atpass

atpass is a password manager with an unusual home for your vault: instead of a proprietary server, it stores every vault item as an end-to-end encrypted record in your own atproto (Bluesky) PDS repo. Your PDS operator — and anyone who can read your public repo — sees only ciphertext: how many items you have and roughly when they changed, never titles, usernames, passwords, URLs, or notes. The master password never leaves your machine; it is run through Argon2id to derive a 256-bit key that encrypts each item with AES-256-GCM, with the record key bound in as additional authenticated data so records can't be swapped between items.

It ships as three clients sharing one crypto core: a commander-based CLI, a client-only static web app (Vite + React) that talks directly to your PDS from the browser with the vault key living only in that tab's memory, and a Firefox Manifest V3 extension that autofills vault items into login forms — the derived key stays in the background script's memory and never passes through the popup. The Node and browser crypto adapters (node:crypto with @node-rs/argon2 versus Web Crypto with hash-wasm) are verified byte-for-byte interoperable, so a vault item added from the CLI decrypts correctly in the web app and vice versa. Formal record schemas live in lexicons/ as xyz.atpass.vault.meta and xyz.atpass.vault.item.

The author's own framing is the whole pitch and the whole warning, verbatim: "Vibe-coded AF" — and "This is a testbed for vibe-coding and atproto. This is not something you should trust real passwords with." The README's security-model section is admirably blunt about the threat model: a malicious PDS operator learns nothing about contents, but a weak master password or a compromised local machine is not covered, the handle-plus-App-Password login means the PDS momentarily sees your App Password at sign-in (full OAuth is not implemented yet), and the project has not been independently audited. Recent commits show the author hardening it anyway — randomized 128-bit record keys so item titles can't be fingerprinted, and CLI session tokens encrypted at rest.

It is early — 27 commits, one v0.1.0 release, pushed two days ago — and reads as a working proof-of-concept rather than a Bitwarden replacement. As an experiment in what password management looks like when the "server" is infrastructure you already own, it is one of the more interesting uses of atproto to show up this month.