Coffre.

01 / what it is

A vault where the security model is the project.

Coffre—French for a safe or vault—is a web password manager. It stores encrypted credentials, supports authenticator and email-based second factors, and separates listing an entry from retrieving its password.

The interface is only one part of it. Most of the work lives underneath: deciding which side derives keys, what the API should never receive, how a session expires, and how to make a captured request useless after a short window.

02 / why I built it

I did not want “encrypted” to be a checkbox.

Coffre started as a Bash prototype, moved through a plain HTML version and a template-based build, then became the current web interface. Each version exposed a different assumption I had made too casually.

I wanted to understand what a password manager should actually trust—not just reproduce what one looks like.

That question pulled the project into cryptography, authentication, rate limiting, email delivery, replay protection, deployment, and security logging. The growing scope was not accidental; it was the lesson.

03 / how it works

Separate responsibilities, short-lived trust.

The current design uses browser cryptography for vault operations and a FastAPI backend for authenticated storage and security controls. PostgreSQL holds durable state, while Redis handles temporary state such as short-lived challenges.

Cryptographic direction

Authentication path

signup → email verification → OTP setup → login → OTP → session

Sessions last roughly one hour. Email OTP codes use uppercase letters and digits with a five-minute lifetime; authenticator-based TOTP is also supported. Passwords copied from the vault are cleared from the clipboard after roughly ten seconds.

04 / what went wrong

The useful bugs were architectural.

The first versions made some boundaries too optimistic. Testing replay scenarios pushed the request flow toward expiring nonces and one-time use. User-controlled fields raised XSS questions. Mobile testing found signup text that could become hard to see, while the API documentation once rendered blank.

05 / what I learned

Security is mostly about boundaries and expiry.

Key separation is not an abstract recommendation once several features depend on the same root secret. A nonce matters only if its lifetime and reuse rules are checked. An encrypted database still needs careful session handling, input validation, monitoring, and recovery paths.

Coffre is now live as a public beta and remains under active development. The next useful milestone is not more features—it is tighter auditing, better mobile behavior, and more hostile testing of the flows already there.

06 / Coffre Teams

Coffre for teams

Share passwords and API keys with your team while keeping control over who can access them. Built for startups and small teams.