notes hold them, and they are treated as secrets rather than as text. By default a note is shown blurred, and only becomes readable when you click the small eye in the corner of the card. Select something else and it blurs again straight away, so a note never quietly stays open on screen.
There is a detail here I am rather fond of, because it is exactly the sort of thing that quietly ruins a security feature: the list of items used to show the first line of each note as a preview. A blurred detail view is worth very little if the same text is sitting in plain sight two centimetres to the left. So while blurring is switched on, the list simply says Hidden. The whole behaviour can be turned off in the settings for anyone who finds it fussy.
Two Ways to Make a Password
The generator earned its own place in the navigation rail, because it grew into something more interesting than the usual slider-and-three-checkboxes affair.
Random Characters, Your Way
The random mode works with four character groups — uppercase, lowercase, digits and special characters — and every one of them is editable. The full alphabet is there by default, and if a particular site refuses a certain symbol, or you simply cannot stand telling O from 0, you delete the offending characters from the box and they are gone. Each group also carries a weight from 1 to 10, which decides how big its share of the password will be, so you can ask for “mostly letters with a sprinkle of symbols” instead of an even scatter. Every enabled group is guaranteed to appear at least once, and the result is drawn from a cryptographic random source with unbiased index selection — no modulo skew.
Sentence Initials — a Password You Can Recite
The second mode is the one I actually enjoy using. It goes online, finds a proverb or idiom — in English or German, from Wiktionary’s proverb and idiom categories, with a Wikipedia sentence as a fallback — with as many words as you asked for, and builds the password from the first letter of each word. “Don’t watch the clock; do what it does. Keep going.” becomes DwtcdwidKg. Special characters and digits are then woven in, either a chosen number of them scattered at random positions, or one after every n characters. The saying itself is shown underneath, so you can memorise the sentence and reconstruct the password in your head.
And because honesty is worth more than marketing, the app says so on screen, in amber: a password you can remember is easier to guess than one you cannot. Sentence mode trades entropy for memorability. Use it for the things you have to type from memory, and use pure random for everything the vault types for you.
Small Guards, Constantly on Duty
A Clipboard That Cleans Up After Itself
Copying a password puts it into the clipboard, where every other program on the machine can read it. So HWSecret clears it again after a configurable delay. The important subtlety is that it only clears its own content: it remembers a fingerprint of what it put there, and if you have copied something else in the meantime, your text is left alone. A password manager that wipes your clipboard out from under you is a password manager you disable.
Locking, on Your Terms
The vault locks itself after a period of inactivity — and if you enter 0, it never does, because there are machines where that is the right answer and I dislike software that argues. There is a Lock & Close button for when you are done, an Unlock vault entry in the tray menu that shows nothing but a password prompt and disappears again, and the tray icon that always tells you which state you are in. Locking clears the keys from memory; the green match indicator and the fill hotkeys only work while the vault is open.
Saving Without Losing
The vault is written atomically: a new file is built, verified, and only then swapped into place, with the previous version kept as a .bak. A power cut in the middle of a save cannot leave you with half a vault — which, when the file is everything, is not a nicety.
An Interface That Looks Like It Belongs
HWSecret follows the Windows 11 look, including the light and dark theme setting of the system, and switches with it. The window has a custom title bar with its own settings and about icons, and inside there is a navigation rail on the left — All items, Web Logins, Secure notes, Favorites, Password generator — with the content on the right, in the manner of the Windows Settings app. List cards carry a thin coloured stripe on their right edge so a web login and a note are distinguishable at a glance, and the search box filters as you type, with a small clear button that appears when there is something to clear.
The settings live in a tabbed dialog — Appearance, Hotkey, Filling, Security — organised specifically so that nothing ever has to be scrolled, and the about box is a single tidy card. All of it is stored in one HWSecret.json next to the executable, falling back to your per-user app-data folder if the program directory happens to be read-only, so the app stays genuinely portable.
Built Entirely by Conversation
Every one of my other tools started as code I had written at some point and then modernised with Claude’s help. HWSecret did not. It began as an empty directory and a paragraph describing what I wanted, and grew from there in a long series of small, concrete requests: put it in the tray; use the window frame from my scanner tool; the settings dialog scrolls, fix it; the layout on the left should look like Windows Settings; make the search box behave; add an eye to the password field; now build me a proper generator; now make it find proverbs.
What surprised me was how much of the work was finding things rather than writing them. A WPF style that silently did not apply to any of my windows. A tab control whose content was invisible to accessibility tools. A text box with double padding. A checkbox that fired its event handler while the window was still being built and crashed the app on startup. A note field that was half-hidden because a layout row had been starved and quietly overlapped the row below it. None of those were things I asked for — they were caught by measuring the running application rather than trusting that it looked about right.
I had to reach into the code myself only a handful of times. The rest was describe, test, describe again.
Where It Stands Today
Version 1.0.0.0 is finished and frozen. It holds web logins and secure notes in an AES-256 vault behind a 600,000-iteration key derivation; it lives in the tray with a global hotkey and a state-aware icon; it fills forms in Edge from buttons or from context-sensitive hotkeys with a green dot to tell you when an entry matches; it blurs notes until you ask; it clears only its own clipboard content; it locks itself when you want and never when you do not; it generates passwords from four weighted, editable character groups or from proverbs in two languages; and it wears the Windows 11 theme you already chose.
Application logins — for the programs that are not web pages — are the obvious next chapter, and there is already a place reserved for them next to Web Logins. But that is a story for a later version.
What it is today is a vault I trust, for the simple and slightly old-fashioned reason that I can read every line that touches my secrets, and there is nothing in there but the lock. No cloud, no account, no telemetry, no recovery, no back door — by construction rather than by promise.
The best guarantee that a key cannot be handed over is that it was never anywhere to be taken from. HWSecret is my answer to a decade of being asked to trust somebody else with mine.
Download will be available soon.
© 2026 by Helmut Wagensonner. HWSecret is a personal project. All product and company names are trademarks of their respective owners.