LPMS

Local Password Management System - a portable, offline encrypted credential vault for Windows.

LPMS replaces a shared password Excel workbook with a real vault: encrypted at rest, multi-user, tag-based access for families, and designed so a crash or flaky USB write is far less likely to wipe your only copy.

No cloud account. No telemetry. No installer required. Your secrets stay in a .vault file you control - on a PC, a thumb drive, or a family NAS share.

---

What the vault is for

A vault (.vault) is the single encrypted database that holds:

• Credentials (type, who, source, usernames/emails, passwords, URLs, notes, favorites, tags)
• User accounts for the vault (each with their own password)
• Tag / compartment grants (who can open which credentials)
• Local audit / integrity metadata

The vault file is ciphertext. Without a user password (or the recovery key), the contents are unreadable. You can copy the .vault between machines the same way you would copy any other file - secrecy travels with the file and the passwords, not with a particular PC.

Typical use: one shared vault on a home NAS (or a trusted PC), opened from Windows machines on the LAN; or the same exe + vault on a USB stick for portable access.

---

Multi-user and families (NAS-friendly)

LPMS is built for secure password management with more than one person:

Role	Intent
SysAdmin	Full vault access, user/tag administration, recovery export
Admin	Day-to-day management within granted tags
Child	Restricted to granted tags only

Credentials can be placed in tags (compartments). Non-SysAdmin users only receive the keys for tags they are granted - so kids can use school/shared logins without seeing parents' banking, and adults can separate Shared vs Private without running separate apps.

That model fits a family NAS setup well:

1. Keep the live MyVault.vault on the NAS (or sync folder everyone trusts).
2. Run lpms.exe on each Windows PC (or from a thumb drive).
3. Open the same vault path; each person unlocks with their own password.
4. After role/tag changes, treat old copies of the vault as stale - keep the NAS copy current and retire old USB backups when access should change.

There is no cloud sync engine and no remote "kick this device offline." Access control is cryptographic grants on the vault you open.

---

How to use it

Requirements

• Windows 10/11
• WebView2 (usually already installed on modern Windows)

On a PC (recommended for daily use)

1. Get a release build of lpms.exe (GitHub Releases) or build from source (docs/BUILD.md).
2. Put lpms.exe somewhere convenient (e.g. C:\Tools\LPMS\ or a folder next to your vault).
3. Run lpms.exe.
4. Create vault (first time) or Open vault and pick your .vault file.
5. Unlock with your user password.
6. Browse, search, copy credentials, add/edit entries, manage tags, and (if SysAdmin) manage users under Admin.

Settings such as auto-lock live with the app/session; the encrypted secrets live only in the vault file.

On a thumb drive (portable)

1. Copy lpms.exe onto the USB drive (one file for the Tauri build).
2. Optionally keep MyVault.vault on the same drive, or keep the vault on a NAS and only carry the app.
3. On any Windows PC with WebView2, run lpms.exe from the stick and open the vault.
4. When finished, lock or exit, then eject the drive cleanly.

Tip: Prefer the vault on a NAS (or a second backup location) even if the app lives on USB. A single stick that holds the only copy of both app and vault is convenient - and fragile if the stick dies.

Family NAS pattern

\\NAS\Family\LPMS\
  MyVault.vault          <- live encrypted vault (share this path)
  backups\               <- dated .vaultbak copies (optional but recommended)

Each PC or USB:
  lpms.exe               <- app only; open the NAS vault path

Everyone opens the same vault file; each person has their own LPMS user and password. Use tags so Shared vs Private (or Kids vs Adults) stay separated.

First-time setup checklist

1. Create the vault and SysAdmin account.
2. Save the recovery key offline when offered (paper / password manager / sealed note). LPMS cannot reset encryption without it if passwords are lost.
3. Add family users and grant tags.
4. Import from Excel if you are migrating (docs/EXCEL_IMPORT.md).
5. Create an encrypted backup (.vaultbak) and store it somewhere other than the live vault folder.

---

Fighting data loss and corruption

LPMS treats integrity as a first-class goal, not an afterthought:

Protection	What it does
Atomic saves	Writes go to .vault.new, get validated, then the previous good file becomes .vault.previous and the new file is promoted. A crash mid-write should not leave you with only a half-written primary.
Automatic recovery	On open, if the primary is bad, LPMS can fall back to .previous or a complete .new.
CRC + parse checks	Truncated or structurally damaged files are rejected instead of silently trusted.
AEAD encryption	AES-256-GCM authenticates ciphertext; tampering fails closed.
Encrypted backups	.vaultbak files are full encrypted vault images. Restore validates before replace.
Integrity report	Admin can run verification without dumping secrets into the UI.

What still loses everything: one copy of the vault on a dying disk/USB with no backup, or forgetting both every user password and the recovery key. There is no vendor backdoor.

Recommended habit: after major changes (import, new users, tag redesign), create a .vaultbak on a second medium. Keep the recovery key offline. Do not treat "OneDrive alone" as a backup if that is also where the only live vault lives.

Details: docs/VAULT_FORMAT.md, docs/SECURITY.md, docs/THREAT_MODEL.md.

---

Security model (short)

• In scope: lost/stolen vault or backup files; offline guessing; casual idle access (auto-lock); clipboard clear; ciphertext tampering.
• Out of scope: malware on a machine while the vault is unlocked (keyloggers, memory scrapers, etc.).

Crypto summary: Argon2id password KDF, AES-256-GCM, per-vault recovery key via HKDF, all key material owned by the Rust core. The UI never receives master keys; password copy is handled in Rust.

---

Architecture

lpms.exe (Tauri 2)
├── WebView UI (HTML/CSS/TypeScript) - presentation only
└── Rust commands + lpms_core - crypto, vault I/O, backups, clipboard copy

A legacy WPF UI remains under src/LPMS.App for reference and alternate builds; the primary desktop path is Tauri.

---

Build from source

See docs/BUILD.md.

Quick path (Windows):

# From repo root
.\build-tauri.bat
# or
.\run.bat

---

Documentation

Document	Contents
docs/BUILD.md	Build and portable packaging
docs/SECURITY.md	Cryptographic architecture
docs/THREAT_MODEL.md	In-scope / out-of-scope threats
docs/VAULT_FORMAT.md	Binary format, atomic save, recovery
docs/CREDENTIAL_SCHEMA.md	Credential fields and list DTOs
docs/EXCEL_IMPORT.md	Migrating from Excel workbooks
docs/ARCHITECTURE.md	Design decisions
docs/TAURI_SECURITY.md	Desktop host security boundary
docs/FFI.md	Legacy C ABI (WPF)
docs/DEPENDENCIES.md	Dependency inventory
SECURITY.md	How to report vulnerabilities
CONTRIBUTING.md	Contribution guidelines

---

Repository layout

LPMS/
├── apps/desktop/       # Tauri frontend (Vite + TypeScript)
├── src-tauri/          # Tauri host + IPC commands
├── src/lpms_core/      # Rust security core
├── src/LPMS.App/       # Legacy WPF UI
├── docs/               # Design and security docs
├── tests/              # Extra test placeholders / fixtures
├── build-tauri.bat     # Release build (Tauri)
├── build.bat           # Legacy WPF portable build
└── run.bat             # Launch Tauri (or: run.bat legacy)

---

License

GNU General Public License v2.0 (GPL-2.0) - see LICENSE.